Third-party applications have become an essential part of today’s online ecosystem, enhancing the functionality of popular platforms. However, the intensive data exchange underlying their proliferation has raised concerns about interdependent privacy (IDP). This paper investigates the IDP issues of third-party apps that were previously not studied comprehensively. Specifically, first, we analyze the permission structure of multiple app platforms, identifying permissions that have the potential to cause interdependent privacy issues by enabling a user to share someone else’s personal data with an app. Second, we collect datasets and characterize the extent to which existing apps request these permissions, revealing the relationship between characteristics such as the respective app platform, the app’s type, and the number of interdependent privacy-related permissions it requests. Third, we analyze why IDP is neglected by both data protection regulations and app platforms and then devise the principles that should be followed when designing a mitigation solution. Finally, based on these principles and satisfying clearly defined objectives, we propose IDPFilter, a platform-agnostic API that enables application providers to minimize collateral information collection by filtering out data collected from their users, but implicating others as data subjects. We implement a proof-of-concept prototype, IDPTextFilter, that implements the filtering logic on textual data, and provide its initial performance evaluation concerning privacy, accuracy, and efficiency. • Collected data from third-party apps to identify interdependent privacy issues. • Identified permissions in app platforms that lead to interdependent privacy issues. • Analyzed real app permissions revealing widespread interdependent privacy risks. • IDPFilter is effective in mitigating interdependent privacy in third-party apps.

Misaligned incentives in secure software development have long been a challenge in security economics. Product liability, a powerful legal framework in other industries, has been largely ineffective for software products until recent times. However, the rapid regulatory responses to recent global cyber attacks by both the US and EU, together with the (relative) success of the General Data Protection Regulation in defining both duty and standard of care for software vendors, may enable regulators to use liability to re-align incentives for the benefit of the digital society. The United States National Cybersecurity Strategy suggests shifting responsibility for cyber incidents back to software vendors and proposes the concept of the liability waiver: if a software company voluntarily undergoes and passes an IT security audit, its future product liability is (fully or partially) waived. This article examines this audit-liability framework from both vendor and auditor perspectives. For vendors, we model the decision process as a sequential problem: a vendor must pass an audit to release a product and can attempt the audit multiple times. We show that the optimal strategy for an opt-in vendor is to never quit and to exert cumulative investments in either a “one-and-done” or “incremental” manner. For auditors, we explore how to design audits that encourage voluntary participation while maximizing vendor effort. We further investigate dynamic audit designs that can amplify vendors’ cumulative investments in security. Our findings provide insights into how liability waivers and audit strategies can re-align incentives, fostering a more secure digital ecosystem.

Outsourcing virtual network functions (VNFs) to third-party service providers, such as public clouds, has become the norm. While outsourcing brings many benefits, including scalability, streamlined management, and lower CapEx, it also introduces security concerns. Owing to the lack of trust in the cloud, organizations may opt to shield both their network functions and the traffic flowing through them. Existing outsourcing mechanisms, however, fall short of the functionality, security, and/or performance requirements. This paper presents SafeLib, a comprehensive, Intel SGX based, open-source, secure network function outsourcing framework. To the best of our knowledge, SafeLib is the first trusted hardware based solution providing i) support for both stateful and stateless virtual NFs, ii) strong security properties with regard to both user traffic and VNF execution, state, policies, and code, iii) high performance, iv) enhanced usability for VNF developers and v) flexibility in choosing the network stack by providing support for both kernel and kernel-bypass mechanisms. We corroborate our performance claims through an extensive testbed evaluation. In addition, we provide insights on the performance penalty of major SGX limitations and also refute the popular belief that using a library OS within an SGX enclave necessarily reduces performance. We believe that SafeLib provides a flexible and performant tool with strong security guarantees for building secure, carrier-grade cloud-based services.

Abstract This paper explores the comparative analysis of federated learning (FL) and centralized learning (CL) models in the context of multi-class traffic flow classification for network applications, a timely study in the context of increasing privacy preservation concerns. Unlike existing literature that often omits detailed class-wise performance evaluation, and consistent data handling and feature selection approaches, our study rectifies these gaps by implementing a feed-forward neural network and assessing FL performance under both independent and identically distributed (IID) and non-independent and identically distributed (non-IID) conditions, with a particular focus on incremental training. In our cross-silo experimental setup involving five clients per round, FL models exhibit notable adaptability. Under IID conditions, the accuracy of the FL model peaked at 96.65%, demonstrating its robustness. Moreover, despite the challenges presented by non-IID environments, our FL models demonstrated significant resilience, adapting incrementally over rounds to optimize performance; in most scenarios, our FL models performed comparably to the idealistic CL model regarding multiple well-established metrics. Through a comprehensive traffic flow classification use case, this work (i) contributes to a better understanding of the capabilities and limitations of FL, offering valuable insights for the real-world deployment of FL, and (ii) provides a novel, large, carefully curated traffic flow dataset for the research community.

Federated learning algorithms are developed both for efficiency reasons and to ensure the privacy and confidentiality of personal and business data, respectively. Despite no data being shared explicitly, recent studies showed that the mechanism could still leak sensitive information. Hence, secure aggregation is utilized in many real-world scenarios to prevent attribution to specific participants. In this paper, we focus on the quality (i.e., the ratio of correct labels) of individual training datasets and show that such quality information could be inferred and attributed to specific participants even when secure aggregation is applied. Specifically, through a series of image recognition experiments, we infer the relative quality ordering of participants. Moreover, we apply the inferred quality information to stabilize training performance, measure the individual contribution of participants, and detect misbehavior.

The unavailability of training data is a permanent source of much frustration in research, especially when it is due to privacy concerns. This is particularly true for location data since previous techniques all suffer from the inherent sparseness and high dimensionality of location trajectories which render most techniques impractical, resulting in unrealistic traces and non-scalable methods. Moreover, time information of location visits is usually dropped, or its resolution is drastically reduced. In this paper we present a novel technique for privately releasing a composite generative model and whole high-dimensional location datasets with detailed time information. To generate high-fidelity synthetic data, we leverage several peculiarities of vehicular mobility such as its language-like characteristics (“you should know a location by the company it keeps”) or how humans plan their trips from one point to the other. We model the generator distribution of the dataset by first constructing a variational autoencoder to generate the source and destination locations, and the corresponding timing of trajectories. Next, we compute transition probabilities between locations with a feed forward network, and build a transition graph from the output of this model, which approximates the distribution of all paths between the source and destination (at a given time). Finally, a path is sampled from this distribution with a Markov Chain Monte Carlo method. The generated synthetic dataset is highly realistic, scalable, provides good utility and, nonetheless, provably private. We evaluate our model against two state-of-theart methods and three real-life datasets demonstrating the benefits of our approach.

A recent trend is to outsource virtual network functions (VNFs) to a third-party service provider, such as a public cloud. Since the cloud is usually not trusted, redirecting enterprise traffic to such an entity introduces security concerns. In addition to protecting enterprise traffic, it is also desirable to protect VNF code, policies and states. Existing outsourcing solutions fall short in either supporting stateful VNFs, catering for all security requirements, or providing adequate performance.In this paper we present SafeLib, a trusted hardware based outsourcing solution built on Intel SGX. SafeLib provides i) support for stateful VNFs, ii) support for illegal SGX instructions by integrating Graphene-SGX, iii) protection of both packet headers and payload for enterprise user traffic, VNF policies and VNF code, and iv) integration of libVNF for streamlined VNF development. Our performance evaluation shows that SafeLib scales properly for multiple cores, and introduces a reasonable performance overhead. We also outline plans to further improve SafeLib to satisfy even more stringent functional, security and performance requirements.

Multiple attacks have shown that in-vehicle networks have vulnerabilities which can be exploited. Securing the Controller Area Network (CAN) for modern vehicles has become a necessary task for car manufacturers.Some attacks inject potentially large amount of fake messages into the CAN network; however, such attacks are relatively easy to detect. In more sophisticated attacks, the original messages are modified, making the detection a more complex problem. In this paper, we present a novel machine learning based intrusion detection method for CAN networks. We focus on detecting message modification attacks, which do not change the timing patterns of communications. Our proposed temporal convolutional network-based solution can learn the normal behavior of CAN signals and differentiate them from malicious ones. The method is evaluated on multiple CAN-bus message IDs from two public datasets including different types of attacks. Performance results show that our lightweight approach compares favorably to the state-of-the-art unsupervised learning approach, achieving similar or better accuracy for a wide range of scenarios with a significantly lower false positive rate.

Sharing Economy (SE) systems use technologies to enable sharing of physical assets and services among individuals. This allows optimisation of resources, thus contributing to the re-use principle of Circular Economy. In this paper, we assess existing SE services and identify their challenges in areas that are not technically connected to their core functionality but are essential in creating trust: information security and privacy, personal data protection and fair economic incentives. Existing frameworks for elicitation of non-functional requirements are heterogeneous in their focus and domain specific. Hence, we propose to develop a holistic methodology for non-functional requirements specification for SE systems following a top-down-top approach. A holistic methodology considering non-functional requirements is essential and can assist in the analysis and design of SE systems in a systematic and unified way applied from the early stages of the system development.

Data is the new oil for the car industry. Cars generate data about how they are used and who’s behind the wheel which gives rise to a novel way of profiling individuals. Several prior works have successfully demonstrated the feasibility of driver re-identification using the in-vehicle network data captured on the vehicle’s CAN (Controller Area Network) bus. However, all of them used signals (e.g., velocity, brake pedal or accelerator position) that have already been extracted from the CAN log which is itself not a straightforward process. Indeed, car manufacturers intentionally do not reveal the exact signal location within CAN logs. Nevertheless, we show that signals can be efficiently extracted from CAN logs using machine learning techniques. We exploit that signals have several distinguishing statistical features which can be learnt and effectively used to identify them across different vehicles, that is, to quasi ”reverse-engineer” the CAN protocol. We also demonstrate that the extracted signals can be successfully used to re-identify individuals in a dataset of 33 drivers. Therefore, not revealing signal locations in CAN logs per se does not prevent them to be regarded as personal data of drivers.

Value-added 5G verticals are foreseen to be delivered as a service chain over multiple network operators with extensive outsourcing of Virtual Network Functions (VNFs). In this short paper we introduce the initial design of SafeLib, a software middlebox platform based on Intel SGX, which protects user traffic, VNF code, policy input and state in such scenarios, while also retaining high performance. Augmenting the smart integration of existing hardware and software building blocks with new secure elements, the SafeLib architecture shows considerable promise in a carrier-grade service context.

Abstract Machine learning algorithms have reached mainstream status and are widely deployed in many applications. The accuracy of such algorithms depends significantly on the size of the underlying training dataset; in reality a small or medium sized organization often does not have the necessary data to train a reasonably accurate model. For such organizations, a realistic solution is to train their machine learning models based on their joint dataset (which is a union of the individual ones). Unfortunately, privacy concerns prevent them from straightforwardly doing so. While a number of privacy-preserving solutions exist for collaborating organizations to securely aggregate the parameters in the process of training the models, we are not aware of any work that provides a rational framework for the participants to precisely balance the privacy loss and accuracy gain in their collaboration. In this paper, by focusing on a two-player setting, we model the collaborative training process as a two-player game where each player aims to achieve higher accuracy while preserving the privacy of its own dataset. We introduce the notion of Price of Privacy, a novel approach for measuring the impact of privacy protection on the accuracy in the proposed framework. Furthermore, we develop a game-theoretical model for different player types, and then either find or prove the existence of a Nash Equilibrium with regard to the strength of privacy protection for each player. Using recommendation systems as our main use case, we demonstrate how two players can make practical use of the proposed theoretical framework, including setting up the parameters and approximating the non-trivial Nash Equilibrium.

Machine learning algorithms have reached mainstream status and are widely deployed in many applications. The accuracy of such algorithms depends significantly on the size of the underlying training dataset; in reality a small or medium sized organization often does not have enough data to train a reasonably accurate model. For such organizations, a realistic solution is to train machine learning models based on a joint dataset (which is a union of the individual ones). Unfortunately, privacy concerns prevent them from straightforwardly doing so. While a number of privacy-preserving solutions exist for collaborating organizations to securely aggregate the parameters in the process of training the models, we are not aware of any work that provides a rational framework for the participants to precisely balance the privacy loss and accuracy gain in their collaboration. In this paper, we model the collaborative training process as a two-player game where each player aims to achieve higher accuracy while preserving the privacy of its own dataset. We introduce the notion of Price of Privacy, a novel approach for measuring the impact of privacy protection on the accuracy in the proposed framework. Furthermore, we develop a game-theoretical model for different player types, and then either find or prove the existence of a Nash Equilibrium with regard to the strength of privacy protection for each player.

A majority of 5G verticals have the potential to generate large revenues, but are expected to have strict Quality of Service (QoS) guarantees, and are projected to be delivered as a service chain of multiple, independent operators. Such multi-operator service delivery requires a set of interdependent Service Level Agreements (SLAs) between operators. The amount and aggregation-level of information shared between stakeholders inside such SLAs will determine how efficient the coordinated traffic engineering between the operators will be. Sharing more details on one's network is uncommon in today's interactions due to the fear of losing competitive advantage and regulations with regard to national security. In this paper, we analyze the economic incentives for information exchange in the context of multi-operator service delivery. We show that the current practice of exchanging only highly aggregated information can lead to both significant under- and overestimation of the risk of not meeting user-facing Quality of Service guarantees. We also show that economic incentives for mutually sharing an optimal amount of information do exist, and optimal information exchange between operators is viable in the long run. Moreover, through a simple numerical example, we demonstrate how the mutually shared information and the resulting risk estimation affect the revenues of the operators from the end-user market. We believe this work opens up a new line of research connecting the economics of multi-operator service delivery and network performability.

Bufferless network operation is favorable in many application domains such as industrial networks, on-chip networks and optical packet switching (OPS). The main challenge with zero buffers is the avoidance or handling of contention; indeed, many domain-specific contention resolution techniques have been proposed in the literature. In this paper, we propose a generic combined forward error correction (FEC) and network coding (NC) scheme, which mitigates the negative impact of contentions at the network layer. Specifically, we present a case study for OPS utilizing FEC at the ingress node and NC at an intermediary optical packet switch to reduce packet loss due to contention. Our analysis shows that if used in a smart way, our mechanism can reduce decoding error and packet loss with multiple orders of magnitude while adhering to buffering limitations and meeting delay requirements. We believe that such a combined coding scheme has the potential to be utilized both in OPS (data center and core networks) and other networks where (near-)zero buffers are required.

Flexible service delivery is a key requirement for 5G network architectures. This includes the support for collaborative service delivery by multiple operators, when an individual operator lacks the geographical footprint or the available network, compute or storage resources to provide the requested service to its customer. Network Function Virtualisation is a key enabler of such service delivery, as network functions (VNFs) can be outsourced to other operators. Owing to the (partial lack of) contractual relationships and co-opetition in the ecosystem, the privacy of user data, operator policy and even VNF code could be compromised. In this paper, we present a case for privacy in a VNF-enabled collaborative service delivery architecture. Specifically, we show the promise of homomorphic encryption (HE) in this context and its performance limitations through a proof of concept implementation of an image transcoder network function. Furthermore, inspired by application-specific encryption techniques, we propose a way forward for private, payload-intensive VNFs.

Communication networks have to provide a high level of resilience in order to ensure sufficient Quality of Service for mission-critical services. Currently, dedicated 1+1 path protection is implemented in backbone networks to provide the necessary resilience. On the other hand, there are several possible realization strategies for 1+1 path protection functionality (1PPF), utilizing both diversity- and network coding. In this paper we consider the cost aspects of the different realization strategies. We evaluate the cost of providing 1PPF both analytically and empirically in realistic network topologies. Our results show that both diversity and network coding can provide 1PPF with reduced cost compared to traditional 1+1 path protection, even in case of short paths and strict coding restrictions. Specifically, the network coding scheme could be used as a cost-efficient and potentially all-optical realization of 1PPF.

Mobile communications are increasingly contributing to global energy consumption. The EARTH (Energy Aware Radio and neTworking tecHnologies) project tackles the important issue of reducing CO2emissions by enhancing the energy efficiency of cellular mobile networks. EARTH is a holistic approach to develop a new generation of energy efficient products, components, deployment strategies and energy-aware network management solutions. In this paper the holistic EARTH approach to energy efficient mobile communication systems is introduced. Performance metrics are studied so to assess the theoretical bounds of energy efficiency and the practical achievable limits. Moreover, various deployment strategies focusing on their potential to reduce energy consumption are studied, whilst providing uncompromised coverage and user experience. This includes heterogeneous networks with a sophisticated mix of different cell sizes, which may be further enhanced by energy efficient relaying and base station cooperation technologies. Finally, scenarios leveraging the capability of advanced terminals to operate on multiple radio access technologies (RAT) are discussed with respect to their energy savings potential.

We analyse throughput adaptation of high-speed TCP protocols during handovers in an emulation testbed. We use emulation characteristics reflecting current mobile networks and future network specifications as set by the relevant standards. We found that the performance of TCP protocols is satisfactory, except as follows. Traditional loss-based TCP-s like BIC, highspeed and scalable adapt slowly to sudden link capacity increases caused by handovers. Fast TCP adapts much faster, however depending on parameter settings it may under-utilise after a capacity decrease coupled with RTT increase. We also calculate the probability of buffer overflows at handover as the function of the buffer size and transmission parameters at the bottleneck link. This probability turns out to be significant for reasonable scenarios, and we suggest a dynamic buffer re-allocation method to eliminate such buffer overruns in mobile networks.

Lookup operations in CAN might take a long time, as requests are passed only to direct neighbors. Realities ease this problem, but their random nature does not ensure fairness between participating nodes. In this paper we propose multiple levels of long range neighbors, called Reference Points (RPs), placed in a deterministic manner. Their location is calculated for each node so as to ensure reaching any point in the coordinate space in a comparably small number of steps. Multi-level RPs also bring fairness to CAN.

The expected growth in the number of communicating wireless devices claims for a more effective utilization of widespread wireless technologies, like WiFi. In this paper we propose an addressing and routing network architecture that uses multi-hop access to extend the range of managed wireless networks. It provides a scalable and controllable solution to facilitate network configuration and mobility handling in a possibly heterogeneous environment.

This paper proposes a middleware that creates a dynamically changeable, but uniform computing environment for personal area networks (PANs). The middleware hides the physical scatteredness and the dynamically changing configuration of the PAN and presents its capabilities as a single computer. Using the uniform application programming interface (API) offered by the middleware, developers creating distributed applications do not have to take care of various PAN configurations or PAN dynamics. The solution provides easy set-up of PANs and transparent redirection of ongoing dataflows.