Unmanned Aerial Vehicle (UAV) clusters are widely used in spectrum reconnaissance, where spectrum samples are transmitted back to the sink through flying ad hoc network (FANET). High sampling frequencies are required, but result in a large amount of data not being transmitted over the wireless network, affecting throughput and reliability of the network. The problem boils down to what a good sampling frequency is and how to find it. There is an unknown dynamic sampling frequency threshold, beyond which high packet loss occurs. Prior work focused on achieving higher frequencies through FANET optimization but neglected methods to find this threshold and achieve a maximum value. We propose an adaptive protocol based on binary search. With limited bandwidth and consistent sampling frequency, the protocol dynamically adjusts sampling frequencies in a phased manner at the application layer to maximize the sampling frequency that the network can handle. In addition to spectrum reconnaissance, this protocol can be extended to other applications with consistent sampling frequencies. We have constructed an application based on the EXata simulation platform to analyze the performance of the protocol in delay, stability, reliability, and search times. Simulation results show the protocol improves the efficiency and survivability of spectrum reconnaissance.

We consider flying ad hoc networks (FANETs) operating in frequency-sweeping jamming environment, where jamming significantly impairs the performance of routing protocols, leading to unstable network communications and data loss. Currently, jamming is defended at physical and link layer by military radio stations, which focuses on restoring communication of a single link. Existing routing protocols fail to utilize valuable information from these radio stations effectively to restore a multi-hop path. To address this issue, we propose a novel routing protocol optimization method that combines spectrum awareness techniques to further mitigate the adverse effects of jammers on overall network performance. The proposed method utilizes the obtained jammer information and bit error rate to modify various parameters in the routing protocol, enabling it to adapt to jamming scenarios. We implement the optimized protocol on the EXata simulation platform. The simulation results show that, compared with the reference protocols, the proposed protocol can increase the throughput by up to 12% and improve the packet delivery ratio by up to 14% in the presence of frequency-sweeping jammers.

Nowadays, unmanned aerial vehicle (UAV) clusters are widely used in military and civil scenarios to perform spectrum reconnaissance. In this task, a high sampling frequency is desirable, but it results in a large volume of data that may not be transmitted through the wireless network. The problem boils down to what a good sampling frequency is and how to find it. There is an unknown dynamic sampling frequency threshold exceeding which leads to high packet loss. To find this threshold and achieve the maximum sampling frequency, we propose a distributed protocol based on binary search to find the best sampling frequency, taking consideration of performance metrics like latency, stability, reliability, and search times. Under the premise of limited bandwidth and consistent spectrum sampling frequency of UAVs, our protocol can dynamically adjust the spectrum sampling frequency at the application layer. We have built a network application on the EXata simulation platform to analyze the performance of the proposed protocol. The simulation results show that the protocol improves the efficiency and survivability of spectrum reconnaissance.

Increasingly, many security and privacy sensitive applications (apps for short) are running in the mobile platforms. However, as the mobile operating systems are becoming increasingly sophisticated, they are vulnerable to various attacks. In addressing the need of running high assurance mobile apps in a secure environment even though the operating systems are untrusted, this paper presents VTRUST, a new mobile app trusted execution environment, which offloads the general execution and storage of a mobile app to a trusted remote server (e.g., a VM running in a cloud) and secures the I/O between the server and the mobile device with the aid of a trusted hypervisor on the mobile device. Specifically, VTRUST establishes an encrypted I/O channel between the local hypervisor and the remote server, such that any sensitive data flowing through the mobile OS, which is hosted by the hypervisor, is encrypted from the perspective of the local mobile OS. To enhance the performance of VTRUST, we have also designed multiple optimizations, such as output data compression and selective sensor data transmission. We have implemented VTRUST and our evaluation shows that it has limited impact on both user experience and the app performance.

Smartphone lock screens are implemented to reduce the risk of data loss or compromise given the fact that increasing amount of person data are accessible on smartphones nowadays. Unfortunately, many smartphone users abandon lock screens due to the inconvenience of unlocking their phones many times a day. With the wide adoption of wearables, token-based approaches have gained popularity in simplifying unlocking and retaining security at the same time. To this end, we propose to take advantage of the smartwatch for easy smartphone unlocking. In this paper, we have designed WearLock, a system that uses acoustic tones as tokens to automate the unlocking securely. We build a sub-channel selection and an adaptive modulation in the acoustic modem to maximize unlocking success rate against ambient noise only when those two devices are nearby. We leverage the motion sensor on the smartwatch to reduce the unlock frequency. We offload smartwatch tasks to the smartphone to speed up computation and save energy. We have implemented the WearLock prototype and conducted extensive evaluations. Results achieved a low average bit error rate (BER) as 8% in various experiments. Compared to traditional manual personal identification numbers (PINs) entry, WearLock achieves at least 18% unlock speedup without any manual effort.

While the Internet of Things (IoT) is making our lives much easier, managing the IoT becomes a big issue due to the huge number of connections, and the lack of protections for devices. Recent work shows that software-defined networking (SDN) has a great capability in automatically and dynamically managing network flows. Besides, switches in SDNs are usually powerful machines, which can be used as fog nodes simultaneously. Therefore, SDN seems a good choice for IoT-Fog networks. However, before deploying to IoT-Fog networks, the security of the OpenFlow channel between the controller and its switches need to be addressed. Since all the controller commands are sent through this channel, once compromised, the network will be completely controlled by an attacker. This is a disaster for both the network service providers and their customers. Previous works on SDN security either protect controllers themselves or make a strong assumption that the OpenFlow channel is already secured. Using TLS to encrypt the channel is not a “silver-bullet” solution due to the known TLS vulnerabilities. In this paper, we specifically investigate the potential threats of man-in-the-middle attacks on the OpenFlow control channel. We first introduce a feasible attack model in an IoT-Fog architecture, and then we implement attack demonstrations to show the severe consequences of such attacks. Additionally, we propose a lightweight countermeasure using Bloom filters. We implement a prototype for this method to monitor stealthy packet modifications. The result of our evaluation shows that our Bloom filter monitoring system is efficient and consumes few resources.

The record-and-replay approach for software testing is important and valuable for developers in designing mobile applications. However, the existing solutions for recording and replaying Android applications are far from perfect. When considering the richness of mobile phones' input capabilities including touch screen, sensors, GPS, etc., existing approaches either fall short of covering all these different input types, or require elevated privileges that are not easily attained and can be dangerous. In this paper, we present a novel system, called MobiPlay, which aims to improve record-and-replay testing. By collaborating between a mobile phone and a server, we are the first to capture all possible inputs by doing so at the application layer, instead of at the Android framework layer or the Linux kernel layer, which would be infeasible without a server. MobiPlay runs the to-be-tested application on the server under exactly the same environment as the mobile phone, and displays the GUI of the application in real time on a thin client application installed on the mobile phone. From the perspective of the mobile phone user, the application appears to be local. We have implemented our system and evaluated it with tens of popular mobile applications showing that MobiPlay is efficient, flexible, and comprehensive. It can record all input data, including all sensor data, all touchscreen gestures, and GPS. It is able to record and replay on both the mobile phone and the server. Furthermore, it is suitable for both white-box and black-box testing.

We have seen an emerging trend towards wearables nowadays. In this paper, we focus on smart glasses, whose current interfaces are difficult to use, error-prone, and provide no or insecure user authentication. We thus present GlassGesture, a system that improves Google Glass through a gesture-based user interface, which provides efficient gesture recognition and robust authentication. First, our gesture recognition enables the use of simple head gestures as input. It is accurate in various wearer activities regardless of noise. Particularly, we improve the recognition efficiency significantly by employing a novel similarity search scheme. Second, our gesture-based authentication can identify owner through features extracted from head movements. We improve the authentication performance by proposing new features based on peak analyses, and employing an ensemble method. Last, we implement GlassGesture and present extensive evaluations. GlassGesture achieves a gesture recognition accuracy near 96%. For authentication, GlassGesture can accept authorized users in near 92% of trials, and reject attackers in near 99% of trials. We also show that in 100 trials imitators cannot successfully masquerade as the authorized user even once.

Cognitive radio plays an important role in improving spectrum utilization in wireless services. In the cognitive radio paradigm, secondary users (SUs) are allowed to utilize licensed spectrum opportunistically without interfering with primary users (PUs). To motivate PU to share licensed spectrum with SU, it is reasonable for SU to pay PU a fee whenever the former is utilizing the latter's licensed spectrum. SU's detailed usage information, such as when and how long the licensed spectrum is utilized, is needed for PU to calculate payment. Providing usage information to PU, however, may compromise SU's privacy. To solve this dilemma, we are the first to propose a novel privacy-preserving mechanism for cognitive radio transactions through commitment scheme and zero-knowledge proof. This mechanism, on one hand, only allows PU to know the total payment to SU for a billing period, plus a little portion of SU's usage information. On the other hand, it guarantees PU that the payment is correctly calculated. We have implemented our mechanism and evaluated its performance.

The electric power grid is a crucial infrastructure in our society and is always a target of malicious users and attackers. In this paper, we first introduce the concept of unidentifiable attack, in which the control center cannot identify the attack even though it detects its presence. Thus, the control center cannot obtain deterministic state estimates, since there may have several feasible cases and the control center cannot simply favor one over the others. Given an unidentifiable attack, we present algorithms to enumerate all feasible cases, and propose an optimization strategy from the perspective of the control center to deal with an unidentifiable attack. Furthermore, we propose a heuristic algorithm from the view of an attacker to find good attack regions such that the number of meters required to compromise is as few as possible. We also formulate the problem that how to distinguish all feasible cases if the control center has some limited resources to verify some meters, and solve it with standard algorithms. Finally, we briefly evaluate and validate our enumerating algorithms and optimization strategy.

Accurate spectrum sensing is important in cognitive radio networks. False sensing results in either waste of spectrum or harmful interference to primary users. To improve accuracy, cooperative spectrum sensing, in which a set of secondary users cooperatively sense the presence of the primary user, has emerged. This technique, however, opens a window for malicious users and attackers, who may remotely or physically capture the sensors and manipulate the sensing reports. In this paper, we consider the attack model whereby the attacker injects self-consistent false data simultaneously, and propose a modified COI (combinatorial optimization identification) algorithm to defend against such attacks. We also provide a theorem that detection uncertainty may exist in cooperative spectrum sensing. We intensively evaluate our algorithm with simulations, and the results show that our algorithm is a good technique to complement an existing algorithm, called IRIS.

Recent studies have revealed security vulnerabilities in implantable medical devices (IMDs). Security design for IMDs is complicated by the requirement that IMDs remain operable in an emergency when appropriate security credentials may be unavailable. In this paper, we introduce IMDGuard, a comprehensive security scheme for heart-related IMDs to fulfill this requirement. IMDGuard incorporates two techniques tailored to provide desirable protections for IMDs. One is an ECG based key establishment without prior shared secrets, and the other is an access control mechanism resilient to adversary spoofing attacks. The security and performance of IMDGuard are evaluated on our prototype implementation.