While traditional real-time systems analysis requires single pessimistic estimates to represent system parameters, the mixed-criticality (MC) design proposes to use multiple estimates of system parameters with different levels of pessimism, resulting in low critical workloads sacrificed at run-time in order to provide guarantees to high critical workloads. Shortcomings of the MC design were improved recently by the precise MC scheduling technique in which the processor speed is increased at run-time to provide guarantees to both low and high critical workloads. Aiming to extend the precise MC scheduling to multiprocessor computing platforms, this paper proposes three novel scheduling algorithms that are based on virtual-deadline and fluid-scheduling approaches. We prove the correctness of our proposed algorithms through schedulability analysis and also present their theoretical effectiveness via speedup bounds and approximation factor calculations. Finally, we evaluate their performance experimentally via randomly generated task sets and demonstrate that the fluid-scheduling algorithms outperform the virtual-deadline algorithm.

Mixed-criticality (MC) scheduling has been proposed to mitigate the pessimism in real-time schedulability analysis that must provide guarantees for the worst case. In most existing work on MC scheduling, low-critical tasks are either dropped or degraded at the criticality mode switch in order to preserve the temporal guarantees for high-critical tasks. Recently, a different direction, called precise MC scheduling, has been investigated. In precise MC scheduling, no low-critical task should be dropped or degraded; instead, the platform processing capacity is augmented at mode switch to accommodate the additional workload by high-critical tasks. In contrast to prior work on this topic with respect to varying processor speed, this work investigates the precise scheduling problem of MC tasks when the number of available processors may vary at the mode switch. To address this new problem, we propose two alternative algorithms by adapting virtual-deadline-based EDF and by fluid scheduling, respectively, and provide a sufficient schedulability test for each. We also conduct schedulability experiments with randomly generated task sets to demonstrate the effectiveness of the proposed algorithms and the benefits of the new scheduling model.

The Automatic Dependent Surveillance-Broadcast (ADS-B) protocol is being adopted for use in unmanned aerial vehicles (UAVs) as the primary source of information for emerging multi-UAV collision avoidance algorithms. The lack of security features in ADS-B leaves any processes dependent upon the information vulnerable to a variety of threats from compromised and dishonest UAVs. This could result in substantial losses or damage to properties. This research proposes a new distance-bounding scheme for verifying the distance and flight trajectory in the ADS-B broadcast data from surrounding UAVs. The proposed scheme enables UAVs or ground stations to identify fraudulent UAVs and avoid collisions. The scheme was implemented and tested in the ArduPilot SITL (Software In The Loop) simulator to verify its ability to detect fraudulent UAVs. The experiments showed that the scheme achieved desired accuracy in both flight trajectory measurement and attack detection.

Mobile devices are evolving into powerful systems due to recent advances in their communication, storage and computation technologies. They are poised to play a key role in providing a rich collaborative computing platform for various applications. This paper proposes "Transient Clouds" - a collaborative computing platform that allows nearby devices to form an ad-hoc network and provide various capabilities as cloud services. Transient Clouds utilize the collective capabilities of the devices present, along with their social and context awareness that cannot be provided efficiently by the traditional clouds. We present a modified algorithm of the Hungarian method for assigning tasks to devices in order to achieve various goals (e.g., load balancing, collocating executions, etc.). We evaluate the performance of our proposed algorithms through simulation and provide a real implementation on the Android platform using the Wi-Fi Direct framework. We envision Transient Clouds to be utilized in temporal scenarios in which the cloud is created on-the-fly by the devices present in an environment and would disappear as the devices leave the network.

—Mobile cloud computing is a viable collaborative computing paradigm for the Internet of Things (IOT) to strengthen the synergy of mobile devices. The security of such collaborative computing needs much attention. This paper explores how to use Probabilistically Checkable Proof (PCP) on And

Systems employing mobile devices (e.g., sensors, smart phones, robots) are emerging with growing capabilities in performing a wide variety of tasks. Due to their abundance and wide deployments, they are posed to play a dominant role in providing a rich mobile computing platform for various jobs, especially for new ones that are created on-the-fly. Realizing this platform is challenging since it is hard to predict the exact equipment present in an environment, what types of information need to be communicated to the devices to execute their tasks, and how to reprogram these devices. This work proposes a new on-demand collaborative computing framework that maps a new job as a set of tasks onto the mobile devices for execution. The mapping is done in a manner that takes into account the capabilities of the devices, the dependency between the tasks, the adjacency of the devices, and the requirements of the requested new job. Our proposed framework is implemented as a test-bed in our Mobile Cyber-Physical Systems lab with MICAz sensors and iRobot Create robots.

This paper presents a secure framework for dispatching and completing tasks in a network of weak embedded devices, such as sensors. The framework allows a device to dispatch tasks to other remote devices while ensuring that the secure data of the originating devices will not be disclosed with the dispatched tasks. The framework is implemented with TinyOS and MICAz motes for evaluation. The results show that the framework achieves the desired security with little overhead and is feasible to weak devices.

Intrusion monitoring is an indispensable security measure for multi-channel wireless mesh networks. This paper studies how to use mesh routers to monitor a network while supporting regular traffic. This paper shows that the traffic aware monitoring (TRAM) problem is an NP-hard problem, which is challenging in coordinating monitoring and traffic forwarding to provide maximal monitoring coverage. This paper proposes three heuristic strategies for seeking optimal monitoring channels and develops a TRAM protocol for accommodating monitoring and transmission simultaneously in mesh networks. The evaluation shows that the proposed TRAM scheme can effectively utilize mesh routers' idle time for monitoring with only minor impact to regular traffic.

The proliferation of mobile devices, coupled by the increase in their capabilities, have enabled the establishment of a rich mobile computing platform for various applications. In this paper we propose a probabilistic code distribution model that enables a mobile device to execute code segments through the help of nearby mobile devices in a secure and resilient manner. The model relies on randomization and replication techniques against unhelpful devices that do not execute their assigned code segments and malicious ones that try to reveal the overall application. We derive bounds to ensure the success of our scheme with a very high probability. Simulation and implementation experiments using MICAz sensors are conducted to validate our model and study the performance of our scheme.

Although multi-interface multi-channel (MIMC) wireless networks have drawn much attention, they are susceptible to various attacks. This paper describes three new types of attacks against a variety of channel assignment protocols: utilization-based conflict attack, link break attack, and denial-of-data attack. These attacks exploit the vulnerabilities arising from the inherent properties of channel assignment protocols in MIMC wireless networks. Analysis and simulation show that the identified attacks are not only very lightweight in attacking but also devastating to the connectivity, throughput, and availability of the MIMC wireless networks.

Since sensors do not have a sophisticated hardware architecture or an operating system to manage code for safety, attacks injecting code to exploit memory-related vulnerabilities can present threats to sensor applications. In a sensor's simple memory architecture, injected code can alter the control flow of a sensor application to either misuse existing routines or download other malicious code to achieve attacks. To protect the control flow, this paper proposes a self-healing scheme that can stop attacks from exploiting the control flow and then recover sensor applications to normal operations with minimum overhead. The self-healing scheme embeds diversified protection code at particular locations to enforce access control in code memory. Both the access control code and the recovery code are designed to be resilient to control flow attacks that attempt to evade the protection. Furthermore, the self-healing scheme directly processes application code at the machine instruction level, instead of performing control or data analysis on source code. The implementation and evaluation show that the self-healing scheme is lightweight in protecting sensor applications.

As sensors in a network are mostly homogeneous in software and hardware, a captured sensor can easily expose its code and data to attackers and further threaten the whole network. To increase the survivability of a sensor network, code diversification has been shown to be an effective solution. However, disseminating many diversified code images is very costly in current network reprogramming systems, as it does not take advantage of the epidemic propagation of network reprogramming. New mechanisms need to be studied for integrating code diversification with network reprogramming. This paper proposes an efficient code diversification scheme for network reprogramming in sensor networks. The scheme uses Deluge to disseminate code images of sensor applications that carry diversification information and allows sensors to randomize the layout of their own executables. Such diversification can defeat a wide range of attacks that exploit the knowledge of code layout, as no sensors have the same code layout in their executables. Except the cost determined by the code size, the computational overhead of diversification in sensors can be reduced to 60%, while sacrificing only 10% of security.

Abstract We propose PWC, a proactive worm containment solution for enterprises. PWC can stop—instead of just slow down—an infected host from releasing worm scans as early as after merely four scans. Motivated by the observation that a worm uses a sustained outgoing packet rate, PWC gains infection awareness seconds before a signature or filter can be generated. To overcome denial‐of‐service possibly caused by such characteristic indicators of infection, PWC/,develops two new white detection (detecting who are uninfected) techniques: (a) the vulnerability time window lemma, and (b) the relaxation analysis. PWC does not rely on contents‐based signatures thus it can defend against polymorphic worms timely in containment. PWC is also resilient to containment evading. PWC is not sensitive to worm scan rate, and not protocol specific. Due to white detection, PWC causes minimal denial‐of‐service. Evaluation based on real traces and worm simulations demonstrates that PWC significantly outperforms Virus Throttle in terms of number of released worm scans, number of hosts infected by local scans, and denial‐of‐service effects. Copyright © 2009 John Wiley & Sons, Ltd.

As the technology of mobile sensors advances, mobility control becomes a viable option that can be utilized to minimize energy consumption in wireless sensor networks (WSNs). A mobility control protocol re-deploys mobile sensors to optimal positions to minimize energy consumption for communication. We identify a unique privacy issue in mobility control protocols that discloses the physical location of the sink node to intruders in WSNs. To protect the sink node, we propose a new privacy preserving scheme to secure mobility control protocols against attacks that locate and sabotage the sink node. The privacy preserving scheme obfuscates the sink location with dummy sink nodes. Analysis shows that the scheme can effectively hide the sink location via anonymity. The scheme can also be easily integrated into current mobility control protocols without raising much additional overhead. The performance simulation and analysis show that, with the sink node well-protected, mobility control protocols achieve similar performance as original protocols.

Since sensors do not have a sophisticated hardware architecture or an operating system to manage code for safety, attacks injecting code to exploit memory-related vulnerabilities can present threats to sensor applications. In a sensor's simple memory architecture, injected code can alter the control flow of a sensor application to either misuse existing routines or download other malicious code to achieve attacks. To protect the control flow, this paper proposes a self-healing scheme that can detect attacks attempting to alter the control flow and then recover sensor applications to normal operations with minimum overhead. The self-healing scheme embeds diversified protection code at particular locations to enforce access control in program memory. Both the access control code and the recovery code are designed to be resilient to control flow attacks that attempt to evade the protection. Furthermore, the self-healing scheme directly processes application code at the machine instruction level, instead of performing control or data analysis on source code. The implementation and evaluation show that the self-healing scheme is lightweight in protecting sensor applications.

Wireless broadcast is an effective approach for disseminating data to a number of users. To provide secure access to data in wireless broadcast services, symmetric-key-based encryption is used to ensure that only users who own the valid keys can decrypt the data. With regard to various subscriptions, an efficient key management for distributing and changing keys is in great demand for access control in broadcast services. In this paper, we propose an efficient key management scheme, namely, key tree reuse (KTR), to handle key distribution with regard to complex subscription options and user activities. KTR has the following advantages. First, it supports all subscription activities in wireless broadcast services. Second, in KTR, a user only needs to hold one set of keys for all subscribed programs instead of separate sets of keys for each program. Third, KTR identifies the minimum set of keys that must be changed to ensure broadcast security and minimize the rekey cost. Our simulations show that KTR can save about 45 percent of communication overhead in the broadcast channel and about 50 percent of decryption cost for each user compared with logical-key-hierarchy-based approaches.

Since sensor applications are implemented in embedded computer systems, cyber attacks that compromise regular computer systems via exploiting memory-related vulnerabilities present similar threats to sensor networks. However, the paper shows that memory fault attacks in sensors are not just the same as in regular computers due to sensor’s hardware and software architecture. In contrast to worm attacks, malcodes carried by exploiting packets cannot be executed in a sensor. Therefore, the paper proposes a range of attack approaches to illustrate that a mal-packet, which only carries specially crafted data, can exploit memory-related vulnerabilities and utilize existing application codes in a sensor to propagate itself without disrupting sensor’s functionality. The paper shows that such a mal-packet can have as few as 17 bytes. A prototype of a 27-byte mal-packet has been implemented and tested in Mica2 sensors. Simulation shows that the propagation pattern of such a mal-packet in a sensor network is very different from worm propagation. Mal-packets can either quickly take over the whole network or hard to propagate under different traffic situations.

Peer-to-Peer (P2P) systems have become an im- portant application in the Internet for information sharing. However, recent studies showed that pollution in P2P file sharing systems is very serious. Although some measurements have been done to estimate the pollution in P2P networks, how a polluted file is propagated among nodes and why the pollution is serious are not studied. This paper proposes a model to capture the major features of the pollution. The model describes the propagation of a polluted file and the competition among the polluted version and the good version of a file in a P2P network. The model shows that correct user strategies based on publisher's reputation can effectively stop pollution at the expense of some initial propagation.

Ad hoc networks are usually unreliable and have limited bandwidth resources. In such networks, packet injection attacks can cause serious denial-of-service via wireless channel contention and network congestion. To defend against this type of injection attacks, we propose SAF, an efficient and effective Source Authentication Forwarding protocol. The protocol can either immediately filter out injected junk packets with very high probability or expose the true identity of an injector. Differing from other forwarding defenses, this protocol is designed to fit in the unreliable environment of ad hoc networks. Our simulation shows that SAF incurs very lightweight overhead in communication and computation.

To provide secure access to data in wireless broadcast services, symmetric key-based encryption is used to ensure that only users who own the valid keys can decrypt the data. In this paper, we propose an efficient key management scheme (namely KTR) to handle key distribution with regarding to complex subscription options and user activities. KTR has the following advantages. First, it supports all subscription activities in wireless broadcast services. Second, in KTR, a user only needs to hold one set of keys for all subscribed programs, instead of separate sets of keys for each program. Third, KTR identifies the minimum set of keys that must be changed to ensure broadcast security and minimize the rekey cost. Our simulations show that KTR can save about 45% of communication overhead in the broadcast channel and about 50% of decryption cost for each user, compared with conventional approaches based on logical key hierarchy.

In this paper, we present an ant colony-based heuristic to solve QoS (quality of service) constrained multicast routing problems. Our algorithm considers multiple QoS metrics, such as bandwidth, delay, delay jitter and packet loss rate, to find the multicast tree that minimizes the total cost. We also explore the scalability of the ant algorithm. Our tests show that the algorithm can find optimal (or near-optimal) solutions quickly and that it has good scalability.