API-level fuzzing has become increasingly important for discovering subtle bugs in modern software, yet generating effective fuzzing harnesses remains a complex and error-prone task. Existing approaches often rely on limited consumer code or shallow program analysis, which fail to capture deep API semantics and interdependencies, resulting in poor coverage and high false positive rates. Recent methods incorporating Large Language Models (LLMs) have improved harness generation by leveraging pretrained knowledge, but they still struggle with hallucinations and lack domain-specific understanding.

Decentralized Identity (DID) enhances authentication and privacy by empowering individuals to control their own digital identities, which has gained traction globally. To our knowledge, this paper presents the first end-to-end verification effort (from design to implementation) of a real-world Decentralized Identity (DID) protocol following the IIFAA DID standard, which has been deployed within the widely used super app Alipay and issued millions of DIDs in practice. We integrate formal verification into the development lifecycle of such industrial security protocol to systematically enhance its reliability from two levels: (1) At the design level, we utilized state-of-the-art protocol design verifier Tamarin to formally model the IIFAA DID standard under a realistic threat model tailored for super apps. We then formulated and performed automated verification of desired security properties using Tamarin. We identified several design flaws that could lead to a security breach. These issues were reported to the design team and have been addressed in the updated design. (2) At the implementation level, we first extract the desired specification derived from the verified symbolic model of protocol design in the form of a set of intermediate I/O specifications. Subsequently, we translate the I/O specifications into a set of functional specifications at the implementation level, which can then be verified by the automated tool VeriFast. We identified several inconsistencies between the implementation and the verified design which are fixed by the development team and led to verified implementation faithfully obeying the verified design, together offering an end-to-end verified secure DID protocol in Alipay super app. Our work showcases how an industrial security protocol development team can design and implement a practical verified secure Decentralized Identity (DID) protocol with the help of end-to-end formal verification.

Modern memory management systems suffer from poor performance and subtle concurrency bugs, slowing down applications while introducing security vulnerabilities. We observe that both issues stem from the conventional design of memory management systems with two levels of abstraction: a software-level abstraction (e.g., VMA trees in Linux) and a hardware-level abstraction (typically, page tables). This design increases portability but requires correctly and efficiently synchronizing two drastically different and complex data structures, which is generally challenging.

Abstract Rust has gained popularity as a safer alternative to C/C++ for low-level programming due to its memory-safety features and minimal runtime overhead. However, the use of the “unsafe” keyword allows developers to bypass safety guarantees, posing memory-safety risks. Bounded Model Checking (BMC) is commonly used to detect memory-safety problems, but it has limitations for large-scale programs, as it can only detect bugs within a bounded number of executions. In this paper, we introduce UnsafeCop that utilizes and enhances BMC for analyzing memory safety in real-world unsafe Rust code. Our methodology incorporates harness design, loop bound inference, and both loop and function stubbing for comprehensive analysis. We optimize verification efficiency through a strategic function verification order, leveraging both types of stubbing. We conducted a case study on TECC (Trusted-Environment-based Cryptographic Computing), a proprietary framework consisting of 30,174 lines of Rust code, including 3,019 lines of unsafe Rust code, developed by Ant Group. Experimental results demonstrate that UnsafeCop effectively detects and verifies dozens of memory safety issues, reducing verification time by 73.71% compared to the traditional non-stubbing approach, highlighting its practical effectiveness.

Fuzzing is a practical approach to discovering flaws in the design and implementation of Wi-Fi protocols. However, existing Wi-Fi fuzzers are either vendor- or ecosystem-specific. Besides, they only cover a subset of 802.11 protocols and frame types. The growing complexity of Wi-Fi protocols, which have evolved to Wi-Fi6 and WPA3 already, calls for a free and comprehensive fuzzing tool for modern Wi-Fi devices. In this paper, we present such a fuzzing tool named Owfuzz. Unlike previous works using mostly firmware emulation fuzzing or driver fuzzing, Owfuzz takes the over-the-air fuzzing approach. It can perform fuzzing tests on arbitrary Wi-Fi devices from any vendor and can fuzz all three types of Wi-Fi frames (management, control, and data) defined in all versions of the 802.11 standards. It can be easily extended to support interactive testing of various protocol models. With Owfuzz, we have tested the products of mainstream Wi-Fi chip and device vendors, leading to the discovery of 23 flaws. We have reported most of these flaws to the related vendors with 8 CVE IDs assigned. Moreover, we have open-sourced Owfuzz to the community to facilitate future research.

Multicell collaboration is considered for power allocation in OFDMA downlink to mitigate the intercell interference. We propose a coordination approach to maximize the sum utility of a cluster of co-channel users by properly configuring user transmit power in local cells. In particular, we employ the well-known α-PF metric as the utility function to accounts for the fairness between users in different cells. It is arguably shown that optimization of fairness-oriented utilities in the multicell scenario through intercell coordination effectively mitigates the interference and improves signal transmission. Our work sheds new lights on intercell interference coordination in multicarrier downlink, and leads to a distributed framework for multicell resource coordination.

Carrier aggregation (CA) is one of the promising techniques for the further advancements of the third-generation (3G) long-term evolution (LTE) system, referred to as LTE-Advanced. When CA is applied, a well-designed carrier scheduling (CS) scheme is essential to the LTE-Advanced system. Joint user scheduling (JUS) and separated random user scheduling (SRUS) are two straightforward CS schemes. JUS is optimal in performance but with very high complexity, whereas SRUS is contrary. Consequently, the authors propose a novel CS scheme, termed as ‘separated burst-level scheduling’ (SBLS). In SBLS, the connected component carrier (CC) of one user can be changed in burst level, whereas in SRUS, it is fixed. Meanwhile, SBLS limits the users to receive from only one of the CCs simultaneously, which is the same as that in SRUS. In this way, SBLS is expected to achieve higher resource utilisation than SRUS but with acceptable complexity increase. There are two factors that are important to the performance of SBLS, namely the dispatching granularity and the dispatching policy. The authors' analysis is verified by system-level simulations. The simulation results also show that the resultant performance gain of SBLS over SRUS is notable and increasing dispatching granularity will quickly deteriorate the performance of SBLS.

This paper considers subcarrier allocation for the multihop orthogonal frequency division multiple-access (OFDMA) broadcast networks consisting of one source, multiple destinations, and one amplify-and-forward (AF) relay. In this paper, proportional fair (PF) based subcarrier allocation is discussed to get a tradeoff between the system transmission rate and fairness. First, the problem is formulated as an optimization problem with prohibitive complexity. Second, by analyzing the optimal solution for the subcarrier allocation problem without PF constraint, two suboptimal schemes are proposed. The simulation results indicate that with the same fairness performance, the proposed schemes achieve considerable capacity gain compared with the conventional PF scheduling method which is extended simply from the single-hop system.

In this paper, we consider the optimal resource allocation problem for dual-hop systems with a source-destination pair and multiple decode-and-forward (DF) relays. Orthogonal frequency division multiplexing (OFDM) is adopted in both hops. To maximize the system capacity, we formulate a mixed binary integer programming problem to optimally allocate the subchannels and transmit power for both the source and the relay nodes. Because of the prohibitive complexity, a greedy heuristic algorithm is proposed to decompose the original problem into solvable subproblems. Simulation results demonstrate that the proposed algorithm has a near-optimal performance.

This paper investigates the spatial resource allocation algorithms for the uplink Virtual-MIMO (Multiple Input and Multiple Output) systems, where K client users (each with one or multiple antennas) are served by one multiple-antenna BS (Base Station). To fully exploit the spatial multi-user diversity gain, the finding of the optimal spatial co-channel users is discussed, which is formulated as a mixed binary integer programming problem. Based on the property of hermitian matrix, simulated annealing is used to recursively find the suboptimal spatial co-channel user group. By simulation results, our proposed strategy has almost the same system throughput performance as the optimal greedy algorithm, and can maintain lower computation complexity.

A two-hop relaying system where a source communicates with its destination through multiple relay nodes is studied for capacity maximization. Amplify-and-forward (AF) relaying is adopted for its simplicity. Taking the independent channel transfer function of different subcarriers and links into consideration, we formulate a resource allocation optimization problem for joint subcarrier assignment, subcarrier matching and power allocation of the two-hop transmission. A heuristic suboptimal algorithm which decomposes the joint problem is proposed. First, equal power allocation is assumed in a partial- update manner to help assigning subcarriers to each relay for matching; then optimal power allocation is achieved by joint waterfilling of source and relays under separate power constraints to further increase system capacity. Numerical results show that the proposed algorithm has a near-optimal performance.

Software radio is the promising technology that allows the different wireless standards easily be converged. Using general purpose processors and open-source operating systems instead of dedicated hardware and software to build the wireless communication system is very flexible and low-cost. In this article,the open-source platform based on common PCs is described, which allows rapid development and verification of software radio systems. We also discuss the efficient distributed strategies essential for this platform. Finally, the demonstration system of TD-SCDMA is developed and the conclusion given