Achieving Trust-Based and Privacy-Preserving Customer Selection in Ubiquitous Computing

TL;DR

This paper introduces TPCS, a trust-based, privacy-preserving customer selection scheme for ubiquitous computing that ensures reliable task assignment while protecting data processors' identities using cryptographic techniques.

Contribution

The paper proposes a novel trust-based customer selection scheme that integrates privacy preservation and security features for ubiquitous computing environments.

Findings

TPCS effectively identifies trustworthy customers with high accuracy.

The scheme maintains privacy of data processors through cryptographic methods.

Security analysis confirms robustness against various attacks.

Abstract

The recent proliferation of smart devices has given rise to ubiquitous computing, an emerging computing paradigm which allows anytime & anywhere computing possible. In such a ubiquitous computing environment, customers release different computing or sensing tasks, and people, also known as data processors, participate in these tasks and get paid for providing their idle computing and communication resources. Thus, how to select an appropriate and reliable customer while not disclosing processors' privacy has become an interesting problem. In this article, we present a trust-based and privacy-preserving customer selection scheme in ubiquitous computing, called TPCS, to enable potential processors select the customers with good reputation. The basic concept of TPCS is that each data processor holds a trust value, and the reputation score of the customer is calculated based on processors' trust values and feedbacks via a truth discovery process. To preserve processors' privacy, pseudonyms and Paillier cryptosystem are applied to conceal each processor's real identity. In addition, three authentication protocols are designed to ensure that only the valid data processors (i.e., the processors registering in the system, holding the truthful trust values, and joining the computing tasks) can pass the authentication. A comprehensive security analysis is conducted to prove that our proposed TPCS scheme is secure and can defend against several sophisticated attacks. Moreover, extensive simulations are conducted to demonstrate the correctness and effectiveness of the proposed scheme.

Tables

Table 1. Table 1: The Parameters for evaluation

Notation	Definition	Value
$\kappa ,{\kappa }_1$	security parameter	$\kappa ,{\kappa }_1=512$
$q$	Generator of Bilinear Pairing	$q=512$
$p_1,p_2$	Generator of Paillier cryptosystem	$p_1,q_1=512$
$m_h$	number of customers	$10$
$sum$	number of processors	$50$
$\rho$	malicious processor proportion	$20\%$
$T_0$	initial trust value	$0.01$
$c_0$	reward sensitivity	0.1
$c_1$	forgetting factor	0.85
$\alpha$	impact factor parameter	$0.3$
$v$	number of iterations	10
$U_{threshold}$	threshold which triggers set update	0.5
$F_{threshold}$	threshold which triggers reward	0.2
$T_{threshold}$	threshold which triggers circuit-breaker	$0.5$

Equations

$$e(P,\sum _{j=1}^{sum}{\sigma }_j)$$

$$=\prod _{j=1}^{sum}e(P,x_{j}H(PI{D}_j||Y_j||F{R}_j||T{R}_j||{\text{proof}}_{jk}))$$

$$=\prod _{j=1}^{sum}e(Y_j,H(PI{D}_j||Y_j||F{R}_j||T{R}_j||{\text{proof}}_{jk})).$$

$$e(Y_k,\sum _{j=1}^{sum}{\text{proof}}_{jk})$$

$$=\prod _{j=1}^{sum}e(x_{k}P,x_{j}H({\alpha }_j+{\alpha }_k))$$

$$=\prod _{j=1}^{sum}e(P,x_k{x}_{j}H({\alpha }_j+{\alpha }_k))$$

$$=\prod _{j=1}^{sum}e(x_{j}P,x_{k}H({\alpha }_j+{\alpha }_k))$$

$$=\prod _{j=1}^{sum}e(Y_j,{\text{proof}}_{kj}).$$

$$g^{H_1(t_c||\chi )}\cdot \sum _{j=1}^{sum}{\tilde{C}}_j$$

$$=(H_1(t_c||\chi ){)}^n\cdot \sum _{j=1}^{sum}\widetilde{{\mathfrak{C}}_j}$$

$$C_1$$

$$=\prod _{j=1}^{sum}{g}^{T_j{f}_j}\cdot (r_j\cdot r_j^{\prime }\cdot H_1(t_c||\chi ){)}^{n{f}_j}\text{mod}{n}^2$$

$$=g^{{\sum }_{j=1}^{sum}{T}_j{f}_j}\cdot (\prod _{j=1}^{sum}(r_j{r}_j^{\prime }{H}_1(t_c||\chi ){)}^{f_j}{)}^n\text{mod}{n}^2$$

$$C_2$$

$$=g^{{\sum }_{j=1}^{sum}{T}_j}\cdot (\prod _{j=1}^{sum}(r_j{r}_j^{\prime }{H}_1(t_c||\chi )){)}^n\text{mod}{n}^2$$

$${\sigma }_r=x_{r}H({\text{ph}}_k||T{r}_k||C_1||C_2||\{PI{D}_j||f_j{\}}_{j=1}^{sum}).$$

$$R{S}_k$$

$$=\frac{{\sum }_{j=1}^{sum}{T}_j{f}_j}{{\sum }_{j=1}^{sum}{T}_j}.$$

$$|f_j-R{S}_k^{(v)}|<U_{threshold},$$

$$w_j^{(v)}=\log (\frac{{\sum }_{v_j\in {\mathcal{V}}_k^{(v)}}d(f_j,R{S}_k^{(v)})}{d(f_j,R{S}_k^{(v)})}),$$

$$R{S}_k^{(v+1)}=\frac{{\sum }_{v_j\in {\mathcal{V}}_k^{(v)}}{w}_j^{(v)}\cdot f_j}{{\sum }_{v_j\in {\mathcal{V}}_k^{(v)}}{w}_j^{(v)}}.$$

$$T_{j}=\left\{\begin{array}[]{rcl}1-|f_{j}-RS_{k}|^{v\cdot c_{0}}&&|f_{j}-RS_{k}|<F_{threshold}\\ 1-|f_{j}-RS_{k}|&&otherwise\\ \end{array}\right.$$

$$T_{j(i+1)}=\alpha \times T_{j(i-1)}+(1-\alpha )\times T_{ji},$$

$$T_{j(i+1)}=\left\{\begin{array}[]{rcl}T_{0}&&T_{j(i-1)}-T_{ji}>T_{threshold}\\ T_{j(i+1)}&&otherwise\\ \end{array}\right.$$

Full text

††journal: Information Sciences

1 Introduction

Nowadays, the fast development of smart devices (e.g., vehicles [45, 47], implantable medical devices [12, 13], wearable devices [19]) embedded with increasingly powerful computational and communication resources, has given rise to ubiquitous computing, a revolutionary computing paradigm which integrates surrounding devices to provide numerous novel services at anytime, anywhere, and by any means [25]. In ubiquitous computing, all objects (e.g., smart devices, human bodies, wireless sensors) can be considered as computers or data processors. These objects, besides serving themselves, can also participate in different computing tasks released by the resource-constrained customers (e.g., individual users, companies, organizations), and get paid by providing their idle resources. By doing so, ubiquitous computing is able to greatly make use of surrounding idle resources and drastically change the ways we live and obtain services.

Although many benefits can be gained by ubiquitous computing, some new challenges arise. Since the processors will run automatically under the control of the customers, the reliability of customers is particularly important. Some customers may unintentionally or intentionally abuse processors’ resources, give unexpected reward, or even put processors in dangerous situations. For instance, by utilizing the computing capacities of surrounding vehicles, traffic problems such as route navigation or environmental monitoring can be resolved. However, some malicious customers may give rewards which do not match processors’ workloads, or collect vehicles’ private information such as location and driving habits. Thus, it is essential to identify such customers before joining a ubiquitous computing task. Normally, the performances of customers can be judged by processors’ feedbacks [14, 15]. However, the problem here is that the feedbacks given by different processors may vary significantly due to different working loads, incomplete views of observations, or even malicious evaluations. When aggregating these feedbacks, traditional methods such as voting or averaging, which treat all processors equally are not suitable.

An ideal approach to resolve the above challenge is to involve trust values for all processors and make the aggregated reputation scores closed to the feedbacks provided by reliable processors. Nevertheless, another critical issue which must be addressed is the privacy of processors. Although pseudonymous [39] and anonymous authentication [16, 41] can be used to conceal processor’s identity information, processors’ location and trajectory privacy may still be disclosed by linking their trust values. To illustrate, we consider a scenario in Fig. 1. At time $t_{1}$, two processors (i.e., the cell phone and the vehicle) join a task, and at time $t_{2}$ and $t_{3}$, they join different tasks respectively. Although their pseudonyms have been changed, their trust values (i.e., $\text{Trust}_{A}$ and $\text{Trust}_{B}$) remain unchanged in a certain period of time. By linking their trust values, the trajectories of the processors can be easily reconstructed. Hence, it is important to design a trust-based customers selection scheme which does not sacrifice processors’ privacy.

In order to address the above challenges, we present a trust-based and privacy-preserving customer selection scheme, called TPCS, to rank the customers according to processors’ feedbacks while not disclosing their privacy. The general process of TPCS can be described as follows. After finishing a ubiquitous task, processors deliver their feedbacks and encrypted trust values to the roadside units (RSUs), which will collaborate with the Service Provider (SP) to calculate the customer’s reputation score using a truth discovery method. During the whole process, processors’ privacy will not be disclosed to any other parties. Below, we have summarized the major contributions of this work.

First, we design a filtering truth discovery based evaluation algorithm to process the feedback information received from processors. By this algorithm, the proposed scheme can effectively estimate the performances of customers and processors. This allows optimal selection of customer in a ubiquitous computing environment.

• 2.

Second, we use pseudonyms and Paillier cryptosystem to protect data processors’ privacy. Moreover, three authentication protocols are designed to ensure that only the legitimate processors can pass the authentication. To the best of our knowledge, our work is the first attempt to resolve the security and privacy issues in customers selection in the ubiquitous computing environment.

• 3.

Third, we conduct a comprehensive security analysis to demonstrate that the scheme presented is not only secure, but can also defend against different sophisticated attacks. Additionally, extensive simulations are performed to validate the correctness & effectiveness of TPCS.

The rest of paper has been organized into 8 sections, where system and threat model along with design goals have been discussed in section 2, followed by preliminary discussion in Section 3. The TPCS scheme functionality is explained in section 5, and its security analysis & evaluation are presented in section 6. Related works and conclusion are detailed in sections 7 and 8 respectively.

2 Models and Design Goal

In order to better present the proposed scheme, we first describe the system model, and give details of the threat model. Based on these, we develop the design goals of our proposed scheme.

2.1 System Model

The overall model considers a typical scenario of ubiquitous computing. The RSUs are widely deployed in a given area, and all customers and processors can communicate with RSUs through their communication resources. Particularly, the system consists of a trust authority (TA), RSUs, a service provider (SP), customers, and processors, as shown in Fig. 2.

Trust Authority (TA): This entity is in charge of all participating parties, and also maintains a database to store processors’ trust values. We assume that it is fully capable of storing and performing computation on data generated by other entities. After receiving processors’ trust values, it can predict their future behaviors based on historical data.

• 2.

Service Provider (SP): SP connects all RSUs and stores feedbacks and trust values sent from these roadside units. Upon receiving the data, SP executes a truth discovery based evaluation algorithm to calculate the reputation scores for customers. Similarly, for the query of a potential processor for the task join request, SP can respond it by recommending the customers with high reputation scores.

• 3.

Roadside Units (RSUs): RSUs are subordinates of SP. They are widely deployed and can cover a wide area. They collect processors’ feedbacks and trust values, and then forward them to SP. In particular, they have limited computation capacities, which ensures that they can authenticate processors’ identities and perform aggregation operations.

• 4.

customers: customers can be companies, individual processors, vehicles, and organizations. They have insufficient computation and communication capabilities to perform the tasks by themselves, so they give benefits to hire processors to help them finish their tasks.

• 5.

Processors: Each processor is embedded with computation and communication units which enable them automatically perform the sensing, computation, and communication tasks received from the customers. After finishing the tasks, each of them will upload its feedback to the nearby RSU for customer evaluation. Besides, the processors update their trust values from TA at regular intervals.

2.2 Threat Model

TA is fully trusted because it generates the public and private keys for all roles. We assume TA is under strong physical protection and cannot be compromised. SP and RSUs are both considered to be honest but curious. In other words, they will honestly perform the given tasks but try to infer processors’ location and trajectory privacy by linking their identities or trust values. Note that, SP and RSU will not collude with each other. This is a common assumption in existing fog-based applications [24, 40, 42]. The customers are supposed to control the whole ubiquitous computing task. However, their performances may vary differently. For any customer, its performance may change constantly in different tasks. As for the processors, they are required to submit their feedbacks and trust values after each task. However, some selfish or malicious processors may provide untruthful feedbacks, or some attackers outside the tasks may give fake feedbacks for their own benefits or with the intention of disrupting the entire system. For example, a healthcare center may hire some processors (e.g., patients’ wearable devices, surrounding vehicles or smartphones) to help it in providing medical care services. However, a competitor, which may be another healthcare center, may maliciously provide negative comments, hoping that the processors would not join the tasks released by this center.

2.3 Design Goals

Using earlier described system model, the goal is to build a trust-based and privacy-preserving customer selection scheme in ubiquitous computing. In particular, the following objectives should be captured.

Privacy: The proposed scheme should preserve processors’ privacy. That is, other parties cannot infer processors’ location and trajectory information based on the given data.

• 2.

Security: The proposed scheme should defend against different sophisticated attacks, such as badmouth attack and on-off attack. In addition, some processors may provide fake trust values and feedbacks. The proposed scheme must be resilient to these attacks.

• 3.

Accuracy: The proposed scheme should accurately calculate the reputation scores of the customers according to processors’ feedbacks. Besides, the scheme should identify malicious and honest processors, and further give prediction of their future trust values.

3 Preliminaries

Bilinear pairing and Paillier cryptosystem are two foundation elements in the proposed scheme. Hence, we introduce them in this section.

3.1 Bilinear Pairing

Let $\mathbb{G}$ and $\mathbb{G}_{T}$ be two multiplicative cyclic groups of the same large prime order $q$. Then, the following three properties can be satisfied by a bilinear map $e:\mathbb{G}\times\mathbb{G}\rightarrow\mathbb{G}_{T}$.

Bilinear: $e(aP,bQ)=e(P,Q)^{ab}$, for all $P,Q\in\mathbb{G}$ and $a,b\in\mathbb{Z}^{*}_{q}$.

• 2.

Non-degenerated: $e(P,P)\neq 1$, for any $P\in\mathbb{G}$.

• 3.

Computable: $e(P,Q)$ can be efficiently computed for all $P,Q\in\mathbb{G}$.

We refer to [1, 6, 38] to provide a more comprehensive description and definition for this technique.

Definition 1

A bilinear parameter generator $\mathcal{G}en$ is a probabilistic algorithm which takes a security number $\kappa$ as input, and outputs a 5-tuple $(q,P,\mathbb{G},\mathbb{G}_{T},e)$, where $q$ is a large prime with $\kappa$ bits, $(\mathbb{G},\mathbb{G}_{T})$ are two multiplicative groups with the same order $q$, $P\in\mathbb{G}$ is a generator, and $e:\mathbb{G}\times\mathbb{G}\rightarrow\mathbb{G}_{T}$ is an efficiently computable bilinear group with the property of non-degeneracy.

Definition 2** (Computational Diffie-Hellman (CDH) Problem)**

Given the elements $(P,aP,bP)\in\mathbb{G}$, there exists no probabilistic and polynomial time algorithm to calculate $abP\in\mathbb{G}$ with non-negligible probability of success.

3.2 Paillier Cryptosystem

This cryptosystem is a form of encryption which supports multiplication operations on the ciphertexts. Due to the homomorphic properties, it has been widely used in various privacy-preserving applications [32]. Fundamentally, it consists of the following three algorithms:

Key Generation: Given a large security parameter $\kappa_{1}$, and two large primes $p_{1},q_{1}$, where $|p_{1}|=|q_{1}|=\kappa_{1}$. Then, $n=p_{1}q_{1}$ and $\lambda=lcm(p_{1},q_{1})$ are computed, where $lcm(a,b)$ is a function to compute the least common multiple of $a$ and $b$. Define a function $L(c)=\frac{c-1}{n}$, $\mu$ is calculated as $(L(g^{\lambda}\ \text{mod}\ n^{2}))^{-1}\ \text{mod}\ n$, where $g\in Z^{*}_{n^{2}}$ is randomly chosen. Then, the public key $pk$ and secret key $sk$ are generated as $pk=(n,g)$ and $sk=(\lambda,\mu)$ respectively.

• 2.

Encryption: Given a message $m\in\mathbb{Z}_{n}$, the ciphertext is calculated as $c=E(m)=g^{m}\cdot r^{n}\ \text{mod}\ n^{2}$, where $r\in\mathbb{Z}^{*}_{n}$ is randomly chosen.

• 3.

Decryption: Given a ciphertext $c\in\mathbb{Z}^{*}_{n^{2}}$, the ciphertext can be decrypted as $m=D(c)=L(c^{\lambda\ \text{mod}\ n^{2}})\cdot\mu\ \text{mod}\ n$. The correctness and security of the Paillier cryptosystem has been proven in [29].

In particular, the Paillier cryptosystem satisfies the following homomorphic properties:

For any $m_{1},m_{2}\in\mathbb{Z}_{n}$, $E(m_{1})\cdot E(m_{2})=E(m_{1}+m_{2})$.

• 2.

For any $m_{1},a\in\mathbb{Z}_{n}$, $E(m_{1})^{a}=E(am_{1})$.

4 TPCS Scheme

The proposed trust-based and privacy preserving customer selection scheme includes system initialization, system overview, report generation, report aggregation, feedback evaluation, and trust value evaluation.

4.1 System Initialization

Given security parameters $\kappa$ and $\kappa_{1}$, TA first generates a 5-tuple $(q,P,\mathbb{G},$ $\mathbb{G}_{T},e)$ by executing $\mathcal{G}en(\kappa)$, and generates the public key $(n=p_{1}\cdot q_{1},g)$ and private key $(\lambda,\mu)$ of the Paillier cryptosystem. Then, TA selects two secure cryptographic hash functions $H$ and $H_{1}$, where $H:\{0,1\}^{*}\rightarrow\mathbb{G}$ and $H_{1}:\{0,1\}^{*}\rightarrow\{0,1\}^{\kappa_{1}}$. Before joining the system, all customers, processors, and RSUs are required to register themselves with TA. Specifically, TA selects a secure symmetric encryption algorithm $AES_{k_{0}}$ by choosing a symmetric key $k_{0}$. For every registered customer or processor $v_{i}$ with its real identity $ID_{i}$, TA creates a group of pseudonyms $\{PID_{i0},PID_{i1},\cdots,PID_{iN}\}$, and generates the public and private key pairs as $Y_{ij}=x_{ij}P$ for $j=\{0,1,\cdots,N\}$, where $x_{ij}\in\mathbb{Z}^{*}_{q}$ is a random value and $PID_{ij}=AES_{k_{0}}{(ID_{i}||x_{ij})}$. Then, TA selects a secure number $\chi\in\mathbb{Z}^{*}_{n}$ to encrypt each processor’s trust value $T_{i}$ as $C_{i}=g^{T_{i}}\cdot(r_{i}\cdot H_{1}{(t_{c}||\chi)})^{n}\ \text{mod}\ n^{2}$, where $t_{c}$ is the current update time and $r_{i}\in\mathbb{Z}^{*}_{n}$, and then generates the corresponding trust signature as $\mathfrak{C}_{i}=C_{i}\cdot g^{H_{1}{(t_{c}||\chi)}}=g^{T_{i}+H_{1}{(t_{c}||\chi)}}\cdot r^{n}_{i}\ \text{mod}\ n^{2}$. Note that the trust signature is used to verify if the trust value is fresh. For every registered RSU, TA selects a random element $x_{r}\in\mathbb{Z}^{*}_{q}$ as secret, and calculates the public key as $Y_{r}=x_{r}P$. Finally, TA sends the parameter $\{\{PID_{ij},x_{ij},Y_{ij}\}^{N}_{j=1},t_{c},C_{i},\mathfrak{C}_{i},n,\mathbb{G},\mathbb{G}_{T},e,H\}$ to each customer or processor, $\{n,g,\chi,P,\mathbb{G},\mathbb{G}_{T},e,x_{r},Y_{r},$ $H\}$ to each RSU, and $\lambda$ to SP.

4.2 Scheme Overview

When a processor joins a task, it first creates a handshake proof with the customer to prove that it has joined this task. After finishing the task, both processor and customer are required to generate their own task reports and deliver them to RSU. Then RSU verifies the processor’s validity, i.e., to verify the processor’s task report, handshake proof, and trust value. It then uses processors’ trust values and feedbacks to calculate the customer’s reputation score. Following this, the RSU delivers the reputation score and feedbacks to SP, which will be then used to evaluate the customers’ performances. Finally, SP sends processors’ trust values to TA, and TA will predict their future performances based on the historical data. This complete process is shown in Fig. 3.

4.3 Report Generation

When a processor $v_{j}$ with $(\text{PID}_{j},x_{j},C_{j},\mathfrak{C}_{j})$ finishes a task organized by a customer $\text{ph}_{k}$, it is required to send a task report to the nearby RSU, which is denoted as $R_{j}$. Specifically, $v_{j}$ generates the report, including the customer $\text{ph}_{k}$, task $Tr_{k}$, feedback $f_{j}$, and a handshake proof with $\text{ph}_{k}$. The handshake proof is used to prove that whether $v_{j}$ actually joined the $\text{ph}_{k}$’s task. This proof is generated as follows.

The customer $\text{ph}_{k}$ generates its Paillier Cryptosystem’s public key $(n_{k},g_{k})$ and the secret key $(\lambda_{k},\mu_{k})$. Then, it broadcasts a random value $\alpha_{k}\in\mathbb{Z}^{*}_{n_{k}}$ and its public key to all processors.

• 2.

The processor $v_{j}$ selects $\alpha_{j},r_{j}\in\mathbb{Z}^{*}_{n_{k}}$ and uses the customer’s homomorphic encryption ($n_{k}$ and $g_{k}$) to calculate $C_{\alpha_{j}}=g^{\alpha_{j}}_{k}\cdot r^{n_{k}}_{j}\ \text{mod}\ n^{2}_{k}$, which is the ciphertext of $\alpha_{j}$. Then, the processor delivers the ciphertext $C_{\alpha_{j}}$ to the customer.

• 3.

After receiving the ciphertext, the customer recovers $\alpha_{j}$ and calculates the proof as $\text{proof}_{kj}=x_{k}H(\alpha_{k}+\alpha_{j})$. Accordingly, the processor calculates its proof as $\text{proof}_{jk}=x_{j}H(\alpha_{j}+\alpha_{k})$.

Then, to prevent the RSU or other attackers linking $v_{j}$’s trust value, $v_{j}$ selects a random vale $r^{\prime}_{j}\in\mathbb{Z}^{*}_{n}$ to perturb the trust ciphertext as $\widetilde{C}_{j}=g^{T_{j}}\cdot(r_{j}\cdot H_{1}{(t_{c}||\chi)})^{n}\cdot(r^{\prime}_{j})^{n}\ \text{mod}\ n^{2}$ 111In this paper, $g$ is not public to the processors, and processors can only use the public key $n$ to perturb the ciphertexts.. Accordingly, the trust signature is also recalculated as $\widetilde{\mathfrak{C}_{j}}=g^{T_{j}+H_{1}{(t_{c}||\chi)}}\cdot r^{n}_{j}\cdot(r^{\prime}_{j})^{n}\ \text{mod}\ n^{2}$. After that, $v_{j}$ uses $x_{j}$ to generate a signature as $\sigma_{j}=x_{j}(PID_{j}||Y_{j}||FR_{j}||TR_{j}||$ $\text{proof}_{jk})$, where $FR_{j}=(\text{ph}_{k}||Tr_{k}||f_{j})$ is the feedback report, and $TR_{j}=(\widetilde{C}_{j}||\widetilde{\mathfrak{C}_{j}}||t_{c})$ is the trust report. Finally, $v_{j}$ submits the report $R_{j}=(PID_{j},Y_{j},FR_{j},TR_{j},\text{proof}_{jk},\sigma_{j})$ to RSU when it finishes the task. Accordingly, $\text{ph}_{k}$ uploads its report $R_{k}=(\text{ph}_{k},Tr_{k},\{\text{proof}_{kj}\}^{num}_{j=1},\sigma_{k})$, where $num$ is the total number of processors in the task $Tr_{k}$ and $\sigma_{k}=x_{k}H(\text{ph}_{k}||Tr_{k}||\{\text{proof}_{kj}\}^{num}_{j=1})$.

4.4 Report Aggregation

Upon receiving the reports, RSU first verifies the processor’s signature $\sigma_{j}$, i.e., to check whether $e(P,\sigma_{j})\overset{?}{=}e(Y_{j},H(PID_{j}||Y_{j}||FR_{j}||TR_{j}||\text{proof}_{jk}))$. If it does hold, the signature is valid and RSU will accept $v_{j}$’s report, since $e(P,\sigma_{j})=e(P,x_{j}H(PID_{j}||Y_{j}||FR_{j}||TR_{j}||\text{proof}_{jk}))=e(Y_{j},H(PID_{j}||Y_{j}||FR_{j}||TR_{j}||\text{proof}_{jk}))$. To improve verification efficiency with less overhead, RSU can perform batch verification as:

[TABLE]

By this way, the verification can be completed by executing only $sum+1$ rather than $2sum$ pairing operations.

After the validity checking, RSU will verify $v_{j}$’s handshake proof, i.e., $\text{proof}_{jk}$, to check whether it has joined the task. Specifically, RSU verifies $e(Y_{k},\text{proof}_{jk})\overset{?}{=}e(Y_{j},\text{proof}_{kj})$. If it holds, the proof is verified, since $e(Y_{k},\text{proof}_{jk})=e(x_{k}P,x_{j}H(\alpha_{j}+\alpha_{k}))=e(x_{j}P,x_{k}H(\alpha_{k}+\alpha_{j}))=e(Y_{j},\text{proof}_{kj})$. Similarly, RSU can also perform batch verification, that is, to check if $e(Y_{k},$ $\sum^{sum}_{j=1}\text{proof}_{jk})\overset{?}{=}\prod^{sum}_{j=1}e(Y_{j},\text{proof}_{kj})$. The proof is given as follows.

[TABLE]

Besides the above operations, it is also important to check if the trust value, i.e., $T_{j}$, is truthful and fresh, as some malicious processors may change their trust values. To achieve this goal, RSU first checks the time stamp $t_{c}$, and then checks the trust signature $\widetilde{\mathfrak{C}_{j}}$. Specifically, RSU checks if $\widetilde{C}_{j}\cdot g^{H_{1}{(t_{c}||\chi)}}$ equals to $\widetilde{\mathfrak{C}_{j}}\cdot{(H_{1}{(t_{c}||\chi)})}^{n}$, as $\widetilde{C}_{j}\cdot g^{H_{1}{(t_{c}||\chi)}}=g^{T_{j}}\cdot(r_{j}\cdot H_{1}{(t_{c}||\chi)})^{n}\cdot(r^{\prime}_{j})^{n}\cdot g^{H_{1}{(t_{c}||\chi)}}=g^{T_{j}+H_{1}{(t_{c}||\chi)}}\cdot(r_{j}\cdot r^{\prime}_{j}\cdot H_{1}{(t_{c}||\chi)})^{n}=\widetilde{\mathfrak{C}_{j}}\cdot{(H_{1}{(t_{c}||\chi)})}^{n}$. Similarly, RSU can perform batch verification to check $g^{H_{1}{(t_{c}||\chi)}}\cdot\sum^{sum}_{j=1}\widetilde{C}_{j}\overset{?}{=}{(H_{1}{(t_{c}||\chi)})}^{n}\cdot\sum^{sum}_{j=1}\widetilde{\mathfrak{C}_{j}}$. The proof is given as follows.

[TABLE]

RSU performs the following steps to generate the aggregated report.

Step 1. Compute the aggregated weighted data according to $\{f_{j},\widetilde{{C}_{j}}\}^{sum}_{j=1}$ as

[TABLE]

[TABLE]

• 2.

Step 2: Use the private key $x_{r}$ to generate a signature $\sigma_{g}$ as

[TABLE]

• 3.

Step 3: Deliver the integrated report $R_{r}=(\text{ph}_{k},Tr_{k},C_{1},C_{2},\{PID_{j},f_{j}\}^{sum}_{j=1},$ $\sigma_{r})$ to SP.

4.5 Reputation Score Evaluation

After receiving the report $R_{r}$, SP first validates the report by checking if $e(P,\sigma_{r})$ equals to $e(Y_{r},H(\text{ph}_{k}||Tr_{k}||C_{1}||C_{2}||\{PID_{j}||f_{j}\}^{sum}_{j=1}))$. Then TA decrypts $C_{1},C_{2}$ by using the secret key $\lambda,\mu$, and calculates the reputation score $RS_{k}$ as follows.

[TABLE]

Note that, $RS_{k}$ is calculated based on processors’ previous trust values. To evaluate the qualities of processors’ feedbacks in the task $Tr_{k}$, we design a filtering truth discovery based evaluation algorithm. The basic idea is to assign a higher weight to a processor if its data is closer to the reputation score, and the data provided by a processor with higher weight will be more likely to be considered as the truthful reputation score [21, 22, 26, 27, 42]. More specifically, $\mathcal{V}_{k}=[v_{1},v_{2},\cdots,v_{sum}]$ represents the set of processors which belongs to the task $Tr_{k}$, and is updated in each iteration since some processors may be removed. The filtering truth discovery based algorithm is achieved by the following steps.

Data filtering: For a processor $v_{j}\in\mathcal{V}_{k}$, SP calculates the difference between each processor’s feedback and the reputation score, and then removes the processors whose difference is less than a threshold, i.e.,

[TABLE]

where $RS^{(v)}_{k}$ denotes $\text{ph}_{k}$’s reputation score in the $v$-th iteration.

• 2.

Weight update: SP calculates the difference between each processor’s feedback and the customer’s reputation score, and then updates each processor’s weight based on the aggregated differences. Without loss of generality, we adopt a logarithmic weight function, which has been widely used in truth discovery based applications [26, 42].

[TABLE]

where $d(\cdot)$ is a distance function calculated as $d(f_{j},RS^{(v)}_{k})=(f_{j}-RS^{(v)}_{k})^{2}$.

• 3.

Reputation score update: Based on the processors’ weights, the reputation score for the customer can be estimated as

[TABLE]

The above procedures will be iteratively conducted until the change of the reputation score between two consecutive iterations is less than a predefined threshold. Then, SP publishes the customer’s reputation score. The general procedure of the filtering truth discovery based evaluation algorithm is shown in Algorithm 1.

4.6 Trust Value Evaluation

Based on the reputation score, SP can also obtain processors’ new trust values. Motivated by [15], we define a function to measure the qualities of processors’ trust values.

[TABLE]

where $v$ is the number of iterations. It is obvious that if there are more malicious processors, $v$ will be larger and it will be more difficult to obtain the accurate reputation score. Thus, $v$ can be used as a reward for the processors whose feedbacks contribute to the accurate reputation score calculation. Besides, we define another factor $c_{0}$ to control the reward sensitivity. If the difference between a processor’s feedback and the reputation score is more than a threshold $F_{threshold}$, then the feedback does not make any positive effect on the reputation score and hence the processor will not obtain the reward. Then, SP delivers processors’ trust values $[(PID_{1},T_{1}),(PID_{2},T_{2}),\cdots,(PID_{sum},T_{sum})]$ to TA.

On receiving the trust values, TA first uses the symmetric key $t_{0}$ to retrieve processors’ real identities, and then predicts processors’ future trust values according to their historical behaviors. Here, we use the exponential weighted moving average (EMWA) technique to estimate processors’ future behaviors, as it gives more consideration of processors’ most recent performances [33, 34].

[TABLE]

where $\alpha\in(0,1)$ is an impact factor, and $T_{j(i-1)},T_{ji}$ and $T_{j(i+1)}$ are the past, current and future trust values respectively .

Note that, some processors may behave well at the beginning to improve their trust values, and behave badly when these values are high enough. To counter the effect of this attack, we further design a trust value circuit-breaker mechanism as:

[TABLE]

From this equation, we can see if the decrease between two consecutive trust values is larger than a predefined threshold, the trust value will be set as the initialized value $T_{0}$. Moreover, to punish the on-off attacker, once the circuit-breaker is triggered, the predicted trust value will be decreased as $T_{j(i+1)}=c_{1}\cdot T_{j(i+1)}$, where $c_{1}\in(0,1)$ is a forgetting factor. In this way, the attacker will take more time to bring its trust value to the previous level.

5 Security Analysis

Before presenting the evaluation, we first discuss the security analysis of our proposed TPCS scheme. In particular, according to the security model discussed earlier, we first focus on how TPCS scheme can achieve processor’s report privacy preservation, authentication and data integrity, and then we discuss some attack strategies and give the resilience analysis against them.

5.1 Security analysis for processor’s report

The processor’s report is privacy-preserving. In this proposed scheme, processor’s trust information is encrypted as a valid Paillier ciphertext $C_{j}=g^{M_{j}}\cdot R^{n}_{j}\ \text{mod}\ n^{2}$ if we consider the trust values $T_{j}$ and $T_{j}+H_{1}{(t_{c}||\chi)}$ as the message $M_{j}$, and the random values $r_{j}$, $r_{j}\cdot H_{1}{(t_{c}||\chi)}$, and $r_{j}\cdot H_{1}{(t_{c}||\chi)}\cdot r^{\prime}_{j}$ as $R_{j}$. As the Paillier Cryptosystem can defend from the chosen plaintext attack, the trust value achieves semantic security and privacy preservation. Hence, although an adversary may eavesdrop the ciphertext $C_{j}$, it cannot identify the original data. After collecting processors’ reports, RSU will compute $C_{1}$ and $C_{2}$ to aggregate all reports. However, the RSU or an adversary cannot get each individual’s trust value without the secret key. Finally, SP can recover $C_{1}$ and $C_{2}$ as $\sum^{sum}_{j=1}T_{j}\cdot f_{j}$ and $\sum^{sum}_{j=1}T_{j}$. Nevertheless, since the decrypted data is aggregated results, it cannot get each individual processor’s trust value $(T_{1},T_{2},\cdots,T_{sum})$. Therefore, the processor’s report is privacy-preserving.

The processor’s report achieves authentication and data integrity. The processor’s report is signed using the BLS short signature [7]. As the BLS signature has been proven to be secure under the CDH problem [5], any malicious behaviors of an adversary can be detected, and accordingly our proposed scheme can guarantee the report’s authentication and data integrity.

5.2 Resilience analysis against attacks launched by adversaries

Resilience to link attack: From TPCS scheme’s perspective, link attack means that an attacker may link a certain $v_{j}$ to its identity or trust value. To prevent the identity link attack, $v_{j}$ can change its pseudonym when it joins different tasks, which will make them unlinkable. However, given that the trust value remains unchanged for some time, it may still be linked according to its trust value. In our proposed scheme, $v_{j}$ does not submit its original trust values directly to the RSU. Instead, the trust value is encrypted, and $v_{j}$ changes the ciphertext by multiplying a random value $(r^{\prime}_{j})^{n}$ when it takes part in a different task (i.e., $C_{j}\rightarrow\widetilde{{C}_{j}}=C_{j}\cdot(r^{\prime}_{j})^{n}\ \text{mod}\ n^{2}$). Besides, although SP owns the secret key $\lambda$, it still cannot trace any individual processor as the encrypted trust values have been aggregated in RSU before uploading to SP.

Resilience to fake trust value attack: In this scheme, the trust value is encrypted and hence the processor has no method to know its real trust level. However, some malicious processor may provide a fake trust value by colluding with other processors or using its previous data. In such a case, our scheme is still effective as we use time stamp $t_{c}$ to generate the trust ciphertext and trust signature, i.e., ($C_{j}=g^{T_{j}}\cdot(r_{j}\cdot H_{1}{(t_{c}||\chi)})^{n}\ vs.\ \mathfrak{C}_{j}=g^{T_{j}+H_{1}{(t_{c}||\chi)}}\cdot r^{n}_{j}$ ). Specifically, for the first collusion attack ($v_{j}$ is in collusion with $v_{i}$ for example), $v_{j}$ submits its falsified trust report as $\widehat{C}_{j}=C_{j}\cdot C_{i}=g^{T_{j}+T_{i}}\cdot(r_{j}r_{i}(H_{1}{(tc||\chi}))^{2})^{n}$, $\widehat{\mathfrak{C}_{j}}=\mathfrak{C}_{j}\cdot\mathfrak{C}_{i}=g^{T_{j}+T_{i}+2H_{1}{(t_{c}||\chi)}}\cdot(r_{j}r_{i})^{n}$. Since $\widehat{C}_{j}\cdot g^{H_{1}{(t_{c}||\chi)}}\neq\widehat{\mathfrak{C}_{j}}\cdot{(H_{1}{(t_{c}||\chi)})}^{n}$, this malicious manipulation will be identified by RSU. For the second reply attack, $v_{j}$ submits its previous trust report $C^{\prime}_{j}=g^{T^{\prime}_{j}}\cdot(r^{\prime}_{j}H_{1}{(t^{\prime}_{c}||\chi)})^{n}$, $\mathfrak{C}^{\prime}_{j}=g^{T^{\prime}_{j}+H_{1}{(t^{\prime}_{c}||\chi)}}\cdot(r^{\prime}_{j})^{n}$. Also, it still cannot pass the authentication, as $C^{\prime}_{j}\cdot g^{H_{1}{(t_{c}||\chi)}}\neq\mathfrak{C}^{\prime}_{j}\cdot{(H_{1}{(t_{c}||\chi)})}^{n}$.

Resilience to badmouth attack: From TPCS scheme’s perspective, a badmouth attack means that the attackers may always provide low feedbacks for customers. Specifically, the badmouth attackers can be categorized into internal and external attackers. For the external badmouth attackers, we design report authentication and handshake protocols to ensure that only the valid processors which register with the system and join the task can pass the authentication. For the internal badmouth attackers, the proposed scheme incorporates a filtering truth discovery based reputation evaluation algorithm to distinguish among truths which deviate from ground truth.

Resilience to on-off attack: In the proposed scheme, an on-off attack means that some malicious processors may perform well to hide themselves before launching attacks. When they attain high trust values, they launch attacks and then remain dormant for a certain time period to regain their trust. This attack is hard to defend against using the traditional methods. In our scheme, we design a circuit-breaker mechanism to handle this problem, which is motivated by a common human nature that people make great efforts to build up trust values and some bad behaviors will destroy them. Specifically, we define a $T_{threshold}$, and once the decrease of two consecutive trust values is larger than the predefined threshold, the circuit-breaker will be triggered. Besides, to punish the on-off attacker, its trust value will be decreased by multiplying a forgetting factor $c_{0}\in(0,1)$ in a long time. That is, the attacker will take a long time to build up its trust value to the previous level. Thus, our proposed scheme mitigates the on-off attack.

6 Performance Evaluation

Here, we evaluate the performance of TPCS scheme in terms of efficiency and effectiveness in task selection. The proposed scheme is implemented in Java, and all experiments are conducted on a system with Intel Core i7 2.5 GHz processor and 16GB RAM. The detailed parameter setting is shown in Table 1.

6.1 Efficiency Analysis

In this experiment, the aim is to evaluate the efficiency of TPCS scheme in terms of authentication and ciphertexts aggregation. Every experiment is executed 10 times and the average result is used for analysis. Note that, in the proposed scheme, three authentication protocols (i.e., report authentication, handshake authentication, trust authentication) are designed for processors’ verification. Fig. 4 illustrates the computational cost of the authentication varying against the number of processors. As can be seen, since we use batch verification in each authentication, the verification is finished with fewer pairing operations, and accordingly the running time is much less as compared to no batch verification. In Fig. 5, we plot the running time of ciphertexts aggregation. From this figure, we can observe that as the number of processors increases, our scheme can efficiently perform the ciphertexts aggregation. This is evident from the fact that only 317 ms is required to execute the ciphertext aggregation for 500 processors.

6.2 Effectiveness Analysis

In order to analyze the correctness of the system, we vary the percentage of malicious processors. The malicious processors will provide untruthful feedbacks, that is, their feedbacks are much higher or lower than the truthful evaluation. All processors are initialized with the same trust value $T_{0}$. After the execution of our proposed truth discovery based evaluation algorithm, we observe the value change of the customer and processors.

Fig. 6 plots the reputation score of the customer where the percentage of malicious processors is set as 10 and 25 percent respectively, i.e., $\rho=10\%$ and $\rho=25\%$. As can be seen, the reputation score tends to be stable after the fourth round. When the number of malicious processors accounts for 10% of the total number of processors, the reputation score is equivalent to 0.787. When there are more malicious feedbacks, the reputation score witnesses a downward trend, while is still in a reasonable range. Fig. 7 presents the trust value of a single malicious processor and a single honest processor where $\rho=10\%$ and $\rho=25\%$. It is obvious that the malicious processor gets the lower trust value after the experiments, which demonstrates the correctness of TPCS scheme.

We also analyze the effectiveness of the scheme for resilience to on-off attack. Recall that an on-off attack means that a processor behaves well to accumulate its trust value at the beginning, and give untruthful feedback when its trust value is high enough. To mitigate the effect of this attack, we design a circuit-breaker mechanism and apply the forgetting factor. As shown in Fig. 8, without the forgetting factor (i.e., the black line), the processor performs well in the first five tasks, and its trust value rises up to 0.8165. After launching the badmouth attack, its trust value decreases quickly, which however rises up to 0.8045 after only four more tasks. In contrast, with the forgetting factor (i.e., red line), it triggers the circuit-breaker at the sixth task, and its trust value rises slowly at the later task. That is, the attacker will need more time to bring its trust value to the previous level and hence demonstrates the effectiveness of TPCS scheme.

7 Related work

By taking advantage of the increasingly powerful computation and communication capabilities of smart devices, ubiquitous computing has received considerable attention in recent years [2, 20, 25]. As a special computing paradigm, ubiquitous computing integrates nearby devices and provides tremendous novel services by exploiting their idle computing and communication resources. This enables complex computing possible at anytime, anywhere, and by different means. Recently, many ubiquitous computing based applications have been studied and proposed, such as data mining [43], human activity recognition [23], disease support [28], and ambient intelligence [3]. However, the selection of a reliable customer while not disclosing processors’ privacy is still an unsolved problem.

To the best of our knowledge, none of the existing schemes have solved this problem. Generally, to find a reliable customer and help processors avoid selecting the misbehaving customers, a potential approach is to evaluate the trustworthiness of the customers and processors. Recently, many trust models have been proposed in VANET [8],[15],[18],[30],[31],[48]. Specifically, in [30], Patwardhan et al. proposed a context-aware reputation management approach for vehicular ad hoc networks, which provides a bootstrapping method to enable vehicles to establish trust relationships. Nevertheless, since it lacks of robustness and scalability, their proposed model cannot be directly used in the task. Raya et al. [31] presented a data-oriented trust establishment scheme. However, their framework is not efficient in handling the large amount of feedback data in a task scenario. Zhu et al. [48] described a trust management scheme for vehicular crowdsensing applications. Hu et al. [15] presented a reliable and trust-based task service selection scheme. By building a trust-based evaluation model, their scheme can defend against several sophisticated attacks in VANET. However, their scheme ignores the outside attackers and cannot be executed with an untrusted service provider. Javed [18] presented a security adaptation scheme to improve the quality of service (QoS) of safety applications. In their scheme, several factors such as connectivity duration, near s’ centrality metrics, and security level are combined to calculate the trust level. However, their work focuses on the QoS in Vehicular Sensor Networks (VSNs) and it is not suitable in the applications of ubiquitous computing. Zhu et al. [46] used blockchain to realize controllable and trustworthy data management in cloud environment. As for the security and trust in ubiquitous computing, some works have been proposed recently. In [37], Xing et al. defined individuals’ contexts to be private information and based on this they proposed a context aggregation and sharing scheme which could achieve trust and privacy preservation. In [17], an adaptive trust and selection scheme is proposed to realize access control for pervasive environment. In [4], Akram te al. summarized the literature related to security, privacy, and trust issues in user-centric solutions. However, to our best knowledge, none of the existing works have focused on how to select reliable customers for the data processors, which inspires to design a trust-based and privacy-preserving customer selection scheme for ubiquitous computing. Besides the above works, we also study the potential security and privacy issues in internet of things and sensor networks [9, 10, 11, 36, 44, 35], as the core of ubiquitous computing is to take advantage of various computing devices.

8 Conclusion

In this article we proposed a trust-based and privacy-preserving customer selection scheme for processors before they join a ubiquitous computing task. Considering the uncertainty of processors’ behaviors, we design a filtering truth discovery based evaluation mechanism to calculate the customers’ reputation scores and processors’ trust values. In addition, three authentication protocols are designed to ensure that only the valid processors can pass the authentication. Security analysis and simulation results establish the security and effectiveness of the proposed scheme. Using similar approach, we aim to address other trust and privacy challenges in different ubiquitous computing based application scenarios.