{"title":"LPABE: Lattice-Based Puncturable Attribute-Based Encryption for Secure Cloud Storage Services","authors":"Chao Deng;Qian He;Jiaxing Zhu;Yiting Chen;Bingcheng Jiang;Jining Chen","doi":"10.1109/TCC.2026.3716629","DOIUrl":"https://doi.org/10.1109/TCC.2026.3716629","url":null,"abstract":"Cloud storage requires fine-grained access control (FGAC), efficient permission revocation, and security against quantum attacks. Existing puncturable attribute-based encryption (PABE) schemes either rely on pairing-based assumptions or suffer from key expansion, ciphertext expansion, or owner-coupled key management when deployed in multi-tenant cloud environments. This paper presents LPABE, a lattice-based PABE scheme that combines policy-level attribute authorization with tag-level user-autonomous puncturing. The proposed scheme introduces a noise-controlled decryption structure based on disjunctive normal form (DNF) policy transformation and symmetric Lagrange coefficient allocation, reducing reconstruction-induced noise growth under the considered policy class. It supports puncture-history-independent local puncturing, while user keys and ciphertexts remain independent of puncture history and revocation-list size. A decoupled credential design further enables a single user key to be used across authorized data sources without data-owner-specific rebinding. Compared with representative lattice-based PABE schemes, the construction avoids puncture-count-dependent quadratic key growth, revocation-list-dependent ciphertext expansion, and data-owner-dependent key-management growth. We prove indistinguishability under chosen-plaintext attacks (IND-CPA) in the selective access-policy and selective tag setting under the Learning With Errors (LWE) assumption, and analyze resistance to collusion attacks. Experimental results demonstrate that LPABE provides practical online performance, with decryption remaining below 45 ms for 50 satisfied attribute leaves and below 11 ms for 50 ciphertext tags, while local puncturing stays nearly constant at about 13.6 ms across repeated punctures.","PeriodicalId":13202,"journal":{"name":"IEEE Transactions on Cloud Computing","volume":"14 3","pages":"1948-1962"},"PeriodicalIF":5.3,"publicationDate":"2026-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148903140","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Dynamic Microservice Applications Deployment in Clouds Based on Multi-Tasking Genetic Programming","authors":"Zhengxin Fang;Hui Ma;Gang Chen;Sven Hartmann","doi":"10.1109/TCC.2026.3706413","DOIUrl":"https://doi.org/10.1109/TCC.2026.3706413","url":null,"abstract":"Microservice architecture has gained popularity in application development due to it can develop, deploy and maintain lightweight microservices independently. Microservice application deployment in clouds has emerged as a challenging problem for cloud providers. This is because of the fine-grained resource requirements and the dynamic arrival of microservice applications in cloud data centers. Meanwhile, a cloud provider faces multiple different but related microservices application deployment tasks. For example, a cloud provider focuses on reducing the energy consumption in a cloud data center for deploying microservice applications that require huge computational resources, while focusing on reducing the communication overhead for those communication-intensive microservice applications. These different optimization objectives give rise to different microservices application deployment tasks. However, existing microservice deployment approaches solve each task separately. In this article, we propose a novel multi-tasking genetic programming approach, named MGPBS, to not only solve multiple microservice application deployment tasks simultaneously but also utilize useful knowledge of solving one task to improve the performance of solving others. Simulation experiments based on real-world traces are conducted to evaluate MGPBS. The results show that MGPBS outperforms several state-of-the-art microservice application deployment approaches.","PeriodicalId":13202,"journal":{"name":"IEEE Transactions on Cloud Computing","volume":"14 3","pages":"1720-1731"},"PeriodicalIF":5.3,"publicationDate":"2026-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148902628","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"CloudMirror: Demystifying Seamless End-to-End Encryption in Cloud Storage and Sharing","authors":"Yudi Zhang;Willy Susilo;Fuchun Guo;Shijin Chen","doi":"10.1109/TCC.2026.3697927","DOIUrl":"https://doi.org/10.1109/TCC.2026.3697927","url":null,"abstract":"The widespread adoption of public cloud services, such as Dropbox and Google Drive, is driven by their efficiency in storage and sharing. However, the risk of providers accessing user data, even under the guise of encrypted protection, remains a significant barrier to trust. Most attempts to implement end-to-end encryption fail to achieve usability, largely due to their inability to integrate seamlessly or their requirement for complex server-side changes. In this paper, we propose CloudMirror, the first solution to offer truly seamless end-to-end encryption for authenticated personal storage across devices. A distinguishing feature of CloudMirroris its ability to function atop existing cloud infrastructure without necessitating any new programmable operations on either the server or client side. Beyond guaranteeing confidentiality and integrity against curious cloud providers, our system maintains the utility of native cloud functions, including data sharing and fast synchronization. It also enables the simultaneous use of multiple clouds within a single view. From a security perspective, CloudMirror mitigates various attacks by incorporating the buffer offset value as <i>Associated Data (AD)</i> in AEAD encryption. Our evaluations with Dropbox, OneDrive, and Google Drive demonstrate that CloudMirror causes no significant performance degradation and maintains full compatibility with unencrypted files.","PeriodicalId":13202,"journal":{"name":"IEEE Transactions on Cloud Computing","volume":"14 3","pages":"1602-1615"},"PeriodicalIF":5.3,"publicationDate":"2026-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148902647","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Ignacio Castillo-Barrios;J. L. Gonzalez-Compean;Ivan Lopez-Arevalo;Jose Juan Garcia-Hernandez
{"title":"APaC: A Context-Aware and Availability Policy as Code Framework for Elastic Object Storage","authors":"Ignacio Castillo-Barrios;J. L. Gonzalez-Compean;Ivan Lopez-Arevalo;Jose Juan Garcia-Hernandez","doi":"10.1109/TCC.2026.3693716","DOIUrl":"https://doi.org/10.1109/TCC.2026.3693716","url":null,"abstract":"Replication strategies provide availability for cloud storage, yet existing policies typically rely on static popularity metrics. These works struggle to react dynamically to contextual workload variations, specifically the temporal increments and decays in user concurrency and data consumption. This paper introduces APaC, a framework that combines a contextreactive replication method with an Availability PolicyasCode programming model for storage systems to autonomously update availability policies and adapt at runtime to workload fluctuations. The APaC model defines replication policies through primitives that specifies <i>who, what, where, how, and when</i> should replicate data, which is interpreted and executed by a configurable and reactive replication system without modifying the storage system basis code core. Under scenarios of read/write intensity and concurrency variation, dynamic adjustments to availability policies enabled effective responsiveness of storage to workload changes, which yielded high throughput rates, and lower capacity consumption. APaC outperformed stateoftheart policies, achieving gains of 16.6% over timedistributionbased, 26% over objectlifetimebased, 34.6% over popularitybased strategies, and more than 70% over the baseline configuration that produce three replicas for each five nodes. It was also observed that performance gains increased with higher levels of concurrency, underscoring the effectiveness of dynamically managing availability policies.","PeriodicalId":13202,"journal":{"name":"IEEE Transactions on Cloud Computing","volume":"14 3","pages":"1421-1435"},"PeriodicalIF":5.3,"publicationDate":"2026-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148902786","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Weijian Zheng;Weiping Zheng;Yiqi Chen;Zichen Wang;Yimin Mao
{"title":"Time-Frequency and Multi-Scale Learning Network for Long-Term Cloud Workload Prediction","authors":"Weijian Zheng;Weiping Zheng;Yiqi Chen;Zichen Wang;Yimin Mao","doi":"10.1109/TCC.2026.3697737","DOIUrl":"https://doi.org/10.1109/TCC.2026.3697737","url":null,"abstract":"Accurate long-term workload prediction (LTWP) is crucial for effective resource management in cloud environments, where workload dynamics are characterized by high variability, noise, and long-range temporal dependencies. Existing methods, such as linear models and PatchTST-based models, often struggle with capturing long-range dependencies, handling noise, and adapting to diverse workload patterns. To address these issues, this paper proposes TFMSNet, a novel time-frequency and multi-scale learning network for LTWP. TFMSNet integrates low-frequency wavelet features to capture global workload trends and high-frequency components to model local variations and change points, enabling more comprehensive temporal representation. Its multi-branch architecture allows for efficient capture of multi-scale dependencies, enhancing adaptability to diverse and dynamic workloads. Extensive experiments on five real-world datasets—Azure-2017, Alibaba-2018, Google-2019, Alibaba-2020 and Alibaba-2021—demonstrate that TFMSNet consistently outperforms state-of-the-art models in performance metrics of MAE, MSE, RMSE and MAPE across multiple prediction horizons. Ablation studies confirm the critical roles of frequency-enhanced attention and multi-branch architecture in improving accuracy. Moreover, the model’s robustness under noisy conditions and its efficiency with shorter input sequences further highlight its practical applicability for real-time, resource-constrained cloud environments.","PeriodicalId":13202,"journal":{"name":"IEEE Transactions on Cloud Computing","volume":"14 3","pages":"2209-2222"},"PeriodicalIF":5.3,"publicationDate":"2026-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148902847","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Preemptive Window-Based Resource Borrowing Methods for Fog Computing","authors":"Mohammed Jasim;Nazli Siasi","doi":"10.1109/TCC.2026.3701002","DOIUrl":"https://doi.org/10.1109/TCC.2026.3701002","url":null,"abstract":"Fog nodes under sustained resource saturation face a critical contention problem where newly arrived delay-sensitive requests compete for resources occupied by active mapped requests. Here, cloud offloading and neighboring node migration are infeasible under network-wide congestion. Therefore, it is essential to process delay-sensitive requests solely within the fog paradigm to maintain its low-latency saliencies. This necessitates efficient resource contention solutions to handle both ongoing and new requests despite resource constraints. Hence, this paper proposes preemptive window-based resource borrowing methods, <i>fixed-time</i>, <i>interleaved</i>, and <i>grace period</i>, that enable temporal resource sharing between competing requests on the same physical nodes without eviction, migration, or infrastructure expansion. A multi-attribute priority function ranks requests based on processing demands, memory, SFC length, delay-bound, lifetime, age, and revenue contribution, after which the borrowing window governs how resources alternate between mapped and new requests based on preemption thresholds and borrowing periods. The framework is evaluated versus baseline methods on a realistic Cogentco topology with heterogeneous capacities, Poisson traffic, and practical SFC requests parameters, under 95% sustained saturation. Results demonstrate that the proposed grace borrowing exhibits the highest admission rates, completion probabilities, minimal service downtime, fewest failed interruptions, lowest penalty, and highest revenue across all traffic intensities. The fixed and interleaved methods offer progressive tradeoffs between new request urgency and mapped request preservation. These findings establish fog computing as a self-sustained paradigm capable of concurrent service continuity and admission under worst-case traffic conditions.","PeriodicalId":13202,"journal":{"name":"IEEE Transactions on Cloud Computing","volume":"14 3","pages":"2068-2085"},"PeriodicalIF":5.3,"publicationDate":"2026-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148902963","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Collaborative Offloading and Resource Allocation for Efficient Inference of Deep Neural Networks in Wireless Networks","authors":"Muhammad Ismail;Long Bao Le","doi":"10.1109/TCC.2026.3702650","DOIUrl":"https://doi.org/10.1109/TCC.2026.3702650","url":null,"abstract":"Integrating Deep Neural Networks (DNNs) into wireless networks of Internet of Things (IoT) devices or Unmanned Aerial Vehicles (UAVs) can enable numerous smart applications, but the computational complexity of DNN inference often causes intolerable delays unless effectively managed. In this paper, we formulate the joint offloading of DNN layers and resource allocation in UAV-based wireless systems as an optimization problem to minimize total inference latency under constraints on wireless connectivity, computational resources, and UAV processing quotas. We propose an optimization-based algorithm, LARA, which uses alternating optimization to iteratively solve the formulated problem. For potential decentralized implementation, we design GAME-MIND, a matching game–based algorithm that efficiently allocates DNN layers to UAVs while balancing computational load. Numerical results show that GAME-MIND achieves favorable delay performance compared to centralized LARA, which itself is close to the near-optimal solution, and significantly outperforms other baselines, including two heuristic methods that offload layers to nearest UAVs, which incur at least twice the delay under high-load conditions. We also demonstrate GAME-MIND’s convergence and analyze its communication, computation, and total inference latency under various network settings.","PeriodicalId":13202,"journal":{"name":"IEEE Transactions on Cloud Computing","volume":"14 3","pages":"1630-1644"},"PeriodicalIF":5.3,"publicationDate":"2026-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148903063","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Jiaqi Zhao;Hui Zhu;Wei Xu;Qian Chen;Xiaopeng Yang;Hui Li
{"title":"A Privacy-Preserving and Non-Interactive Outsourced Tree Evaluation Scheme via Trusted Execution Environments","authors":"Jiaqi Zhao;Hui Zhu;Wei Xu;Qian Chen;Xiaopeng Yang;Hui Li","doi":"10.1109/TCC.2026.3710713","DOIUrl":"https://doi.org/10.1109/TCC.2026.3710713","url":null,"abstract":"With the rapid advancement and widespread adoption of tree models, an increasing number of challenges, such as privacy risks and performance bottlenecks, have also emerged. To address these issues, several outsourced private decision tree evaluation (PDTE) schemes have been proposed, but they struggle to balance prediction efficiency and security in a practical setting. In this paper, we propose a privacy-preserving and non-interactive outsourced tree evaluation scheme, namely NIOT, in which users can access efficient, accurate, and virtually transparent prediction services from one server. Specifically, we propose a secure and non-interactive outsourced comparison algorithm, which leverages the innovative integration of trusted execution environments and additive homomorphic encryption under a general semi-honest threat model, enabling efficient comparisons between masked query values and thresholds. Then, based on masked summations, the oblivious path selection algorithm is presented, which evaluates paths over ciphertexts while concealing the true inference path. The security of NIOT is formally verified according to the ideal-real paradigm. Experimental results on real-world and synthetic datasets show that NIOT achieves lossless prediction accuracy like non-privacy predictions, and delivers at least a 4.33× running speedup and a 2.32× communication improvement compared to state-of-the-art outsourced PDTE schemes.","PeriodicalId":13202,"journal":{"name":"IEEE Transactions on Cloud Computing","volume":"14 3","pages":"1313-1328"},"PeriodicalIF":5.3,"publicationDate":"2026-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148903114","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"PLOSQ3D: Privacy-Preserving Location-Based Skyline Query Over Encrypted 3D Spatial Data","authors":"Zhuliang Jia;Suprio Ray;Rongxing Lu;Pulei Xiong","doi":"10.1109/TCC.2026.3694669","DOIUrl":"https://doi.org/10.1109/TCC.2026.3694669","url":null,"abstract":"Privacy-preserving location-based skyline queries (LBSQ) enable location-based services (LBS) over outsourced spatial data while preserving data privacy. Prior studies primarily consider Euclidean distance as the spatial-attribute metric. However, this does not capture reachability in three-dimensional (3D) obstacle environments, where obstacles invalidate direct Euclidean distances and necessitate obstacle-aware path computations. In this work, we present PLOSQ3D, a privacy-preserving location-based skyline query framework in 3D obstacle space. We first formalize the problem, specify its privacy requirements, and identify the challenges introduced by obstacle-aware distances. Subsequently, we introduce a novel index, Secure Augmented R-Tree (SAR-Tree) that jointly encodes spatial and non-spatial attributes, enabling effective pruning under 3D spatial constraints. To enforce privacy, we leverage Function Secret Sharing (FSS) to design three protocols: SLDC for secure dominance computation, SSPC for secure shortest-path computation, and OLDU for oblivious skyline-set update. Building on them, we carefully design the PLOSQ3D scheme. Our security analysis demonstrates strong privacy guarantees against honest-but-curious adversaries. We further conduct extensive experiments on both synthetic and real 3D datasets. Experimental results show that our framework achieves high efficiency in both computation and communication overhead, confirming its practicality for 3D spatial applications that demand spatial-awareness and privacy protection.","PeriodicalId":13202,"journal":{"name":"IEEE Transactions on Cloud Computing","volume":"14 3","pages":"2055-2067"},"PeriodicalIF":5.3,"publicationDate":"2026-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148903122","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Fast and Green Federated Learning: A Heterogeneity-Aware Client Selection Strategy Maximizing Overall Contribution Rate","authors":"Cheng Hu;Yuan Wang;Renuga Kanagavelu;Yuhui Deng;Peiyan Ning;Kangning Cai;Jiming Xu;Yong Liu;Siow Mong Rick Goh;Qingsong Wei","doi":"10.1109/TCC.2026.3713640","DOIUrl":"https://doi.org/10.1109/TCC.2026.3713640","url":null,"abstract":"Federated Learning is a widely studied distributed machine learning paradigm, in which numerous heterogeneous clients collaboratively train a global model without sharing their local data. The performance of Federated Learning relies on the clients involved in the training process. Some clients may contribute more than others. However, they may also require more computing resources and incur longer runtime, resulting in slower overall progress and higher energy consumption. To tackle this issue, we introduce a new concept, Contribution Rate, to better capture client contribution over a unit of time. Consequently, we propose FedRate, a novel heterogeneity-aware client selection strategy to maximize the overall contribution rate of federated learning systems. In addition, FedRate adopts a computation-efficient contribution measurement mechanism for quantifying each client’s contribution with linear complexity. Extensive experiments are conducted to evaluate FedRate against state-of-the-art baselines, under scenarios involving clients with heterogeneous computing capabilities and non-Independent and Identically Distributed (non-IID) local data. Experimental results show that FedRate significantly reduces the training time and energy consumption by an average of 51%+ and 69%+ respectively, without compromising the final accuracy of the global model.","PeriodicalId":13202,"journal":{"name":"IEEE Transactions on Cloud Computing","volume":"14 3","pages":"1832-1845"},"PeriodicalIF":5.3,"publicationDate":"2026-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148903162","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}