Trustworthiness in neural networks is crucial for their deployment in critical applications, where reliability, confidence, and uncertainty play a pivotal role in decision-making. Traditional performance metrics such as accuracy and precision fail to capture these aspects, particularly in cases where models exhibit overconfidence. To address these limitations, this paper introduces a novel framework for quantifying the trustworthiness of neural networks by incorporating subjective logic into the evaluation of Expected Calibration Error (ECE). This method provides a comprehensive measure of trust, distrust, and uncertainty by clustering predicted probabilities and fusing opinions using appropriate fusion operators. We demonstrate the effectiveness of this approach through experiments on the MNIST and CIFAR-10 datasets, where post-calibration results indicate improved trustworthiness. The proposed framework offers a more interpretable and nuanced assessment of AI models, with potential applications in sensitive domains such as healthcare and autonomous systems.

Taking part in surveys, experiments, and studies is often compensated by rewards to increase the number of participants and encourage attendance. While privacy requirements are usually considered for participation, privacy aspects of the reward procedure are mostly ignored. To this end, we introduce PrePaMS, an efficient participation management system that supports prerequisite checks and participation rewards in a privacy-preserving way. Our system organizes participations with potential (dis-)qualifying dependencies and enables secure reward payoffs. By leveraging a set of proven cryptographic primitives and mechanisms such as anonymous credentials and zero-knowledge proofs, participations are protected so that service providers and organizers cannot derive the identity of participants even within the reward process. In this paper, we have designed and implemented a prototype of PrePaMS to show its effectiveness and evaluated its performance under realistic workloads. PrePaMS covers the information whether subjects have participated in surveys, experiments, or studies. When combined with other secure solutions for the actual data collection within these events, PrePaMS can represent a cornerstone for more privacy-preserving empirical research.

Subjective Logic (SL) enriches probabilistic logic by incorporating uncertainty and subjective belief ownership, enabling the expression of uncertainty about subjective beliefs. Unlike traditional probabilistic logics, SL 1) accommodates situations where different agents express beliefs about the same proposition, integrating the subjective nature and ownership of beliefs; and 2) addresses existing limitations in Dempster-Shafer Theory of evidence (DST), particularly in modelling trust transitivity. In modern computer systems, trust assessment extends beyond direct relationships to complex networks, necessitating the consideration of referral and direct trust relationships. This paper introduces a novel trust discount operator for referral edges in complex networks, addressing challenges in discounting trust across two and multiple referral edges. Through our empirical analysis, we demonstrate the effectiveness of the proposed operator and establish a relationship between path length and trustworthiness.

Modern vehicles increasingly rely on electronics, software, and communication technologies (cyber space) to perform their driving task. Over-The-Air (OTA) connectivity further extends the cyber space by creating remote access entry points. Accordingly, the vehicle is exposed to security attacks that are able to impact road safety. A profound understanding of security attacks, vulnerabilities, and mitigations is necessary to protect vehicles against cyber threats. While automotive threat descriptions, such as in UN R155, are still abstract, this creates a risk that potential vulnerabilities are overlooked and the vehicle is not secured against them. So far, there is no common understanding of the relationship of automotive attacks, the concrete vulnerabilities they exploit, and security mechanisms that would protect the system against these attacks. In this article, we aim at closing this gap by creating a mapping between UN R155, Microsoft STRIDE classification, Common Attack Pattern Enumeration and Classification (CAPEC), and Common Weakness Enumeration (CWE). In this way, already existing detailed knowledge of attacks, vulnerabilities, and mitigations is combined and linked to the automotive domain. In practice, this refines the list of UN R155 threats and therefore supports vehicle manufacturers, suppliers, and approval authorities to meet and assess the requirements for vehicle development in terms of cybersecurity. Overall, 204 mappings between UN threats, STRIDE, CAPEC attack patterns, and CWE weaknesses were created. We validated these mappings by applying our Automotive Attack Database (AAD) that consists of 361 real-world attacks on vehicles. Furthermore, 25 additional attack patterns were defined based on automotive-related attacks.

Zero Trust security has recently gained attention in enterprise network security. One of its key ideas is making network-level access decisions based on trust scores. However, score-based access control in the enterprise domain still lacks essential elements in our understanding, and in this paper, we contribute with respect to three crucial aspects. First, we provide a comprehensive list of 29 trust attributes that can be used to calculate a trust score. By introducing a novel mathematical approach, we demonstrate how to quantify these attributes. Second, we describe a dynamic risk-based method to calculate the trust threshold the trust score must meet for permitted access. Third, we introduce a novel trust algorithm based on Subjective Logic that incorporates the first two contributions and offers fine-grained decision possibilities. We discuss how this algorithm shows a higher expressiveness compared to a lightweight additive trust algorithm. Performance-wise, a prototype of the Subjective Logic-based approach showed similar calculation times for making an access decision as the additive approach. In addition, the dynamic threshold calculation showed only 7% increased decision-making times compared to a static threshold.

Connected, Cooperative, and Autonomous Mobility (CCAM) will take intelligent transportation to a new level of complexity. CCAM systems can be thought of as complex Systems-of-Systems (SoSs). They pose new challenges to security as consequences of vulnerabilities or attacks become much harder to assess. In this paper, we propose the use of a specific type of a trust model, called subjective trust network, to model and assess trustworthiness of data and nodes in an automotive SoS. Given the complexity of the topic, we illustrate the application of subjective trust networks on a specific example, namely Cooperative Intersection Management (CIM). To this end, we introduce the CIM use-case and show how it can be modelled as a subjective trust network. We then analyze how such trust models can be useful both for design time and run-time analysis, and how they would allow us a more precise quantitative assessment of trust in automotive SoSs. Finally, we also discuss the open research problems and practical challenges that need to be addressed before such trust models can be applied in practice.

Research on the security of sensors used in air, sea, and road vehicles has increased over the past years. However, previous work frequently focuses on sensors that detect the vehicle’s surroundings, like LiDAR, RADAR, or cameras. While a successful attack could have an equally severe impact, motion control sensors are investigated to a lesser degree, and security research on them often treats only one of the vehicle types (air, sea, road). The same aspect also applies to mitigations proposed in some of the papers. We close this gap by providing a broad overview and comparing research on demonstrated attacks and defenses. The present survey is the first to cover demonstrated attacks on vehicle motion control sensors of air, sea and road vehicles. Moreover, for the identified issues, demonstrated mitigations and countermeasures for the attacks are referenced. Further, we discuss possible adjustments required to transfer a countermeasure that is demonstrated for one vehicle type to the other two. Additionally, all attacks and countermeasures are summarized in tabular or graphical representation. The covered sensors include rotation, acceleration, gyroscopic, pressure sensors, Inertial Measurement Units, and sensors used to determine the position of a vehicle.

Service Function Chaining (SFC) enables dynamic steering of traffic through a set of service functions based on classification of packets, allowing network operators fine-grained and flexible control of packet flows. New paradigms like Zero Trust (ZT) pose additional requirements to the security of network architectures. This includes client authentication, confidentiality, and integrity throughout the whole network, while also being able to perform operations on the unencrypted payload of packets. However, these requirements are only partially addressed in existing SFC literature. Therefore, we first present a comprehensive analysis of the security requirements for SFC architectures. Based on this analysis, we propose a concept towards the fulfillment of the requirements while maintaining the flexibility of SFC. In addition, we provide and evaluate a proof of concept implementation, and discuss the implications of the design choices.

Internet of Things (IoT) devices are becoming more widespread not only in areas such as smart homes and smart cities but also in research and office environments. The sheer number, heterogeneity, and limited patch availability provide significant challenges for the security of both office networks and the Internet in general. The systematic estimation of device risks, which is essential for mitigation decisions, is currently a skill-intensive task that requires expertise in network vulnerability scanning, as well as manual effort in firmware binary analysis. This article introduces SAFER, 1 the Security Assessment Framework for Embedded-device Risks, which enables a semi-automated risk assessment of IoT devices in any network. SAFER combines information from network device identification and automated firmware analysis to estimate the current risk associated with the device. Based on past vulnerability data and vendor patch intervals for device models, SAFER extrapolates those observations into the future using different automatically parameterized prediction models. Based on that, SAFER also estimates an indicator for future security risks. This enables users to be aware of devices exposing high risks in the future. One major strength of SAFER over other approaches is its scalability, achieved through significant automation. To demonstrate this strength, we apply SAFER in the network of a large multinational organization, to systematically assess the security level of hundreds of IoT devices on large-scale networks. Results indicate that SAFER successfully identified 531 out of 572 devices leading to a device identification rate of 92.83 %, analyzed 825 firmware images, and predicted the current and future security risk for 240 devices.

Motion control systems, such as traditional Electronic Stability Control (ESC) systems, in autonomous vehicles rely on sensors. One of these sensor types are gyroscopes. In our research we found a resonance frequency of an automotive grade MEMS gyroscope when exposing the gyroscope to audible sound frequencies. As this caused the yaw rate to be altered we further analyzed the ESC system's reaction on an altered yaw rate. This caused a system error that was indicated by error codes and an active warning light. Last but not least we describe improvements that can enhance the ESC system's availability.

It is mostly unclear which personal predispositions are associated with knowledge about how to protect one’s privacy online and actually protecting it. More elaborate knowledge on this topic may help in the design process of user interfaces. Therefore, we investigated person characteristics underlying individual differences in online privacy literacy and behavior.N = 1,073 (n = 500 men) participants completed the Online Privacy Literacy Scale, an Online Privacy Behavior Scale, the Big Five Inventory, and a test assessing crystallized intelligence in an online survey.Online privacy literacy and behavior were significantly, moderately positively related. Both were significantly positively related to crystallized intelligence. Online privacy behavior was additionally significantly positively related to Openness.The results give insights into individual factors associated with knowledge about online privacy settings and related behaviors. In addition, results can help optimizing design of user interfaces/assistive technologies that support (certain) users to implement their data protection rights.

Decentralized token exchanges allow for secure trading of tokens without a trusted third party. However, decentralization is mostly achieved at the expense of transaction privacy. For a fair exchange, transactions must remain private to hide the participants and volumes while maintaining the possibility for noninteractive execution of trades. In this paper we present a swap confidential transaction system (SwapCT) which is related to ring confidential transactions (e.g. used in Monero) but supports multiple token types to trade among and enables secure, partial transactions for noninteractive swaps. We prove that SwapCT is secure in a strict, formal model and present its efficient performance in a prototype implementation with logarithmic signature sizes for large anonymity sets. For our construction we design an aggregatable signature scheme which might be of independent interest. Our SwapCT system thereby enables a secure and private exchange for tokens without a trusted third party.

Over the last years, demand for file hosting has sky-rocketed due to cost reductions and availability of services. However, centralized providers have a negative impact on the privacy of their users, since they are able to read and collect various data about their users and even link it to their identity via their payments. On the other hand, decentralized storage solutions like GNUnet suffer from a lack of participation by providers, since there is no feasible business model. We propose PriCloud, a decentralized storage system which allows users to pay their storage providers without sacrificing their privacy by employing anonymous storage smart contracts and private payments on a blockchain. We are able to provide privacy to the users and storage providers, and unlinkability between users and files. Our system offers decentralized file storage including strong privacy guarantees and built-in remuneration for storage providers.

Cooperative Intelligent Transport Systems (C-ITS) is a new upcoming technology that aims at increasing road safety and reducing traffic accidents. C-ITS is based on peer-to-peer messages sent on the Vehicular Ad hoc NETwork (VANET). VANET messages are currently authenticated using digital keys from valid certificates. However, the authenticity of a message is not a guarantee of its correctness. Consequently, a misbehavior detection system is needed to ensure the correct use of the system by the certified vehicles. Although a large number of studies are aimed at solving this problem, the results of these studies are still difficult to compare, reproduce and validate. This is due to the lack of a common reference dataset. For this reason, the original VeReMi dataset was created. It is the first public misbehavior detection dataset allowing anyone to reproduce and compare different results. VeReMi is used in a number of studies and is currently the only dataset in its field. In this Paper, we extend the dataset by adding realistic a sensor error model, a new set of attacks and larger number of data points. Finally, we also provide benchmark detection metrics using a set of local detectors and a simple misbehavior detection mechanism.

Protocol reverse engineering based on traffic traces infers the behavior of unknown network protocols by analyzing observable network messages. To perform correct deduction of message semantics or behavior analysis, accurate message type identification is an essential first step. However, identifying message types is particularly difficult for binary protocols, whose structural features are hidden in their densely packed data representation. We leverage the intrinsic structural features of binary protocols and propose an accurate method for discriminating message types.Our approach uses a similarity measure with continuous value range by comparing feature vectors where vector elements correspond to the fields in a message, rather than discrete byte values. This enables a better recognition of structural patterns, which remain hidden when only exact value matches are considered. We combine Hirschberg alignment with DBSCAN as cluster algorithm to yield a novel inference mechanism. By applying novel autoconfiguration schemes, we do not require manually configured parameters for the analysis of an unknown protocol, as required by earlier approaches.Results of our evaluations show that our approach has considerable advantages in message type identification result quality and also execution performance over previous approaches.

Modern vehicles and in particular automated or autonomous vehicles utilize data gained from wheel speed sensors for various functionalities like determining current speed or electronic stability control. The wheel speed is derived from a multitude of hall sensors. By generating an electromagnetic field with a fitting frequency it is possible to change the wheel speed sensor's interpretation of wheel speed. The braking system and electronic stability control would then base their actions on incorrect data possibly leading to a dangerous situation. In this research, we investigate practical feasibility and impact of such attacks. For this, an audio amplifier and a Helmholtz coil were used to emit electromagnetic fields with varying frequencies. We then analyse the effect of a single manipulated wheel speed sensor on the electronic stability control used in modern vehicles (using a hardware-in-the-loop setup). We finally describe consequences and possible countermeasure for the upcoming autonomous and highly automated vehicles.

Existing approaches to reverse engineer network protocols based on traffic traces lack comprehensive methods to determine the data type, e. g. float, timestamp, or addresses, of segments in messages of binary protocols. We propose a novel method for the analysis of unknown protocol messages to reveal the data types contained in these messages. Therefore, we split messages into segments of bytes and interpret these as vectors of byte values. Based on the vector interpretation, we can determine similarities and characteristics of specific data types. These can be used to classify segments into clusters of the same type and to identify their data type for previously trained data types. We performed first evaluations of different applications of our method that show promising results up the a data-type-recognition precision of 100,%.

The ability to robustly detect abnormal driving behavior has the potential to limit traffic accidents and save many lives. Abnormal driving behavior that threatens road safety includes aggressive, anxious, nervous, and unstable driving. Any of these can lead to dangerous situations in traffic. Therefore, we aim to provide a robust mechanism to detect such abnormal driving behavior. In this paper, we present our work in this regard which focuses on neural networks-based anomaly detection approaches. We consider autoencoder replicator neural networks and long short-term memory networks; comparing them to a previously employed Isolation Forest. We show that introducing a post-processing approach, that takes into account the recent history of a vehicle, reliable anomaly detection for driving behavior can be achieved based on the recurrent neural network. Its performance is well suited for application in a large scale detection system for driver assistance or autonomous vehicles.

The purpose of multi-source fusion is to combine information from more than two evidence sources, or subjective opinions from multiple actors. For subjective logic, a number of different fusion operators have been proposed, each matching a fusion scenario with different assumptions. However, not all of these operators are associative, and therefore multi-source fusion is not well-defined for these settings. In this paper, we address this challenge, and define multi-source fusion for weighted belief fusion (WBF) and consensus & compromise fusion (CCF). For WBF, we show the definition to be equivalent to the intuitive formulation under the bijective mapping between subjective logic and Dirichlet evidence PDFs. For CCF, since there is no independent generalization, we show that the resulting multi-source fusion produces valid opinions, and explain why our generalization is sound. For completeness, we also provide corrections to previous results for averaging and cumulative belief fusion (ABF and CBF), as well as belief constraint fusion (BCF), which is an extension of Dempster's rule. With our generalizations of fusion operators, fusing information from multiple sources is now well-defined for all different fusion types defined in subjective logic. This enables wider applicability of subjective logic in applications where multiple actors interact.

For preserving privacy, blockchains can be equipped with dedicated mechanisms to anonymize participants. However, these mechanism often take only the abstraction layer of blockchains into account whereas observations of the underlying network traffic can reveal the originator of a transaction request. Previous solutions either provide topological privacy that can be broken by attackers controlling a large number of nodes, or offer strong and cryptographic privacy but are inefficient up to practical unusability. Further, there is no flexible way to trade privacy against efficiency to adjust to practical needs. We propose a novel approach that combines existing mechanisms to have quantifiable and adjustable cryptographic privacy which is further improved by augmented statistical measures that prevent frequent attacks with lower resources. This approach achieves flexibility for privacy and efficency requirements of different blockchain use cases.

Distributed Reflective Denial of Service (DRDoS) attacks are an immanent threat to Internet services. The potential scale of such attacks became apparent in March 2018 when a memcached-based attack peaked at 1.7 Tbps. Novel services built upon UDP increase the need for automated mitigation mechanisms that react to attacks without prior knowledge of the actual application protocols used. With the flexibility that software-defined networks offer, we developed a new approach for defending against DRDoS attacks; it not only protects against arbitrary DRDoS attacks but is also transparent for the attack target and can be used without assistance of the target host operator. The approach provides a robust mitigation system which is protocol-agnostic and effective in the defense against DRDoS attacks.

Driving behavior is a major factor in traffic safety applications. Abnormal behavior, such as extremely aggressive or passive driving, can endanger both the driver and other traffic participants. Most driving behavior analysis approaches to date rely on classification, which requires labeled data for both normal driving and various types of anomalous behavior. We propose an approach that detects anomalous driving patterns based on outlier detection, which does not require such data. Apart from the required data set, existing approaches have difficulties dealing with changing behavior that overlaps with normal behavior (e.g., aggressive drivers still stop in traffic jams). We introduce a post-processing step that significantly improves results in this regard. The approach is evaluated using simulations based on the realistic LuST traffic scenario, and shows reliable detection of anomalous vehicles with low false positive rates.

Changing pseudonym certificates are the agreed-upon approach for privacy-friendly message authentication in upcoming vehicular ad hoc networks and are included in recent standards. This paper examines the performance of four different pseudonym change strategies and their parameters using simulations of realistic, large-scale traffic scenarios. The strategies are assessed by measuring their effectiveness and efficiency in protecting drivers from being tracked by an attacker with limited coverage. In an urban scenario, all strategies achieve satisfactory privacy protection, but the change frequency required is rather high. In a highway scenario, the attacker algorithm achieves a high-tracking success for all strategies, especially in low traffic, even for very short change intervals. This paper proposes concrete change intervals for urban scenarios, which are higher than currently foreseen, but concludes that privacy protection in uniform traffic conditions remains a challenge.

There is an increasing availability of high throughput networks which leads to the need of security appliances in these networks. Testing these appliances with regards to performance and effectiveness relies on testing tools that can achieve or even surpass the capabilities of the devices and networks under test. However, current tools are not capable of achieving both the flexibility and performance demands of modern high-speed security equipment. We propose a concept and an architecture that can fulfil these demands and introduce the General Purpose Network Testing Framework (GPNTF) as a prototype implementation. This framework can achieve high throughput while being highly adaptable with regard to network testing scenarios.

With the omnipresence of the Internet of Things and poorly secured devices with it in combination with high bandwidth networks, Distributed Denial of Service (DDoS) attacks have become one of the biggest threats for network security. With high bandwidth attacks flooding network infrastructure, the pressure to secure the attack targets shifts more and more to the network operators. Often without direct access to the target, the operators are asked to secure their clients. We propose a framework based on Software-Defined Networking (SDN) and the Bro Security Monitor that can mitigate attacks purely within the network infrastructure. In our evaluation, we show that our framework can reliably mitigate several different attack scenarios, including SYN flooding and HTTP flooding.

The increasing availability of 10G Ethernet network capabilities challenges existing transport layer protocols. As 10G connections gain momentum outside of backbone networks, the choice of appropriate TCP congestion control algorithms becomes even more relevant for networked applications running in environments such as data centers. Therefore, we provide an extensive overview of relevant TCP congestion control algorithms for high-speed environments leveraging 10G. We analyzed and evaluated six TCP variants using a physical network testbed, with a focus on the effects of propagation delay and significant drop rates. The results indicate that of the algorithms compared, BIC is most suitable when no legacy variant is present, CUBIC is suggested otherwise.

There are many high-speed TCP variants with different congestion control algorithms, which are designed for specific settings or use cases. Distinct features of these algorithms are meant to optimize different aspects of network performance, and the choice of TCP variant strongly influences application performance. However, setting up tests to help with the decision of which variant to use can be problematic, as many systems are not designed to deal with high bandwidths, such as 10 Gbps or more. This paper provides an overview of pitfalls and challenges of realistic network analysis to help in the decision making process.

The integrity of messages in vehicular ad-hoc networks has been extensively studied by the research community, resulting in the IEEE1609.2 standard, which provides typical integrity guarantees. However, the correctness of message contents is still one of the main challenges of applying dependable and secure vehicular ad-hoc networks. One important use case is the validity of position information contained in messages: position verification mechanisms have been proposed in the literature to provide this functionality. A more general approach to validate such information is by applying misbehavior detection mechanisms. In this paper, we consider misbehavior detection by enhancing two position verification mechanisms and fusing their results in a generalized framework using subjective logic. We conduct extensive simulations using VEINS to study the impact of traffic density, as well as several types of attackers and fractions of attackers on our mechanisms. The obtained results show the proposed framework can validate position information as effectively as existing approaches in the literature, without tailoring the framework specifically for this use case.

Abstract Privacy strategies and privacy patterns are fundamental concepts of the privacy-by-design engineering approach. While they support a privacy-aware development process for IT systems, the concepts used by malicious, privacy-threatening parties are generally less understood and known. We argue that understanding the “dark side”, namely how personal data is abused, is of equal importance. In this paper, we introduce the concept of privacy dark strategies and privacy dark patterns and present a framework that collects, documents, and analyzes such malicious concepts. In addition, we investigate from a psychological perspective why privacy dark strategies are effective. The resulting framework allows for a better understanding of these dark concepts, fosters awareness, and supports the development of countermeasures. We aim to contribute to an easier detection and successive removal of such approaches from the Internet to the benefit of its users.

Vehicular ad-hoc networks are a promising research area. Besides improving safety, traffic efficiency enhancements are a major expected benefit. In this paper, we present a novel security mechanism for traffic efficiency applications that leverages on velocity-based vehicle clustering and uses HyperLogLog estimators to create bandwidth-efficient integrity proofs. Evaluation results show that our mechanism achieves high protection against plausible attacker models, and that it is more bandwidth efficient than a comparably secure security mechanism that does not employ clustering.

In the context of vehicular networks, certificate management is challenging because of the dynamic topology and privacy requirements. In this paper we propose a technique that combines certificate omission and certificate pre-distribution in order to reduce communication overhead and to minimize cryptographic packet loss. Simulation results show that this technique is useful to improve awareness quality during pseudonym changes.

The standard approach to privacy-friendly authentication in vehicular ad-hoc networks is the use of pseudonym certificates. The level of location privacy users can enjoy under the threat of an attacker depends on the attacker's coverage and strategy as well as on the users' strategy for changing their pseudonym certificates.

Mobile messaging applications, such as WhatsApp, provide a free alternative for mobile texting on smartphones. Mobile messengers typically also share presence information about users to indicate when a user is online. We investigated the privacy implications of such presence updates, using WhatsApp as an example. We conducted a user study with two independent groups (19 participants in total), in which we collected and analyzed their presence information over four weeks of regular WhatsApp use and conducted follow-up interviews. Our results show that presence information alone is sufficient to accurately identify, for example, daily routines, deviations, times of inappropriate mobile messaging, or conversation partners. We discuss resulting privacy implications of presence information and potential solutions to mitigate these issues.

Vehicle to Vehicle (V2V) and Vehicle to Infrastructure (V2I) communication aims to increase safety, efficiency, and comfort of drivers. Vehicles periodically broadcast their current status, such as position, velocity, and other information. Received information is stored in a local knowledge base, often called world model, and used for application decisions. Because of the potential impact, V2V communication is an interesting target for malicious attackers. Message integrity protection using cryptographic signatures only protects against outsider attackers. In addition to signatures, misbehavior detection mechanisms comparable to intrusion detection systems (IDS) are needed to detect insider attackers. Given the complexity and large number of foreseen V2V and V2I applications, misbehavior detection cannot be a one-size-fits-all solution. In this paper, we present a flexible framework that can combine a range of different misbehavior detection mechanisms by modeling their outputs using subjective logic. We demonstrate the feasibility of our framework by using a combination of existing detection mechanisms to increase their misbehavior detection results.

New technologies such as vehicle-to-X (V2X) communication and advanced driver assistance systems (ADAS) are on the rise. They are mainly used to increase road safety as well as traffic efficiency and to provide customers with infotainment features. However, these new technologies also provide the opportunity to combat vehicle related crime which is present in our society. In this paper, we summarize current measures tackling vehicle related crime and propose a security function, namely electronic decal, based on V2X communication to combat vehicle theft. Furthermore, we propose an integration of the electronic decal functionality into the message format based on the latest standardization progress of the European Telecommunications Standards Institute (ETSI).

In vehicular ad-hoc networks (VANETs), a use case for mobile ad-hoc networks (MANETs), the ultimate goal is to let vehicles communicate using wireless message exchange to provide safety, traffic efficiency, and entertainment applications. Especially traffic efficiency applications benefit from wide-area message dissemination, and aggregation of information is an important tool to reduce bandwidth requirements and enable dissemination in large areas. The core idea is to exchange high quality summaries of the current status rather than forwarding all individual messages. Securing aggregation schemes is important, because they may be used for decisions about traffic management, as well as traffic statistics used in political decisions concerning road safety and availability. The most important challenge for security is that aggregation removes redundancy and the option to directly verify signatures on atomic messages. Existing proposals are limited, because they require roads to be segmented into small fixed-size regions, beyond which aggregation cannot be performed. In this paper, we introduce SeDyA, a scheme that allows more dynamic aggregation compared to existing work, while also providing stronger security guarantees. We evaluate SeDyA against existing proposals to show the benefits in terms of information accuracy, bandwidth usage, and resilience against attacks.

In this paper, we investigate how the concept of differential privacy can be applied to Intelligent Transportation Systems (ITS), focusing on protection of Floating Car Data (FCD) stored and processed in central Traffic Data Centers (TDC). We illustrate an integration of differential privacy with privacy policy languages and policy-enforcement frameworks like the PRECIOSA PeRA architecture. Next, we identify differential privacy mechanisms to be integrated within the policy-enforcement framework and provide guidelines for the calibration of parameters to ensure specific privacy guarantees, while still supporting the level of accuracy required for ITS applications. We also discuss the challenges that the support of user-level differential privacy presents and outline a potential solution. As a result, we show that differential privacy could be put to practical use in ITS to enable strong protection of users' personal data.

Automotive navigation systems are becoming ubiquitous as driver assistance systems. Vendors continuously aim to enhance route guidance by adding new features to their systems. However, we found in an analysis of current navigation systems that many share interaction weaknesses, which can damage the system’s credibility. Such issues are most prevalent when selecting a route, deviating from the route intentionally, or when systems react to dynamic traffic warnings. In this work, we analyze the impact on credibility and propose improved interaction mechanisms to enhance perceived credibility of navigation systems. We improve route selection and the integration of dynamic traffic warnings by optimizing route comparability with relevance-based information display. Further, we show how bidirectional communication between driver and device can be enhanced to achieve a better mapping between device behavior and driver intention. We evaluated the proposed mechanisms in a comparative user study and present results that confirm positive effects on perceived credibility.

Ubiquitous computing is characterized by the merger of physical and virtual worlds as physical artifacts gain digital sensing, processing, and communication capabilities. Maintaining an appropriate level of privacy in the face of such complex and often highly dynamic systems is challenging. We argue that context awareness not only enables novel UbiComp applications but can also support dynamic regulation and configuration of privacy mechanisms. We propose a higher level context model that abstracts from low level details and contains only privacy relevant context features. Context changes in our model can trigger reconfiguration of privacy mechanisms or facilitate context-specific privacy recommendations to the user. Based on our model, we analyze potential privacy implications of context changes and discuss how these results could inform actual reconfiguration of privacy mechanisms.

Nano communication is one of the fastest growing emerging research fields. In recent years, much progress has been achieved in developing nano machines supporting our needs in health care and other scenarios. However, experts agree that only the interaction among nano machines allows to address the very complex requirements in the field. Drug delivery and environmental control are only two of the many interesting application domains, which, at the same time, pose many new challenging problems. Very relevant communication concepts have been investigated such as RF radio communication in the terra hertz band or molecular communication based on transmitter molecules. Yet, one question has not been considered so far and that is nano communication security, i.e., will it be possible to protect such systems from manipulation by malicious parties? Our objective is to provide some first insights into the security challenges and to highlight some of the open research challenges in this field. The main observation is that especially for molecular communication existing security and cryptographic solutions might not be applicable. In this context, we coin the term biochemical cryptography that might lead to significant improvements in the field of molecular communication. We also point to relevant problems that have similarities with typical network architectures but also completely new challenges.

As information systems extensively exchange information between participants, privacy concerns may arise from its potential misuse. A Privacy by Design (PbD) approach considers privacy requirements of different stakeholders during the design and the implementation of a system. Currently, a comprehensive approach for privacy requirement engineering, implementation, and verification is largely missing. This paper extends current design methods by additional (formal) steps which take advantage of ontologies. The proposed extensions result in a systematic approach that better protects privacy in future information systems.

This paper analyses how ITS applications may embrace a privacy-by-design approach. We take a holistic viewpoint based on three founding principles: data minimization, enforcement and transparency. The impact on architecture and technology is presented. Three challenges for ITS deployment are further discussed: the intrinsic instability of the resulting engineering process; the impact on future ITS platforms; the difficulty to reach consensus. Finally, tangible steps are identified on how to go forward in terms of further research work as well as building further industry consensus.

Automotive navigation systems, especially portable navigation devices (PNDs), are gaining popularity worldwide. Drivers increasingly rely on these devices to guide them to their destination. Some follow them almost blindly, with devastating consequences if the routing goes wrong. Wrong messages as well as superfluous and unnecessary messages can potentially reduce the credibility of those devices. We performed a comparative study with current PNDs from different vendors and market segments, in order to assess the extent of this problem and how it is related to the interaction between device and driver. In this paper, we report the corresponding results and identify multiple interaction weaknesses that are prevalent throughout all tested device classes.

Privacy is an important requirement in vehicle networks, because vehicles broadcast detailed location information. Also of importance is accountability due to safety critical applications. Conditional pseudonymity, i.e., usage of resolvable pseudonyms, is a common approach to address both. Often, resolvability of pseudonyms is achieved by authorities maintaining pseudonym- identity mappings. However, these mappings are privacy sensitive and require strong protection to prevent abuse or leakage. We present a new approach that does not rely on pseudonym-identity mappings to be stored by any party. Resolution information is directly embedded in pseudonyms and can only be accessed when multiple authorities cooperate. Our privacy-preserving pseudonym issuance protocol ensures that pseudonyms contain valid resolution information but prevents issuing authorities from creating pseudonym-identity mappings.

Direct inter-vehicle communication enables numerous safety applications like intersection collision warning. Beacons - periodic one-hop link-layer broadcast messages containing, e.g., location, heading, and speed - are the basis for many such applications. For security, current work often requires all messages to be signed and to carry a certificate to ensure integrity and authenticity. However, high beacon frequency of 1 - 10 Hz and dense traffic situations lead to significant communication and computational overhead. In this paper, we propose several mechanisms to significantly reduce this overhead while maintaining a comparable level of security. The general idea is to omit signatures, certificates, or certificate verification in situations where they are not necessarily required. This creates a security-performance trade-off that we analyze in detail. The results show that significant savings can be achieved with only small impact on security.

Abstract Inter‐vehicle communication is regarded as one of the major applications of mobile ad hoc networks (MANETs). Compared to MANETs or wireless sensor networks (WSNs), these so‐called vehicular ad hoc networks (VANETs) have unique requirements on network protocols. The requirements result mainly from node mobility and the demands of position‐dependent applications. On the routing layer, those requirements are well met by geographic routing protocols. Functional research on geographic routing has already reached a considerable level, whereas security aspects have only been recently taken into account. Position information dissemination has been identified as being crucial for geographic routing since forged position information has severe impact regarding both performance and security. In this work, we first summarize the problems that arise from falsified position data. We then propose a framework that contains different detection mechanisms in order to mitigate or lessen these problems. Our developed mechanisms are capable of recognizing nodes cheating about their position in beacons (periodic position dissemination in most single‐path geographic routing protocols, e.g., GPSR). Unlike other proposals described in the literature, our detection system does not rely on additional hardware or special nodes, which would contradict the ad hoc approach. Instead, we use a number of different independent sensors to quickly give an estimation of the trustworthiness of other nodes' position claims. The different sensors run either autonomously on every single node, or they require cooperation between neighboring nodes. The simulation evaluation proves that the combination of autonomous and cooperative position verification mechanisms successfully discloses most nodes disseminating false position information, and thereby widely prevents attacks using position cheating. Copyright © 2008 John Wiley & Sons, Ltd.

Network communication using unprotected air as a medium leads to unique challenges ensuring confidentiality, integrity and availability. While newer amendments of IEEE 802.11 provide acceptable confidentiality and integrity, availability is still questionable despite broad usage of Wi-Fi technologies for tasks where availability is critical. We will present new security weaknesses that we have identified in the 802.11 standard and especially the 802.11h amendment. Our results are underlined by an extensive analysis of attacks addressing the quiet information element and channel switch announcement in management frames. For some stations a complete DoS effect can be achieved with a single packet for more than one minute. This shows that the newly identified attacks are more efficient than earlier approaches like a deauthentication attack. Tests were performed with a large variety of network interface cards, mobile devices, and operating systems.

Vehicle-to-vehicle/vehicle-to-infrastructure (V2X) communication systems are envisioned to greatly improve road safety, traffic efficiency, and driver convenience. However, many V2X applications rely on continuous and detailed location information, which raises location privacy concerns. A multitude of privacy-protection mechanisms have been proposed in recent years. However, few efforts have been made to develop privacy metrics, which can provide a rigorous way to assess the privacy risk, evaluate the effectiveness of a given mechanism, and exploit the full possibilities of protection methods in V2X systems. Therefore, in this paper we present a trip-based location privacy metric for measuring user location privacy in V2X systems. The most distinguishable aspect of the metric is to take into account the accumulated information, which is the privacy-related information acquired by an adversary for an extended period of time, e.g., days or weeks. We develop methods to model and process the accumulated information, and reflect the impact on the privacy level in the metric. We further prove the viability and correctness of the metric by various case studies. Our simulations find out that under certain conditions, accumulated information can significantly decrease the level of user location privacy. The metric and our findings in this paper give some valuable insights into location privacy, which can contribute to the development of effective privacy-protection mechanisms for the users of V2X systems.

Efficient information dissemination is one of the challenging tasks in most ad-hoc network application domains, be it in wireless sensor networks, mobile ad-hoc networks, or vehicular ad-hoc networks. It is obvious, that flooding has a high communication overhead, leading to channel congestion and packet collisions. Therefore, more efficient dissemination mechanisms were investigated and proposed by the research community. One class of such algorithms is gossiping, where each node forwards a message with a certain probability. The main challenge in gossiping is the proper determination of the forwarding probability, i.e., on the one hand this value has to be chosen high enough to assure a high delivery ratio, on the other hand it has to be as low as possible to reduce communication overhead. At the same time this probability has to be adapted to dynamic network conditions, like changing node density. In this work an advanced scheme for adaptive gossiping is proposed, capable to adjust the dissemination probability dynamically and in a distributed manner. The gossiping probability is determined at a node for every message that has to be forwarded based on two hop neighborhood information. That way, the proposed protocol is capable of working in arbitrary network topologies and densities, enabling more efficient data dissemination compared to existing approaches.

Most techniques for personal data synchronization only allow one-to-one or star network topologies. Enkel DS presented in this paper extends OMA SyncML DS, an open industry standard for optimistic data synchronization. Enkel DS allows many-to-many topologies including cycles enabling a human user to synchronize each personal device with another.

Mechanisms for information dissemination are essential for many applications in vehicular ad-hoc networks (VANETs). Currently, simple flooding is often supposed to broadcast information within a geographic region, as for example in many geocast protocols. However, simple flooding has several drawbacks: every node rebroadcasting a message leads to redundancy, contention, and collision, to which is referred as the broadcast storm problem. Hence, in order to fulfill the applications' requirements, more efficient solutions are necessary. In this work we introduce three extensions to an existing probabilistic broadcast protocol to be capable to achieve high reception rates with a wide range of vehicle densities, at the same time lowering the communication complexity. The efficiency of the protocol is shown by simulations in an intersection and highway scenario and its superiority over flooding and the basic protocol is presented.

Pseudonyms are pseudonymous certificates, which are regarded as a silver bullet to meet the security and privacy requirements of vehicular communications. Most works so far assume that pseudonyms are readily available when they are needed. In this paper, we identify and compare two strategies to refill pseudonyms. We then propose the pseudonym-on-demand scheme, which is an implementation of one of the strategies. We show that our approach supports the functionalities of pseudonyms in terms of secure and privacy-preserved vehicular communications. Furthermore, our proposed scheme serves as a platform, into which many features to enhance security and privacy can be integrated.

This paper has shown that U2VAS fulfills all requirements of a truly modular and flexible communication stack for VANETs. Beyond the framework, the current implementation already contains several forms of communication, positioning and security mechanisms. We invite interested developers to join our effort and contribute to the further development of U2VAS.

Abstract Information dissemination rather than traditional routing is useful for many application domains in mobile ad hoc networks. Context‐adaptive information dissemination is a special variant, which was originally designed for vehicular ad hoc networks (VANETs), but could also be used in other domains, for example, disaster management. In this work, we address the security of this dissemination scheme. The attack analysis shows weaknesses but also how the adaption to context already limits the impact of many attacks. We present and evaluate a sensor‐based protection system helping to reduce the margin for attacks to a level of local disturbance, while the overall dissemination is not affected significantly any more. Copyright © 2008 John Wiley & Sons, Ltd.

Unlike in conventional networks, node positions in mobile ad hoc networks (MANETs) usually change over time. As a side effect of managing routes, routing protocols to some extent also disseminate neighborship and topology information in the network, thereby disclosing at least some information on a node's own position to other nodes. Due to the wireless nature of ad hoc networks, this information can become available even to third parties which are not participating in the network. Using this information, location profiling may become possible, where attackers gather information on node positions or mobility patterns. This information may then be used for anything ranging from targeted advertisement to criminal activities. Therefore, location privacy is an important issue in ad hoc networks. In this paper, we analyze to what extent an attacker can track the precise location of a node, assuming a powerful attacker model where an attacker knows all neighbor relationships plus information on node distances. We present a new approach which uses these information and uses geometric constraints and heuristics to find node positions efficiently. The quality of our results is discussed and compared to other approaches. Based on the localization precision that such an "omniscient" attacker can reach, we will be able to evaluate the quality of future, more realistic attack models

The privacy aspect is often neglected in many electronic systems. With the emergence of ubiquitous systems, privacy will become an even more important aspect than it has been in the past. Location privacy - the information where exactly a node is currently located - is one aspect. This paper classifies several kinds of attacks on location privacy. It examines the results of these attacks on a scheme utilising changing identities to preserve the users’ identities. Simulation results show the influence of the number of nodes and the backoff time between transmissions on the nodes’ location privacy.

Recently many prominent web sites face so called Distributed Denial of Service Attacks (DDoS). While former security threats could be faced by a tight security policy and active measures like using rewalls, vendor patches etc. these DDoS are new in suchway that there is no completely satisfying protection yet. In this paper we categorize different forms of attacks and give an overview over the most common DDoS tools. Furthermore we present a solution based on Class Based Routing mechanisms in the Linux kernel that will prevent the most severe impacts of DDoS on clusters of web servers with a prepended load balancing server. The goal is to keep the web servers under attack responding to the normal client requests. Some performance tests and a comparison to other approaches conclude our paper.