2026· Computers, Materials & Continua· 0 citations· 32 references
TL;DR
Security analysis demonstrates that SecuAudit can effectively resist data forgery, metadata tampering, and sub-threshold collusion attacks under the defined threat model, and establishes a feasible framework for secure data circulation under the evaluated deployment assumptions.
Abstract
: AI agents frequently access external files, databases, and application programming interfaces (APIs) through the Model Context Protocol (MCP). However, these external resources typically lie outside the security boundary of the agent. During data circulation, attackers can not only tamper with the external data but also manipulate critical metadata, such as access permissions, validity periods, and authorization scopes. Even when the underlying data remains intact, such attacks can cause proxies to ingest expired or policy-violating resources, leading to severe privacy breaches and risks of unauthorized execution. To address these challenges, we propose SecuAudit, a privacy-enhancing decentralized data auditing scheme tailored for the MCP architecture. Leveraging Shamir’s Secret Sharing mechanism, key management is securely decentralized across multiple servers, effectively mitigating sub-threshold collusion attacks. Furthermore, by introducing a supervised hash mechanism, dynamic access policies and metadata constraints are cryptographically bound to the user’s private keys and file tags. Finally, based on a carefully designed randomized challenge-response protocol, third-party auditor (TPA) can efficiently verify both data integrity and metadata compliance without accessing the sensitive raw data. Security analysis demonstrates that SecuAudit can effectively resist data forgery, metadata tampering, and sub-threshold collusion attacks under the defined threat model. Experimental results obtained from our implementation under the evaluated configurations show that: (i) at ( t = 30, m = 59), SecuAudit reduces Keygen latency by 54.6% relative to our implementation of the Pedersen-based Threshold Label-Aggregating Remote Data Auditing scheme (Ped-TLARDA), while maintaining comparable online auditing performance; (ii) metadata binding introduces an average additional Signblock overhead of 2.5%; and (iii) the local EVM evaluation requires approximately 770 bytes of on-chain storage per file and 499,021 gas for the evaluated contract-interaction lifecycle; (iv) the theoretical cumulative detection probability for 1% data loss exceeds 99.9% after 23 independent audits, while all six implemented attack cases were detected in the controlled evaluation. These results indicate the feasibility of SecuAudit under the evaluated settings. In conclusion, SecuAudit establishes a feasible framework for secure data circulation under the evaluated deployment assumptions.
Keyword-based remote integrity auditing schemes effectively address the integrity of electronic medical records (EMRs) stored in the cloud. In practice, users expect to be able to perform flexible dynamic data updates while also protecting data privacy against a third-party auditor during the auditing process. However, existing schemes fail to simultaneously satisfy both requirements: they either incur prohibitive overhead for block-level updates or disclose to the auditor which EMRs match the target keyword and the number of such EMRs. To address this, we propose a new keyword-based auditing scheme for medical cloud. Specifically, we design a novel authentication identifier set. Unlike the keyword tags in Shen et al.’s scheme, this set aggregates the block hashes and thereby enables the auditor to verify integrity without obtaining sensitive information. Furthermore, we introduce a dynamic hash list. By updating this list during block insertion and deletion, the scheme eliminates the need to recompute the authenticators of subsequent blocks, significantly enhancing the efficiency of dynamic data updates. Security analysis confirms that the proposed scheme is secure. Performance analysis shows our scheme reduces block insertion and deletion overhead by over 60% compared to Gao et al.’s scheme, demonstrating high efficiency and practicality.
Meijuan Huang, Siyu Chen, Bo Yang et al.· Information· 0 citations
AI agents performing cryptographic operations (signing Git commits, authenticating API calls, issuing certificates) currently store private keys in software-accessible locations: plaintext files, environment variables, or container memory. Any process with sufficient read privileges can extract the raw key material. A recent production incident demonstrated the practical severity: private keys were exfiltrated from a widely deployed framework via email injection in under five minutes. We aim to enforce both key confidentiality and content-aware authorisation for key use. To that end, we replace software-resident keys with hardware-confined keys accessible through a vendor-neutral PKCS#11 interface. A hardware keystore (HSM, TPM, smart card) executes cryptographic operations on-device; the host receives only the result via opaque handles. Hardware confinement is the primary contribution; it is enabled by a surrounding five-layer Zero-Trust enforcement stack comprising session identity (SAGA), scope bounds (Smax), semantic validation (RAV), taint tracking, and the hardware execution boundary. We evaluate against 12 injection scenarios derived from AgentDojo's ImportantInstructionsAttack template (Debenedetti et al., arXiv:2406.13352). We run four LLM models; three follow injections in baseline mode (gpt-oss-120b, Qwen2.5-72B, DeepSeek-V4-Flash, n=192 combined). Baseline Attack Success Rate (ASR): 19.3% [14.3%, 25.4%]; protected ASR: 0% (Wilson 95% CI upper bound 2.0%). Zero false positives across four benign task scenarios.
: Many security and privacy-sensitive systems must control access to encrypted data based on dynamic operational context, such as workflow stage, safety mode, or emergency conditions. Data producers cannot anticipate which context will apply at processing time, and the component observing context cannot be trusted with plaintext or policy structure. Existing mechanisms, including Access Control Encryption (ACE), assume that all authorization-relevant information is fixed at encryption time, and offer no mechanism to incorporate context that becomes available only after the data has been produced and forwarded. We introduce Contextual Reading ACE (CR-ACE), a framework for enforcing context-dependent read authorization without a trusted reference monitor. An honest-but-curious intermediary sanitizes sender ciphertexts and attaches public contextual attributes while remaining oblivious to message contents, principal identities, and authorization logic. Receivers locally enforce authorization as the conjunction of the global ACE policy and a contextual predicate embedded in their key material. We formalize a security model for CR-ACE, provide a construction and prove that it achieves contextual payload privacy, sender anonymity, sanitization security under context, and correct enforcement of both global and context-dependent authorization in our non-collusion model.
Roberta Cimorelli Belfiore, A. Ferrara, B. Masucci· International Conference on...· 0 citations
A viable, privacy-friendly auditing framework of clouds which guarantees the end-toend encrypted verification without sacrificing the efficiency is presented.
Deepshikha Chaturvedi, Vidyullata Devmane, Shashikant S. Radke et al.· International Journal of Com...· 0 citations
Service uptime monitoring infrastructure is a high-value target for data-integrity attacks: a single compromised or dishonest monitoring provider can fabricate availability records, retroactively suppress outage evidence, or silently alter historical data, and clients today have no cryptographic means of detecting such manipulation. This study develops a threat model for monitoring-data integrity attacks—covering provider-side tampering, evidence suppression, Sybil-identity flooding, and submission replay—and presents a verification architecture engineered to resist each threat in that model. Independent validator nodes sign availability observations with Ed25519 keys; a quorum-based aggregation rule tolerates up to f < Q/2 Byzantine validators, SHA-256 content-hash commitments bind off-chain evidence to an immutable on-ledger record that any third party can independently re-derive and check without trusting the aggregator; and stake-bonded registration imposes a quantifiable capital cost on Sybil identities. We formalize the adversary model, prove signature unforgeability under the Elliptic Curve Discrete Logarithm assumption, derive the capital cost of quorum capture, and bound the residual attack surface—selective evidence inclusion and round-stalling—that persists even under a semi-honest aggregator. A seven-day, five-validator, three-region deployment achieves 99.7% quorum agreement, sub-6-second worst-case attestation latency, and zero false positives or negatives across 200 independently re-verified historical rounds, confirming that the architecture removes the central point of trust that lets a single compromised provider corrupt monitoring evidence undetected.
Unknown authors· International Journal of Adv...· 0 citations
This paper proposes an architecture based on the Selective Disclosure JSON Web Token (SD-JWT) standard for securely sharing read-only files, which embeds cryptographic signatures and integrity protection directly into the shared resource, providing verifiable authenticity without relying on complex IAM infrastructures.
