Intel Software Guard eXtension (SGX) is the cornerstone of Confidential Computing, enabling runtime code and data integrity and confidentiality via enclaves. Unfortunately, memory-unsafe and type-unsafe programming languages, such as C/C++, are commonly used to develop enclave implementations. As a result, a memory corruption or a data race within enclaves could lead to different attacks against the enclaves, such as Return-Of-Programming (ROP) and data leakage, breaking the hardware security guarantee provided by SGX. To automatically identify these issues in existing enclave implementations, in this paper, we propose FuzzSGX, an input and program mutation-based fuzzer for Intel SGX enclave implementations. FuzzSGX provides an enclave fuzzing runtime, FuzzSGX Runtime, a drop-in library for Intel SGX SDK, enabling code coverage and sanitization within enclaves. To explore the host app-enclave boundary, FuzzSGX conducts static analysis and symbolic execution on existing host apps and enclave implementations to generate promising fuzzing programs, fuzzing both ECALLs and OCALLs. We evaluate FuzzSGX using 30 popular SGX applications and enclave implementations and find 93 bugs among these SGX projects, including data races, null pointer dereferences, out-of-bound accesses, division-by-zero, etc. FuzzSGX achieves 3.2x higher code coverage and finds 48.2% more bugs by directly targeting the host appenclave boundary by using program mutations, compared to state-of-the-art fuzzers.

Universal Serial Bus (USB) is the de facto protocol supported by peripherals and mobile devices, such as USB thumb drives and smart phones. For many devices, USB Type-C ports are the primary interface for charging, file transfer, audio, video, etc. Accordingly, attackers have exploited different vulnerabilities within USB stacks, compromising host machines via BadUSB attacks or jailbreaking iPhones from USB connections. While there exist fuzzing frameworks dedicated to USB vulnerability discovery, all of them focus on USB host stacks and ignore USB gadget stacks, which enable all the features within modern peripherals and smart devices. In this paper, we propose FuzzUSB, the first fuzzing framework for the USB gadget stack within commodity OS kernels, leveraging static analysis, symbolic execution, and stateful fuzzing. FuzzUSB combines static analysis and symbolic execution to extract internal state machines from USB gadget drivers, and uses them to achieve state-guided fuzzing through multi-channel inputs. We have implemented FuzzUSB upon the syzkaller kernel fuzzer and applied it to the most recent mainline Linux, Android, and FreeBSD kernels. As a result, we have found 34 previously unknown bugs within the Linux and Android kernels, and opened 8 CVEs. Furthermore, compared to the baseline, FuzzUSB has also demonstrated different improvements, including $ 3\times$ higher code coverage, $ 50\times$ improved bug-finding efficiency for Linux USB gadget stacks, $ 2\times$ higher code coverage for FreeBSD USB gadget stacks, and reproducing known bugs that could not be detected by the baseline fuzzers. We believe FuzzUSB provides developers a powerful tool to thwart USB-related vulnerabilities within modern devices and complete the current USB fuzzing scope.

In this paper, we suggest a vehicle speeding enforcement system based on V2X (Vehicle-to-Everything). Existing camera-based enforcement, which can measure in one direction, has a narrow measurement range and it is difficult to analyze vehicle speed in real time. To overcome these shortcomings, we measure vehicle speed in real time by extracting speed data from the GPS (Global Positioning System) and the IVN (In-Vehicle Network). Also, we aim to expand the scope of enforcement by using a V2X-based system. Under the V2X-based system, we show a wider enforcement range and the instantaneous/average speed of the vehicle in real time. We also analyze the difference in performance between DSRC (Dedicated Short Range Communication) and C-V2X (Cellular-V2X) in the proposed V2X-based system.

Deep learning systems on the cloud are increasingly targeted by attacks that attempt to steal sensitive data. Intel SGX has been proven effective to protect the confidentiality and integrity of such data during computation. However, state-of-the-art SGX systems still suffer from substantial performance overhead induced by the limited physical memory of SGX. This limitation significantly undermines the usability of deep learning systems due to their memory-intensive characteristics.

This paper presents an implementation of a CMOS image sensor with a 65 nm CMOS process. The pixel array consists of 13 Mp with 1.12 μm pixel pitch. The fabricated sensor uses 10-bit column-parallel single slope analog-to-digital converters (ADC) based on a low-power readout architecture. Furthermore, a low-power built-in self-test (BIST) is proposed to avoid test over-kills. The proposed image sensor achieves a frame rate of 30–120 frames/s, a temporal random noise of 2 e−rms, a dynamic range of 65.2dB, peak integral non-linearity of 0.18 % and peak differential non-linearity of 0.26 least-significant bits. It consumes only 99.7mW at 30 frames/s.

A data race in a kernel is an important class of bugs, critically impacting the reliability and security of the associated system. As a result of a race, the kernel may become unresponsive. Even worse, an attacker may launch a privilege escalation attack to acquire root privileges. In this paper, we propose Razzer, a tool to find race bugs in kernels. The core of Razzer is in guiding fuzz testing towards potential data race spots in the kernel. Razzer employs two techniques to find races efficiently: a static analysis and a deterministic thread interleaving technique. Using a static analysis, Razzer identifies over-approximated potential data race spots, guiding the fuzzer to search for data races in the kernel more efficiently. Using the deterministic thread interleaving technique implemented at the hypervisor, Razzer tames the non-deterministic behavior of the kernel such that it can deterministically trigger a race. We implemented a prototype of Razzer and ran the latest Linux kernel (from v4.16-rc3 to v4.18-rc3) using Razzer. As a result, Razzer discovered 30 new races in the kernel, with 16 subsequently confirmed and accordingly patched by kernel developers after they were reported.

Web-based malware equipped with stealthy cloaking and obfuscation techniques is becoming more sophisticated nowadays. In this paper, we propose J-FORCE, a crash-free forced JavaScript execution engine to systematically explore possible execution paths and reveal malicious behaviors in such malware. In particular, J-FORCE records branch outcomes and mutates them for further explorations. J-FORCE inspects function parameter values that may reveal malicious intentions and expose suspicious DOM injections. We addressed a number of technical challenges encountered. For instance, we keep track of missing objects and DOM elements, and create them on demand. To verify the efficacy of our techniques, we apply J-FORCE to detect Exploit Kit (EK) attacks and malicious Chrome extensions. We observe that J-FORCE is more effective compared to the existing tools.

Causality inference, such as dynamic taint anslysis, has many applications (e.g., information leak detection). It determines whether an event e is causally dependent on a preceding event c during execution. We develop a new causality inference engine LDX. Given an execution, it spawns a slave execution, in which it mutates c and observes whether any change is induced at e. To preclude non-determinism, LDX couples the executions by sharing syscall outcomes. To handle path differences induced by the perturbation, we develop a novel on-the-fly execution alignment scheme that maintains a counter to reflect the progress of execution. The scheme relies on program analysis and compiler transformation. LDX can effectively detect information leak and security attacks with an average overhead of 6.08% while running the master and the slave concurrently on separate CPUs, much lower than existing systems that require instruction level monitoring. Furthermore, it has much better accuracy in causality inference.

While conventional cognitive radio (CR) system is striving at providing best possible protections for the usage of primary users (PU), little attention has been given to ensure the quality of service (QoS) of applications of secondary users (SU). When loading real-time applications over such a CR system, we have found that existing spectrum sensing schemes create a major hurdle for real-time traffic delivery of SU. For example, energy detection based sensing, a widely used technique, requires possibly more than 100 ms to detect a PU with weak signals. The delay is intolerable for real-time applications with stringent QoS requirements, such as voice over internet protocol (VoIP) or live video chat. This delay, along with other delays caused by backup channel searching, channel switching, and possible buffer overflow due to the insertion of sensing periods, makes supporting real-time applications over CR system very difficult if not impossible. In this paper, we present the design and implementation of a sensing-based CR system - RECOG, which is able to support realtime communications among SUs. We first redesign the conventional sensing scheme. Without increasing the complexity or trading off the detection performance, we break down a long sensing period into a series of shorter blocks, turning a disruptive long delay into negligible short delays. To enhance the sensing capability as well as better protect the QoS of SU traffic, we also incorporate an on-demand sensing scheme based on MAC layer information. In addition, to ensure a fast and reliable switching when PU returns, we integrate an efficient backup channel scanning and searching component in our system. Finally, to overcome a potential buffer overflow, we propose a CR-aware QoS manager. Our extensive experimental evaluations validate that RECOG can not only support realtime traffic among SUs with high quality, but also improve protections for PUs.

This paper investigates the issue of how to balance the tradeoff between sensing performance and sensing costs/rewards for cooperative sensing in a multichannel cognitive radio system. Two cases of practical interest are studied. In the first case, the number of available sensors is assumed to be sufficient for detecting available frequency channels. For this case, we study the problem of selecting appropriate sensors to minimize the cost of detecting all the available channels subject to sensing performance constraints. The problem can be solved by using a branch-and-bound algorithm. In the second case, the number of available sensors is assumed to be insufficient for detecting all the available channels. For this case, we study the problem of selecting appropriate channels to maximize the sensing rewards subject to sensing performance constraints. Since the computational complexity of solving this problem optimally is fairly high, we propose a greedy algorithm as a low complexity solution to the problem. We further validate the effectiveness of the proposed algorithm via Monte-Carlo simulations.

We consider efficient techniques for delivering audio-video telephony/conferencing service (AVS) traffic over WiMAX networks. Issues that need to be considered in error-prone and variable delay wireless networks specifically for real-time AVS traffic include delay, jitter and the possible lack of synchronization between audio and video traffic. First, we consider two different schemes for WiMAX connection management that allocate the same connection ID (CID) or two different CIDs for audio and video connections, which we refer to as integrated-CID scheme and separated-CID scheme, respectively. The integrated-CID scheme is amenable to connection management with reduced overheads, but causes cell-edge users to suffer longer voice delay variance. Second, we consider two different audio codecs, with low and high source rates. Generally, a codec with a high source rate gives more satisfaction to users, but we show that this does not hold for cell-edge users because it breaks the synchronization from video frames due to the longer reception delay. Finally, we investigate appropriate strategies for codec selection for both cell-edge and cell-interior, i.e., selecting a combination of high-rate audio/low-rate video and low-rate audio/high-rate video. We conduct simulation experiments to test the proposed scenarios over mobile WiMAX systems.

One of the major challenges in cognitive radio networks is to maintain the quality of service (QoS) for secondary transmissions while ensuring the protection of primary users PUs); the latter requirement is normally enabled through inband spectrum sensing. To maintain QoS of secondary traffic, a secondary user (SU) has to quickly switch to another empty spectrum band when a PU returns to its currently occupied spectrum by SU. The issue of how to quickly and accurately identify a free spectrum band when the operating spectrum band becomes unavailable is of practical interest; out-of-band spectrum sensing is a mechanism that can be leveraged for this purpose. In this paper, we propose a novel progressive out-of-band spectrum sensing (PG-Sensing) scheme that consists of two components, 1) progressive scanning which adaptively selects a subset of the available candidate spectrum bands which have a higher chance of being empty, and 2) multiband sequential shifted chi-squared test (SSCT) based searching that searches only the set of selected spectrum bands in the first step. The proposed PGsensing scheme significantly reduces the time to resume secondary transmissions thus allowing SUs to reliably and quickly switch to a free spectrum band when necessary while maintaining good QoS for PUs as well as SUs.

Energy detection is an attractive spectrum sensing method for cognitive radio. The design of energy detection relies on two critical assumptions: 1) noise power is perfectly and {\it a prior} known; and 2) the test statistics in energy detection can be accurately modeled as independent and identically distributed (i.i.d.) Gaussian random variables. In practice, noise power varies from time to time. This renders difficulty in estimating noise power and incurs an inaccuracy in modeling the test statistics. This paper studies how to realize energy detection using software-defined radio in a real environment. The noise power variation in a real environment is investigated. A histogram based method is proposed to determine the threshold of energy detection. Our experimental study shows the effectiveness of the histogram based method.

Linear turbo equalizers with/without channel estimation have been exploited due to their good performance with low complexity compared to a maximuma posteriori (MAP) turbo equalizer. Much work has focused on channel estimate-based minimum mean square error (MMSE) turbo equalizers. However, an MMSE turbo equalizer still requires higher complexity than an adaptive turbo equalizer such as with a normalized least mean square (NLMS) turbo equalizer. Even if adaptive turbo equalizers converge, there is often a performance loss compared to an MMSE turbo equalizer because the adaptive turbo equalizers treat soft decision data as stationary. In order to reduce this loss, we propose a new adaptive turbo equalizer that uses the soft decision data to switch among a set of K different equalizers to approximate the time varying MMSE behavior. Simulations show that the proposed switching-based NLMS turbo equalizer has better bit error rate (BER) performance than a conventional NLMS turbo equalizer by as much as 0.6dB.

This paper initially shows ROHC and packet aggregation significantly improve the number of successful voice calls. However, the improvement does not include processor's processing overhead, which is identified by measuring ROHC processing time from Intel Pentium 4 and RouterBOARD, and applying the results into NS-2 simulations. Simulation results indicate the number of successful voice calls is seriously affected by the processing overhead. For the solution of the processing limitation, we propose a hardware model of the two algorithms and numerically analyze the model. Simulation results show the hardware model makes the number of successful voice calls approach the ideal (no-delay) case, and the numerical model exactly characterizes the hardware behaviors.

Wireless Mesh Network (WMN) supports various types of mesh clients such as sensor networks, cellular; 802.11/e Wireless LAN, etc. In this case, it needs to be suitably organized and adopt well-known or newly proposed algorithm to guarantee high and reliable mesh performance. This paper applies RObust Header Compression (ROHC) originate from cellular data network plus packet aggregation to WMNs when mesh clients generate small-size fusion data, i.e., sensor (delivered by UDP) and voice over IP (VOIP) data. We preliminarily analyze ROHC and packet aggregation improve UDP throughput and the number of supported voice calls. However; the improvement does not include a processor's processing overhead for ROHC and packet aggregation, which is examined by measuring ROHC execution time from Intel Pentium 4 and RouterBOARD, and applying the results into NS-2 simulations. The results indicate UDP and voice performance are seriously affected by the processing overhead. As a solution for the performance degradation, we introduce a hardware design for the two algorithms. By using SystemC Hardware Description Language (HDL), we first design hardware specification composed of 1Ghz master clock and 333Mhz BUS system. Then, we integrate the hardware model into previous NS-2 network model, and propose profile-based network/hardware co-simulation method which gives insight how to investigate real-timing characteristics of the hardware model in the view of network behaviors.

We consider the problem of supporting VoIP calls over a wireless mesh network. We particularly consider the call admission control (CAC) decision problem for VoIP calls on a mesh network. The goal of the call admission decision is to maintain the quality of VoIP calls as given by the R-score measure. In this work, we define a notion of interference capacity model that can be efficiently used to design a CAC algorithm. We show through extensive simulation of 802.11 mesh using ns-2, that our CAC performs well in multi-hop scenarios. Specifically, the proposed CAC provides less than 20% incorrect decisions for different sizes of a multihop linear topology.

Abstract — Performance in multihop wireless networks is known to degrade with the number of hops for both TCP and UDP traffic. For VoIP, the wireless network presents additional challenges as the perceived quality is dependent on both loss and delay. We investigate several methods to improve voice quality and present experimental results from an 802.11b testbed optimized for voice delivery. Use of multiple interfaces, path diversity and aggregation are shown to provide a combined improvement of 13 times in number of calls supported in our 15 node 802.11 mesh system. VoIP, multihop, mesh I.

Performance in multihop wireless networks is known to degrade with the number of hops for both TCP and UDP traffic. For VoIP, the wireless network presents additional challenges as the perceived quality is dependent on loss, delay and jitter. Furthermore, small size of VoIP packets aggravates network utilization of the 802.11 based wireless mesh network. In this work, we evaluate the packet aggregation algorithms to reduce VoIP protocol overhead, compare the aggregation algorithms and propose a distributed packet aggregation mechanism. The experimental results demonstrates that the proposed distributed packet aggregation algorithm improves the VoIP quality and results in significant increase in the number high quality VoIP calls supported over multihop mesh.

In this work, we focus on increasing network utilization to support real-time applications, especially voice over IP, in 802.11b wireless mesh network. For increasing capacity, we investigate on two directions: use of packet aggregation and utilize of header compression. Although aggregation reduces 802.11 MAC overhead, it also increases delay. We present a distributed multihop aggregation algorithm that uses the "natural" waiting time in the interface queue of packets in a loaded network. Header compression can relax the VoIP protocol overhead, but it also introduces the signaling overhead. In our work, we propose a zero-length header compression algorithm integrated with packet aggregation, which doesn't need to depend on the signaling mechanism to recover the context discrepancy between compressor and decompressor. The above performance optimization techniques are experimented in the NS2 simulator. The experimental results show an increase of 12 times for a six hop string when all optimizations are used

In the recent past, there has been a tremendous increase in the popularity of VoIP services as a result of huge growth in broadband access. The same voice-over-Internet protocol (VoIP) service poses new challenges when deployed over a wireless mesh network, while enabling users to make voice calls using WiFi phones. Packet losses and delay due to interference in a multiple-hop mesh network with limited capacity can significantly degrade the end-to-end VoIP call quality. In this work, we discuss the basic requirements for efficient deployment of VoIP services over a mesh network. We present and evaluate practical optimizing techniques that can enhance the network capacity, maintain the VoIP quality and handle user mobility efficiently. Extensive experiments conducted on a real testbed and ns-2 provide insights into the performance issues and demonstrate the level of improvement that can be obtained by the proposed techniques. Specifically, we find that packet aggregation along with header compression can increase the number of supported VoIP calls in a multihop network by 2-3 times. The proposed fast path switching is highly effective in maintaining the VoIP quality. Our fast handoff scheme achieves almost negligible disruption during calls to roaming clients

Autostereoscopic 3-D imaging and display system is implemented on the notebook 486 DxII PC with TFT active matrix LCD display module and accompanying lenticular sheet lens. An image processing board (e.g. Targa Plus which is commercially available) is used to capture and display the image. Display experiments for still images and animating graphics images were very promising and satisfactory. Measured depth perception is about 100 mm on a notebook PC LCD display unit. The compact design of lens-plate and TFT LCD display module would be appropriate for 3-D game machines, stereoscopic TV system on multimedia PC.