# Towards Crowdsourcing Internet of Things (Crowd-IoT): Architectures, Security and Applications
## 4 Trustworthy, Security and Privacy in Crowdsourcing Internet of Things
### Security in Crowd-IoT  
Privacy and security are related to crowdsourcing. As mentioned in Section 3.1 on privacy in crowdsourcing of IoT, some existing approaches resolve users' privacy by data encryption. However, some encryption algorithms, e.g., public-key encryption methods, are not suitable for crowdsourcing because they require the parties to issue the keys for decryption to be made online. Implementing crowdsourcing with a large number of users and tasks is complex. On the other hand, conventional symmetric encryption methods are not applicable to crowdsourcing because the data can be compromised after the keys have been revealed. This subsection reviews specific research works on security in crowdsourcing IoT, followed by security in edge-based crowdsourcing. The authors in [52] proposed a ciphertext-policy attribute-based encryption (CP-ABE) mechanism for crowdsourcing. The proposed crowdsourcing system with CSMA-ABE is shown in Figure 16. The system components contain requesters, workers, a semi-trusted third party, and attribute authorities. In the CSMA-ABE scheme, the requestor applies the CP-ABE encryption to encrypt the task data after specifying an access policy based on the task requirement. After task matching, the partially decrypted task is sent back to workers. The workers decrypt the task to obtain the task data and the symmetric key. Each worker encrypts the task result using the symmetric key and sends the encrypted result back to the platform. Their work focused on key management and distribution in multiauthority scenarios while ensuring forward/backward security of tasks. Figure 16: Crowdsourcing system with CSMA-ABE [52]. Figure 15: The architecture of edge-crowd integration for cooperative trust and privacy preservation in social IoT [51]. In crowdsourcing IoT, signcryption is a cryptographic primitive for ensuring the authenticity and confidentiality of crowdsourced data. A novel identity-based signcryption (IBSC) approach using bilinear pairing was proposed by [PERSON] [53] for crowdsourcing industrial IoT. The architecture for crowdsourced industrial IoT and the network model of the proposed signcryption scheme are shown in Figure 17. There are four major units: (1) Cloud Server for data processing and storage; (2) PKG for generation of system and secret keys; (3) IIoT Data Owner, which applies the receiver and PKG public keys to signcrypt data; and (4) Receiver which allows users to obtain a secret key from the PKG and perform unsigncryption over signcrypted data. The performance comparison shows that the IBSC scheme is efficient in terms of communication and computation costs with signcryptext size and is suitable for crowdsourced industrial IoT applications. Remote user authentication is important for crowdsourcing IoT. The authors in [54] proposed an approach based on a chaotic map for a user authentication scheme that is secure for crowdsourcing IoT. Their scheme considered three factors: smart cards, passwords, and personal biometrics. These factors can be authenticated by the Remote server, which participates in the key agreement process. The proposed approach has some important features. First, it does not store or transmit any user-sensitive information to protect the user's privacy. That means there is no revealing of sensitive information during the mutual authentication and key agreement phase. For authentication, the authors applied zero-knowledge proof, fuzzy extractor, and Chebyshev polynomial chaotic maps. The chaotic map zero-knowledge proof allows the user to prove the ownership of a secret key without revealing sensitive information. A fuzzy extractor can then extract the random string and the auxiliary string from a biometric input. There are five phases in the overall process: (1) Registration phase; (2) Login phase; (3) Authentication and key establishment phase; (4) Password and biometric change phase; and (5) Smart card or device revocation phase. Their approach has the advantages of high security and low communication and computational costs.