Many existing Artificial Intelligence (AI) solutions on mobile devices rely on an extensive collection of sensitive data, raising privacy concerns and often requiring storage for both context and model improvement. Apple's Private Cloud Compute (PCC) aims to address this by emphasizing mobile device integration and a privacy-first design. The central claim of PCC is that it does not store any user data and that user input and user accounts are unlinkable. While most of the PCC system specifications are public, compiled binaries add a layer of opaqueness. There are no reproducible builds, and there are no symbols within those binaries, creating potential discrepancies between the specification and what is shipped to the user. Additionally, the underlying models and interfaces for querying PCC are not openly accessible, limiting academic evaluation of model properties, such as accuracy. This poses a challenge in assessing whether a privacy-preserving approach like PCC is actually trustworthy while also providing high-quality answers. We are the first to reverse-engineer the PCC implementation on mobile devices to evaluate privacy aspects and to open its non-public interfaces on local devices to support custom PCC queries. We demonstrate this level of access beyond Apple's intended use cases by independently benchmarking the PCC model. We enable future research by making our PCC benchmarking framework publicly available.

A viable remote attack surface of smartphones is the baseband chip, which handles the communication with cellular networks. One attack that is often conducted, e.g., to track users, is the deployment of Rogue Base Stations (RBSs). We built and actively maintain CellGuard, an iOS app that analyzes the interaction of an iPhone with its baseband chip to detect whether the phone connects to an RBS. In this demo, we showcase CellGuard's base functionality of dissecting baseband communication packets and assessing nearby cells for trustworthiness, as well as recent developments. We present the latest changes to the app, including support for Apple's new C1 and C1X baseband chips, architectural improvements, user interface enhancements, and additional notifications for suspicious baseband activity.

Pairing of wireless devices, such as smartphones, suffers from a plethora of practical challenges if strong security guarantees via integrity codes are desired. Acoustic schemes are easy to deploy, but suffer from limited data rates and high sensitivity to environmental noise. Existing Wi-Fi-based methods, however, lack the necessary timing precision and signal flexibility to implement integrity codes on off-the-shelf devices. In this paper, we introduce Pair-Fi, a novel method that overcomes these limitations by leveraging integrity codes transmitted using software-defined radio (SDR)-like capabilities enabled through firmware modifications directly on smartphone-integrated Wi-Fi chips. Pair-Fi demonstrates both transmission and reception of raw IQ samples directly on commodity smartphone hardware, allowing for precise on-off keying modulation with timing resolution as low as 4 µs slots. By bypassing the constraints of conventional Wi-Fi frame timings, our approach significantly improves pairing speed, reliability, and resistance to interference. We validate Pair-Fi experimentally on recent smartphone models, such as the Google Pixel 7, showing robust performance in realistic environments. Our results indicate that SDR-enabled integrity code pairing via smartphone Wi-Fi chips provides a practical, secure, and efficient alternative to existing device pairing mechanisms, opening new avenues for secure and seamless device interactions in everyday scenarios.

5G and 5G-Advanced cellular networks are vulnerable to local outages resulting from disasters or targeted attacks. This fragility stems from the reliance on the central core network involved for most 5G connectivity use cases. Crisis-struck areas isolated from the cellular core network form islands , where crisis response is hindered by the unavailability of recovery-relevant services, such as emergency calls, cell broadcasts, messengers, and news apps. Our concept of island-ready, resilient-by-design 6G communication networks envisions local cellular connectivity allowing users to connect to local application servers, which is currently impossible. In our conceptualization, we follow an all-society approach, as realizing island connectivity requires the cooperation of multiple actors, including users, operators, developers, providers, and authorities. We evaluate the island readiness of 5G and 5G-Advanced systems and outline the open challenges stakeholders must address for full island readiness, such as decentralizing the 6G core network and designing local-first application architectures.

Wi-Fi sensing has emerged as a versatile tool for tasks such as localization, gesture recognition, and vital-sign monitoring, enabling applications from smart environments to personalized healthcare. However, sensing accuracy often significantly degrades when pretrained models are deployed across different commodity receivers. We present the first systematic comparison of Channel State Information (CSI) across diverse Commercial Off-The-Shelf Wi-Fi sensing platforms. Using a unified experimental setup delivering precisely precoded signals simultaneously to multiple receivers, we isolate receiver-specific variability. We find that dominant cross-device differences arise from Automatic Gain Control and consistent subcarrier non-linearities. We propose a simple gain-alignment preprocessing step, recovering most of the lost accuracy (up to 75%) in cross-device Human Activity Recognition model deployments. Without preprocessing, model accuracy sharply drops—effectively breaking practical deployments. Additional analyses reveal measurable inherent differences in receiver faithfulness, sensitivity and noise. While these receiver-induced differences do not significantly affect robust sensing tasks such as Human Activity Recognition, they become relevant in scenarios demanding high precision (e.g., single-shot time of flight). Our findings demonstrate that cross-device variability in CSI is real but manageable, and we provide tools and guidelines for robust, hardware-agnostic Wi-Fi sensing.

One of the core privacy features of smartphone operating systems is a permission framework that requires explicit user consent before granting apps access to private data. Such systems are deeply integrated into Google's Android and Apple's iOS, which together account for the majority of the smartphone operating system market. While permission systems can be seen as milestones in user empowerment and privacy protection, they offer users only a binary choice: whether an app can access a specific resource or not. As soon as an app is allowed to read a resource, the operating system loses control over its further use. Most apps have Internet access and can send permission-protected data, like a user's location, over the Internet, which can harm user privacy. To solve this problem, we present an addition to current permission systems that splits apps into multiple sandboxed processes to enforce fine-grained privacy and data-flow controls on smartphones. By default, our design forces apps to process permission-protected data locally on the device, thereby eliminating the need for apps to request runtime permissions for local-only use cases. We implement a proof-of-concept based on the Android Open Source Project code base. We showcase our framework's practicability by adapting multiple app use cases to our system, benchmarking its computational overhead, and discussing the implications for platform operators, developers, and users.

Smartphones have become the primary interface to the Internet for many users, making app stores an essential part of the mobile ecosystem. Apple's App Store and Google's Play Store form a duopoly of the two largest app stores, both of which offer targeted advertisements in their store ecosystems. Consequently, their need for user data to improve the targeting of ads conflicts with users' desire for privacy. Users have to trust the statements given in privacy policies that are often scattered over multiple places and have no way of overseeing how their data is used for ad targeting. The European Union passed several regulations, most notably the DSA and DMA, addressing this transparency issue. The implementation of these laws, however, must be audited to ensure their effectiveness. Unfortunately, the transparency measures implemented in the context of advertising and the ad-targeting mechanisms in app stores have received little attention so far. In this work, we analyze the first-party ad tracking ecosystem on Apple's and Google's app stores. We measure the effects of different account parameters and interest patterns on the ads these accounts receive. Furthermore, we study the transparency measures implemented by the platforms. While we only detect rare occurrences of targeted advertising, we find Google's recommendations to be highly personalized. We notice multiple issues with the realization of transparency measures that affect their effectiveness and, in our opinion, contradict corresponding EU laws.

Acoustic data transmission offers a compelling alternative to Bluetooth and NFC by leveraging the ubiquitous speakers and microphones in smartphones and IoT devices. However, most research in this field relies on simulations or limited on-device testing, which makes the real-world reliability of proposed schemes difficult to assess. We systematically reviewed 31 acoustic communication studies for commodity devices and found that none provided accessible source code. After contacting authors and re-implementing three promising schemes, we assembled a testbed of eight representative acoustic communication systems. Using over 11 000 smartphone transmissions in both realistic indoor environments and an anechoic chamber, we provide a systematic and repeatable methodology for evaluating the reliability and generalizability of these schemes under real-world conditions. Our results show that many existing schemes face challenges in practical usage, largely due to severe multipath propagation indoors and varying audio characteristics across device models. To support future research and foster more robust evaluations, we release our re-implementations alongside the first comprehensive dataset of real-world acoustic transmissions. Overall, our findings highlight the importance of rigorous on-device testing and underscore the need for robust design strategies to bridge the gap between simulation results and reliable IoT deployments.

WiFi sensing relies heavily on blackbox machine learning (ML) models due to the large feature space and complexity. Despite achieving very high accuracies in complex scenarios, the blackbox nature of these ML-based sensing techniques is commonly criticized. This is in fact a major source of mistrust as these models provide very little explanation supporting their decision, while often handling critical applications (e.g., elderly monitoring). In this paper, we investigate explainable artificial intelligence (XAI) techniques to shed light on the decisions and behaviors of such blackbox models. Specifically, we propose eXSense, a workflow designed based on state-of-the-art XAI techniques to analyze the behavior of blackbox models both locally and globally. To demonstrate its potential, we conduct an extensive analysis on two case studies from the recent sensing literature. Finally, leveraging the insights obtained from our analysis, we propose and evaluate changes to these models, thus enhancing their efficiency and reliability. This includes reducing the feature space by at least 80% with no/minimal loss ($\leq 1\%$) to the model accuracy.

Millimeter-wave (mmWave) communication systems utilize phased-array antennas to generate highly directional beams, effectively reducing the signal footprint. Nonetheless, eavesdropping, particularly within the main-lobe, remains a significant concern. This paper introduces BeamSec, a novel beam hopping approach to maximize absolute secrecy rates with no information about the channel state information (CSI) or location of the eavesdroppers. Methodologically, BeamSec identifies diverse beam-pairs between transceivers by analyzing signal characteristics, such as Angle of Departure (AoD) and Angle of Arrival (AoA). To prevent the secure message from being eavesdropped, BeamSec splits and jointly encodes data among selected beams. Moreover, BeamSec optimizes secrecy by adapting time allocation across selected beams under different levels of channel knowledge, namely (i) full/-partial Radio Frequency (RF) maps constructed based on the empirical data of legitimate users, (ii) knowledge of the room floor map, and (iii) only the instantaneous knowledge of the legitimate transmitter (TX)-receiver (RX) channel. Furthermore, we experimentally validate the efficiency of the proposed schemes using an 802.11ad-compatible 60 GHz phased-array testbed. Specifically, BeamSec demonstrates a non-zero absolute secrecy rate even for the simplistic uniform time allocation approach. Radio map (partial channel knowledge) and known room geometry (instantaneous TX/RX) based schemes provide further improvement of 124.8% and 58.13%, respectively, as compared to uniform time allocation.

This work investigates a practical reconfigurable intelligent surface (RIS)-aided integrated sensing and communication (ISAC) system, where a subset of RIS elements fail to function properly and reflect incident signals randomly towards unintended directions with attenuation, thereby degrading system performance. To date, no study has addressed such impairments caused by faulty RIS elements in ISAC systems. This work aims to fill the gap. First, to quantify the impact of faulty elements on ISAC performance, we derive the misspecified Cramér-Rao bound (MCRB) for sensing parameter estimation and signal-to-interference-and-noise ratio (SINR) for communication quality. Then, to mitigate the performance loss caused by faulty elements, we jointly design the remaining functional RIS phase shifts and transmit beamforming to minimize the MCRB, subject to the communication SINR and transmit power constraints. The resulting optimization problem is highly non-convex due to the intricate structure of the MCRB expression and constant-modulus constraint imposed on RIS. To address this, we reformulate it into a more tractable form and propose a block coordinate descent (BCD) algorithm that incorporates majorization-minimization (MM), successive convex approximation (SCA), and penalization techniques. Simulation results demonstrate that our proposed approach reduces the performance loss by 21.25% on average compared to the baseline where the presence of faulty elements is ignored. Furthermore, the performance gain becomes more evident as the number of faulty elements increases.

Using smartphone apps during crises is well-established, proving critical for efficient crisis response. However, such apps become futile without an Internet connection, which is a common issue during crises. The ongoing 6G standardization explores the capability to provide local cellular connectivity for areas cut off from the Internet in crises. This paper introduces to the HCI community the concept of cellular island connectivity in isolated areas, promising a seamless transition from normal operation to island operation with local-only cellular connectivity. It presents findings from a survey (N = 857) among adult smartphone users from major German cities regarding their smartphone usage preferences in this model. Results show a shift in app demand, with users favoring general-purpose apps over dedicated crisis apps in specific scenarios. We prioritize smartphone services based on their criticality, distinguishing between apps essential for crisis response and those supporting routines. Our findings provide operators, developers, and authorities insights into making user-centric design decisions for implementing island-ready 6G communication.

Mobile networks are evolving rapidly, with 6G promising unprecedented capabilities in terms of data rates and ultra-low latencies. However, the development of testbed platforms for wireless experimentation has not kept pace. Existing platforms typically offer either end-to-end capabilities with low bandwidth or high bandwidth with limited or no real-time functionality. In this paper, we introduce HELIX, an experimentation platform with 6G scalable real-time capabilities. HELIX integrates a comprehensive physical layer subsystem with multi-numerology support alongside an advanced mixed software-hardware control unit responsible for interacting with the fronthaul network and dynamically configuring the functional split in real time. On the server side, we implement the necessary drivers and routines to enable seamless integration with O-RAN systems, thus facilitating open and end-to-end experimentation. We demonstrate the capabilities of HELIX through a variety of experiments at sub-6 GHz, 28 GHz, and 60 GHz frequencies. Notably, HELIX achieves data rates of up to 1200 Mbps using 256-QAM modulation with over 417 MHz of bandwidth, and end-to-end bidirectional latencies of 500 μs. We show advanced features, including the implementation of Integrated Sensing And Communication (ISAC), and discuss how the platform could be extended to support bandwidths of up to 1670 MHz.

Cloud data center, backbone, and access networks constantly push the boundaries towards lower latencies, jitter, and scalable throughput. Evaluating data plane devices, i.e., switches, routers, and complex network functions, by developers and service operators under demanding settings is imperative to ensure service resilience in real-world deployments. Our proposed prototype, Instant P4STA, extends a packet timestamping framework for programmable hardware by combining a hardware packet generator with a uniform browser-based packet editor for dynamic packet generation. The user can specify the packet template bit-by-bit, utilizing the Python library Scapy with a vast variety of packet templates. This way, our prototype combines the best features of software and hardware-based packet generators. We demonstrate packet generation up to 3.2 Tbit/s on eight egress ports with up to four packet types in parallel. More packet generation throughput is possible with more egress ports, capped only by the number of physical ports in the programmable hardware.

LoRaWAN has become a widely adopted, cost-effective solution for Low-Power Wide-Area Networks (LPWANs), bridging the gap between short-range wireless protocols and high-power cellular networks. Its affordable hardware and robust physical layer make it a key enabler for Internet of Things (IoT) applications across sectors like agriculture, smart cities, and industrial automation-domains where security is of central importance. In this paper, we present BlindSpot, a novel jamming attack that enables efficient selective jamming of LoRaWAN gateways. Unlike traditional approaches that rely on creating high-power interference, BlindSpot exploits the limited number of demodulation paths in LoRaWAN gateways to continuously occupy the gateways with fabricated frames, blinding them for any other legitimate transmissions. Compared to existing approaches, this reduces the attacker's power requirements and allows them to decode the legitimate transmissions with a high probability. Selectively retransmitting these frames, the attacker has precise control over which transmissions can be decoded by the gateway. Using a Software-Defined Radio (SDR)-based LoRa transceiver, we demonstrate the effectiveness of the attack against commercial LoRaWAN gateways and propose detection and mitigation strategies to improve the security of LoRaWAN deployments.

LoRaWAN has become a widely adopted, cost-effective solution for Low-Power Wide-Area Networks (LPWANs), bridging the gap between short-range wireless protocols and high-power cellular networks. Its affordable hardware and robust physical layer make it a key enabler for Internet of Things (IoT) applications across sectors like agriculture, smart cities, and industrial automation-domains where security is of central importance. Investigating LoRaWAN's resilience against physical-layer attacks, we developed BlindSpot, a novel jamming attack targeting state-of-the-art LoRaWAN gateways. Unlike traditional jammers, BlindSpot does not rely on overpowering transmissions but prevents their reception by exhausting resources at the gateway. This is possible since commercial gateway processors have only a limited number of demodulators for parallel frame reception. In this demo, we show the effectiveness of the attack against a commercial LoRaWAN gateway, compare it to traditional jamming, and show how our Software-Defined Radio (SDR)-based receiver can overcome the attack.

In April 2024, Google launched the Find My Device Network (FMDN), an Offline-Finding Network (OFN) that allows lost Bluetooth devices, such as trackers or headphones, to be located using billions of Android devices as finders. Similarly to Apple's Find My network, it is activated by default on all modern Android devices. Google promises end-to-end encryption for all location updates and claims to protect the privacy of finder devices as well as owners of lost devices and trackers. Although Android is open-source, FMDN is part of Google Play Services and is only partially publicly specified. We reverse-engineer the proprietary parts of the network, document its behavior, and analyze its privacy, security, and performance. We find several security and privacy issues, including denial-of-service attacks and a potential linkage attack on Android. We further implement a custom app, porting Google's trackers from Android to iOS while also extending the features of the FMDN.

Smartwatches such as the Apple Watch collect vast amounts of intimate health and fitness data as we wear them. Users have little choice regarding how this data is processed: The Apple Watch can only be used with Apple's iPhones, using their software and their cloud services. We are the first to publicly reverse-engineer the watch's wireless protocols, which led to discovering multiple security issues in Apple's proprietary implementation. With WatchWitch, our custom Android reimplementation, we break out of Apple's walled garden-demonstrating practical interoperability with enhanced privacy controls and data autonomy. We thus pave the way for more consumer choice in the smartwatch ecosystem, offering users more control over their devices.

With the steady rising Electric Vehicle (EV) adoption world-wide, a consideration of the Electric Vehicle (EV) charging-related load on power grids is becoming critically important. While strategies to manage this load (e.g., to avoid peaks) exist, they assume that Electric Vehicles (EVs) and charging infrastructure are trustworthy. If this assumption is, however, violated (e.g., by an adversary with control over Electric Vehicle (EV) charging systems), the threat of charging load-based attacks on grid stability arises. An adversary may, for example, try to cause overload situations, by means of a simultaneous increase in charging load coordinated over a large number of EVs. In this paper, we propose an Intrusion Detection System (IDS) that combines regression-based charging load prediction with novelty detection-based anomaly identification. The proposed system considers features from both the Electric Vehicle (EV) charging and power grid domains, which is enabled in this paper by a novel co-simulation concept. We evaluate our Intrusion Detection System (IDS) concept with simulated attacks in real Electric Vehicle (EV) charging data. The results show that the combination of support vector regression with isolation forest-based novelty detection generally provides the best results. Additionally, the evaluation shows that our Intrusion Detection System (IDS) concept, combining grid and charging features, is capable of detecting novel/stealthy attack strategies not covered by related work.

LoRa is about to become the standard for Low-Power Wide-Area Networks (LPWANs), being well suited for many Internet of Things (IoT) and sensor network applications. The success of the technology sparked interest to adopt LoRa for other, more challenging use-cases in industrial automation or control of cyber-physical systems. Regular LoRa gateways are, however, limited in their number of parallel demodulation paths and restricted to a single network. To overcome this limitation, we implement a software-defined, multichannel LoRa receiver that is able to receive all common spreading factors and uplink channel combinations of the LoRaWAN EU868 frequency plan. In addition, our receiver does not rely on hard-coded sync words, enabling a mechanism similar to monitor mode in WLAN networks. Experimental evaluation using Software-Defined Radios (SDRs) confirms superior performance compared to commercial LoRa gateways.

Find My is a crowd-sourced network of hundreds of millions of Apple devices that use Bluetooth Low Energy (BLE) to detect and track the location of items. We explore the limits and opportunities of using this proprietary network for large-scale distributed sensing. The key idea is to let low-cost sensing devices emit specially crafted BLE advertisements that trick nearby Apple devices into generating location reports that carry arbitrary sensor data, which can then be retrieved from the Apple servers. This paper reports on our ongoing work to reverse engineer the Find My system and to design a protocol for the efficient and reliable collection of data from sensing devices via the Find My network. Preliminary results from real-world experiments demonstrate the feasibility of our approach and a several-fold performance improvement compared with the state of the art.

Mobile phones connect to the Internet and receive phone calls using a cellular baseband chip. Basebands pose a substantial attack surface, as they do not only process but also decrypt personal data. Cellular attackers usually force a phone to connect with a, e.g., to record identity information and locations, intercept or manipulate traffic, or execute arbitrary code by exploiting vulnerabilities in the baseband stack. s are stealthy, as smartphones attempt to connect to nearby base stations and do not display any indicators of compromise to the user. While their detection with Software-defined Radios (SDRs) is possible, usability and scalability are limited.

The security of Linux kernel interfaces is paramount in preventing over-the-air, proximity, or other network attacks. The Linux kernel is fuzzed continuously to detect newly introduced bugs. Despite their long runtime, existing fuzzers fail to detect critical bugs, as they are unaware of physical device semantics and difficult to adapt to new devices. This paper proposes a novel fuzzer called VirtFuzz, which is based on Virtual I/O (VirtIO) device drivers. A proxy mechanism enables data collection from physical device interaction. These collected inputs are then used to fuzz through a virtual device. Using our universal VirtIO device, VirtFuzz is generic and can be easily adapted to various Linux VirtIO kernel drivers and their related subsystems. We use this approach to fuzz the Linux Bluetooth and Wireless LAN (WLAN) stacks. To demonstrate the adaptability of our approach, we additionally provide implementations to fuzz the networking and input stack. We find 31 new, manually confirmed bugs, with 6 Common Vulnerabilities and Exposuress (CVEs) assigned.

Trustworthy digital communication requires the secure exchange of contact information, but current approaches lack usability and scalability for larger groups of users. We evaluate the usability of two secure contact exchange systems: the current state of the art, SafeSlinger, and our newly designed protocol, PairSonic, which extends trust from physical encounters to spontaneous online communication. Our lab study (N=45) demonstrates PairSonic's superior usability, automating the tedious verification tasks from previous approaches via an acoustic out-of-band channel. Although participants significantly preferred our system, minimizing user effort surprisingly decreased the perceived security for some users, who associated security with complexity. We discuss user perceptions of the different protocol components and identify remaining usability barriers for CSCW application scenarios.

While designed to locate lost items, Bluetooth trackers are increasingly exploited for malign purposes, such as unwanted location tracking. This study probes deeper into this issue, focusing on the widespread use of these devices for stalking. Following a dual approach, we analyzed user data from a widely used tracking detection app (over 200,000 active installations) and conducted a comprehensive online survey (N=5,253). Our data analysis reveals a significant prevalence of trackers from major brands such as Apple, Tile, and Samsung. The user data also shows that the app sends about 1,400 alarms daily for unwanted tracking. Survey insights reveal that 44.28% of stalking victims had been subjected to location tracking, with cars emerging as the most common hideout for misused trackers, followed by backpacks and purses. These findings underscore the urgency for more robust solutions. Despite ongoing efforts by manufacturers and researchers, the misuse of Bluetooth trackers remains a significant concern. We advocate for developing more effective tracking detection mechanisms integrated into smartphones by default and creating supportive measures for individuals without smartphone access.

This paper investigates the radio resource management (RRM) design for multiuser rate-splitting multiple access (RSMA), accounting for various characteristics of practical wireless systems, such as the use of discrete rates, the inability to serve all users, and the imperfect successive interference cancellation (SIC). Specifically, failure to consider these characteristics in RRM design may lead to inefficient use of radio resources. Therefore, we formulate the RRM of RSMA as optimization problems to maximize respectively the weighted sum rate (WSR) and weighted energy efficiency (WEE), and jointly optimize the beamforming, user admission, discrete/continuous rates, accounting for imperfect SIC, which result in nonconvex mixed-integer nonlinear programs that are challenging to solve. Despite the difficulty of the optimization problems, we develop algorithms that can find high-quality solutions. We show via simulations that carefully accounting for the aforementioned characteristics, can lead to significant gains. Precisely, by considering that transmission rates are discrete, the transmit power can be utilized more intelligently, allocating just enough power to guarantee a given discrete rate. Additionally, we reveal that user admission plays a crucial role in RSMA, enabling additional gains compared to random admission by facilitating the servicing of selected users with mutually beneficial channel characteristics. Furthermore, provisioning for possibly imperfect SIC makes RSMA more robust and reliable.

Wi-Fi sensing applications have achieved remarkable results over the last decade, offering accurate device-free localization and gesture recognition capabilities. Indeed, Wi-Fi sensing has quickly become a critical field of research for future communication systems under the paradigm known as joint communication and sensing. However, device-free wireless sensing can also be exploited for malign purposes against unaware victims, and the omnipresence of Wi-Fi transceivers poses a significant threat to people’s privacy. Therefore, it is essential to develop functional solutions that can effectively thwart wireless sensing. All the current attempts to hinder illegitimate wireless sensing rely on specialized hardware deployed in the environment, but their cost and complexity can undermine widespread deployment. In this paper, we explore the possibility of using native capabilities of Wi-Fi systems, namely beamforming, to thwart wireless sensing. To this end, we propose for the first time a solution that enables complete control over the beamforming in commercial Wi-Fi devices. On top of that, we build BeamDancer, which randomizes beamforming vectors to inhibit channel fingerprinting. We empirically demonstrate the effectiveness of the proposed solution against three different wireless sensing techniques, both data-driven and model-based, while preserving almost entirely the legitimate Wi-Fi traffic at the same time.

Electric Vehicle (EV) charging involves a complex system with cyber-physical components, backend systems, and communication protocols. A potential security incident in this system can open up cyber-physical threats and, for instance, lead to EV battery fires or power grid blackouts. In this paper, we propose a hybrid Intrusion Detection System (IDS) method consisting of regression-based charging session forecasting and anomaly detection. The method considers an EV’s detailed charging behavior throughout a session and we discuss and evaluate different design choices. For anomaly detection, we consider both classification- and novelty-based models as well as an ensemble method to combine both models. We perform evaluations based on real-world EV charging session data with simulated attacks. Our results show that regression-based forecasting provides a significant increase in detection performance for attacks affecting individual reports during a charging session. Additionally, the proposed ensemble method, which combines artificial neural network-based classification and local outlier factor-based novelty detection, can maintain a low false alarm rate while offering good detection performance w.r.t. known attacks as well as generalization to previously unseen attacks. We thus argue that the proposed solution can provide a positive contribution to EV charging security, resilience, and trustworthiness.

Modern smartphones support FIDO2 passwordless authentication using either external security keys or internal biometric authentication, but it is unclear whether users appreciate and accept these new forms of web authentication for their own accounts. We present the first lab study (N=87) comparing platform and roaming authentication on smartphones, determining the practical strengths and weaknesses of FIDO2 as perceived by users in a mobile scenario. Most participants were willing to adopt passwordless authentication during our in-person user study, but closer analysis shows that participants prioritize usability, security, and availability differently depending on the account type. We identify remaining adoption barriers that prevent FIDO2 from succeeding password authentication, such as missing support for contemporary usage patterns, including account delegation and usage on multiple clients.

Wireless backhauling at millimeter-wave frequencies (mmWave) in static scenarios is a well-established practice in cellular networks. However, highly directional and adaptive beamforming in today’s mmWave systems have opened new possibilities for self-backhauling. Tapping into this potential, 3GPP has standardized Integrated Access and Backhaul (IAB) allowing the same base station to serve both access and backhaul traffic. Although much more cost-effective and flexible, resource allocation and path selection in IAB mmWave networks is a formidable task. To date, prior works have addressed this challenge through a plethora of classic optimization and learning methods, generally optimizing a Key Performance Indicator (KPI) such as throughput, latency, and fairness, and little attention has been paid to the reliability of the KPI. We propose Safehaul, a risk-averse learning-based solution for IAB mmWave networks. In addition to optimizing average performance, Safehaul ensures reliability by minimizing the losses in the tail of the performance distribution. We develop a novel simulator and show via extensive simulations that Safehaul not only reduces the latency by up to 43.2% compared to the benchmarks, but also exhibits significantly more reliable performance, e.g., 71.4% less variance in achieved latency.

We present a novel multi-hop data dissemination protocol for wireless networks that minimizes the total energy consumption across an entire network by minimizing the transmission power at each hop. It is based on a game-theoretic model, constructs a spanning tree topology in a decentralized manner, and is usable in practice. We evaluate the protocol via simulation and a pratical implementation on a testbed of 75 Raspberry Pis, demonstrating that a total energy reduction of up to 90% can be achieved compared to a simple broadcast protocol.

Smart home speakers have become a commodity item in many households and provide interesting research opportunities in areas like wireless communication and human-computer interaction. Commercial devices do not provide sufficient access for many research tasks. We present a modular smart home hub designed specifically for research purposes. The electronic and mechanical components are designed with reproducibility in mind and can be easily recombined for a project's needs. Additionally, we show applications of the hub in different scenarios.

Many websites contain services from third parties. Misconfigurations of these services can lead to missing compliance with legal obligations and privacy risks for website users. Previous research indicates that one cause for such privacy issues is missing awareness. However, reasons for the missing awareness and other reasons for the prevalence of privacy issues are not widely researched; that includes website owners’ dealing with those issues. To shed light on the issue, we analyze 1043 responses from website owners to a notification about a privacy issue on their website using thematic analysis, following an exploratory and qualitative approach. Our analysis shows that, next to unawareness of the issue, incorrect technical implementation and ambiguous responsibilities are among the reasons for privacy issues. Also, website owners face different challenges, such as a lack of knowledge or slow organizational coordination and processes. In addition, our results show that the circumstances in which they operate their website influences how they act and what challenges they face. To illustrate these differences in website owners, we derive three personas from our thematic analysis: (1) the Ignorant Hobbyist, (2) the Busy Self-Employed, and (3) the Informed Multi-Stakeholder. These personas cover the majority of the aspects of the analyzed responses and represent the diversity of website owners and their backgrounds. Given the challenges and backgrounds of website owners, we discuss which prerequisites must be fulfilled to remediate privacy issues on websites. Finally, we present measures that support website owners in remediating privacy issues and show how to adapt these measures to the needs of different website owners. We hope that better support for website owners will also lead to better privacy for website visitors.

Millimeter-wave self-backhauled small cells are a key component of next-generation wireless networks. Their dense deployment will increase data rates, reduce latency, and enable efficient data transport between the access and backhaul networks, providing greater flexibility not previously possible with optical fiber. Despite their high potential, operating dense self-backhauled networks optimally is an open challenge, particularly for radio resource management (RRM). This paper presents, RadiOrchestra, a holistic RRM framework that models and optimizes beamforming, rate selection as well as user association and admission control for self-backhauled networks. The framework is designed to account for practical challenges such as hardware limitations of base stations (e.g., computational capacity, discrete rates), the need for adaptability of backhaul links, and the presence of interference. Our framework is formulated as a nonconvex mixed-integer nonlinear program, which is challenging to solve. To approach this problem, we propose three algorithms that provide a trade-off between complexity and optimality. Furthermore, we derive upper and lower bounds to characterize the performance limits of the system. We evaluate the developed strategies in various scenarios, showing the feasibility of deploying practical self-backhauling in future networks.

This paper investigates rate-splitting (RS) precoding for non-orthogonal unicast and multicast (NOUM) transmissions using fully-digital and hybrid precoders. We study the nonconvex weighted sum-rate (WSR) maximization problem subject to a multicast requirement. We propose FALCON, an approach based on sequential parametric optimization, to solve the aforementioned problem. We show that FALCON converges to a local optimum without requiring judicious selection of an initial feasible point. Besides, we show through simulations that by leveraging RS, hybrid precoders can attain nearly the same performance as their fully-digital counterparts under certain specific settings.

Modern mobile devices feature multiple wireless technologies, such as Bluetooth, Wi-Fi, and LTE. Each of them is implemented within a separate wireless chip, sometimes packaged as combo chips. However, these chips share components and resources, such as the same antenna or wireless spectrum. Wireless coexistence interfaces enable them to schedule packets without collisions despite shared resources, essential to maximizing networking performance. Today's hardwired coexistence interfaces hinder clear security boundaries and separation between chips and chip components. This paper shows practical coexistence attacks on Broadcom, Cypress, and Silicon Labs chips deployed in billions of devices. For example, we demonstrate that a Bluetooth chip can directly extract network passwords and manipulate traffic on a Wi-Fi chip. Coexistence attacks enable a novel type of lateral privilege escalation across chip boundaries. We responsibly disclosed the vulnerabilities to the vendors. Yet, only partial fixes were released for existing hardware since wireless chips would need to be redesigned from the ground up to prevent the presented attacks on coexistence.

In 2021 OpenHaystack on macOS was the first step into liberating Apple's Find My technology to be integrated into any Bluetooth-capable device. By using custom firmware for microchips like the ESP32, it was possible to build custom trackable accessories similar to an Apple AirTag in size and functionality.

When an iPhone is turned off, most wireless chips stay on. For instance, upon user-initiated shutdown, the iPhone remains locatable via the Find My network. If the battery runs low, the iPhone shuts down automatically and enters a power reserve mode. Yet, users can still access credit cards, student passes, and other items in their Wallet. We analyze how Apple implements these standalone wireless features, working while iOS is not running, and determine their security boundaries. On recent iPhones, Bluetooth, Near Field Communication (NFC), and Ultra-wideband (UWB) keep running after power off, and all three wireless chips have direct access to the secure element. As a practical example what this means to security, we demonstrate the possibility to load malware onto a Bluetooth chip that is executed while the iPhone is off.

Finder networks in general, and Apple's Find My network in particular, can pose a grave threat to users' privacy and even health if these networks are abused for stalking. Apple's release of the AirTag-a very affordable tracker covered by the nearly ubiquitous Find My network-amplified this issue. While Apple provides a stalking detection feature within its ecosystem, billions of Android users are still left in the dark. Apple recently released the Android app "Tracker Detect," which does not deliver a convincing feature set for stalking protection. We reverse engineer Apple's tracking protection in iOS and discuss its features regarding stalking detection. We design "AirGuard" and release it as an Android app to protect against abuse by Apple tracking devices. We compare the performance of our solution with the Apple-provided one in iOS and study the use of AirGuard in the wild over multiple weeks using data contributed by tens of thousands of active users.

During disasters, existing telecommunication infrastructures are often congested or even destroyed. In these situations, mobile devices can form a backup communication network for civilians and emergency services using disruption-tolerant networking (DTN) principles. Unfortunately, such distributed and resource-constrained networks are particularly susceptible to a wide range of attacks such as terrorists trying to cause more harm. In this article, we presentRESCUE, a resilient and secure device-to-device communication framework for emergency scenarios that provides comprehensive protection against common attacks.RESCUEfeatures a minimalistic DTN protocol that, by design, is secure against notable attacks such as routing manipulations, dropping, message manipulations, blackholing, or impersonation. To further protect against message flooding and Sybil attacks, we present a twofold mitigation technique. First, a mobile and distributed certificate infrastructure particularly tailored to the emergency use case hinders the adversarial use of multiple identities. Second, a message buffer management scheme significantly increases resilience against flooding attacks, even if they originate from multiple identities, without introducing additional overhead. Finally, we demonstrate the effectiveness ofRESCUEvia large-scale simulations in a synthetic as well as a realistic natural disaster scenario. Our simulation results show thatRESCUEachieves very good message delivery rates, even under flooding and Sybil attacks.

Context-based copresence detection schemes are a necessary prerequisite to building secure and usable authentication systems in theInternet of Things (IoT). Such schemes allow one device to verify proximity of another device without user assistance utilizing their physical context (e.g., audio). The state-of-the-art copresence detection schemes suffer from two major limitations: (1) They cannot accurately detect copresence in low-entropy context (e.g., empty room with few events occurring) and insufficiently separated environments (e.g., adjacent rooms), (2) They require devices to have common sensors (e.g., microphones) to capture context, making them impractical on devices with heterogeneous sensors. We address these limitations, proposingNext2You, a novel copresence detection scheme utilizing channel state information (CSI). In particular, we leverage magnitude and phase values from a range of subcarriers specifying a Wi-Fi channel to capture a robust wireless context created when devices communicate. We implementNext2Youon off-the-shelf smartphones relying only on ubiquitous Wi-Fi chipsets and evaluate it based on over 95 hours of CSI measurements that we collect in five real-world scenarios.Next2Youachieves error rates below 4%, maintaining accurate copresence detection both in low-entropy context and insufficiently separated environments. We also demonstrate the capability ofNext2Youto work reliably in real-time and its robustness to various attacks.

The changing vulnerability and threat landscape constantly challenge the security of wireless communication standards and protocols. For the Internet of Things (IoT), LoRaWAN is one of the dominant technologies for urban environments, industrial settings, or critical infrastructures due to its low-power and long-range capabilities. LoRaWAN IoT deployments are expected to operate for multiple years or even decades. Hence, it is imperative to maintain operational security at all times while continuously evolving the security of the standard and its implementations. We survey LoRaWAN security and follow a systematic and evolvable approach that can be dynamically updated. To this end, we propose a novel methodology to create evolvable surveys which relate the analyzed critical security concepts, thus allowing IT security experts to reason about LoRaWAN security properties over time. With this, we provide a tool to hardware manufacturers, software developers and providers, and network operators to achieve sustainable security for IoT deployments.

In the era of large-scale internet scanning, misconfigured websites are a frequent cause of data leaks and security incidents. Previous research has investigated sending automated email notifications to operators of insecure or compromised websites, but has often met with limited success due to challenges in address data quality, spam filtering, and operator distrust and disinterest. While several studies have investigated the design and phrasing of notification emails in a bid to increase their effectiveness, the use of other contact channels has remained almost completely unexplored due to the required effort and cost. In this paper, we investigate two methods to increase notification success: the use of letters as an alternative delivery medium, and the description of attack scenarios to incentivize remediation. We evaluate these factors as part of a notification campaign utilizing manually-collected address information from 1359 German website operators and focusing on unintentional information leaks from web servers. We find that manually collected addresses lead to large increases in delivery rates compared to previous work, and letters were markedly more effective than emails, increasing remediation rates by up to 25 percentage points. Counterintuitively, providing detailed descriptions of possible attacks can actually decrease remediation rates, highlighting the need for more research into how notifications are perceived by recipients.

Researchers help operators of vulnerable and non-compliant internet services by individually notifying them about security and privacy issues uncovered in their research. To improve efficiency and effectiveness of such efforts, dedicated notification studies are imperative. As of today, there is no comprehensive documentation of pitfalls and best practices for conducting such notification studies, which limits validity of results and impedes reproducibility. Drawing on our experience with such studies and guidance from related work, we present a set of guidelines and practical recommendations, including initial data collection, sending of notifications, interacting with the recipients, and publishing the results. We note that future studies can especially benefit from extensive planning and automation of crucial processes, i. e., activities that take place well before the first notifications are sent.

Despite the growing interest in cross-technology communication, its application to real-world systems is still limited, as existing schemes are mostly unidirectional and technology-specific. The lack of generic solutions as well as the complexity of their integration reduces the applicability in a broader scope. In this paper, we propose a solution to augment Wi-Fi, BLE, and ZigBee devices with the ability to transmit and receive cross-technology broadcast frames alongside their existing functionality. After experimentally evaluating the performance of our solution on a variety of hardware platforms, we leverage it to build a gateway-free smart home, where a smartphone can simultaneously control heterogeneous smart objects. The smart objects, which include an off-the-shelf ZigBee light bulb and a BLE-enabled door lock from different vendors, perform cross-technology communication while retaining their original functionality and can maintain duty-cycled operations.

With the advent of the Internet of Things (IoT), establishing a secure channel between smart devices becomes crucial. Recent research proposes zero-interaction pairing (ZIP), which enables pairing without user assistance by utilizing devices' physical context (e.g., ambient audio) to obtain a shared secret key. The state-of-the-art ZIP schemes suffer from three limitations: (1) prolonged pairing time (i.e., minutes or hours), (2) vulnerability to brute-force offline attacks on a shared key, and (3) susceptibility to attacks caused by predictable context (e.g., replay attack) because they rely on limited entropy of physical context to protect a shared key. We address these limitations, proposing FastZIP, a novel ZIP scheme that significantly reduces pairing time while preventing offline and predictable context attacks. In particular, we adapt a recently introduced Fuzzy Password-Authenticated Key Exchange (fPAKE) protocol and utilize sensor fusion, maximizing their advantages. We instantiate FastZIP for intra-car device pairing to demonstrate its feasibility and show how the design of FastZIP can be adapted to other ZIP use cases. We implement FastZIP and evaluate it by driving four cars for a total of 800 km. We achieve up to three times shorter pairing time compared to the state-of-the-art ZIP schemes while assuring robust security with adversarial error rates below 0.5%.

The omnipresence of IoT devices in Industry 4.0 is expected to foster higher reliability, safety, and efficiency. However, interconnecting a large number of wireless devices without jeopardizing the system performance proves challenging. To address the requirements of future industries, we investigate the cross-layer design of beamforming and scheduling for layered-division multiplexing (LDM) systems in millimeter-wave bands. Scheduling is crucial as the devices in industrial settings are expected to proliferate rapidly. Also, highly performant beamforming is necessary to ensure scalability. By adopting LDM, multiple transmissions can be non-orthogonally superimposed. Specifically, we consider a superior-importance control multicast message required to be ubiquitous to all devices and inferior-importance private unicast messages targeting a subset of scheduled devices. Due to NP-hardness, we propose BEAMWAVE, which decomposes the problem into beamforming and scheduling. Through simulations, we show that BEAMWAVE attains nearoptimality and outperforms other competing schemes.

Bluetooth pairing establishes trust on first use between two devices by creating a shared key. Similar to certificate warnings in TLS, the Bluetooth specification requires warning users upon issues with this key, because this can indicate ongoing Machine-in-the-Middle (MitM) attacks. This paper uncovers that none of the major Bluetooth stacks warns users, which violates the specification. Clear warnings would protect users from recently published and potential future security issues in Bluetooth authentication and encryption.

Apple's file-sharing service AirDrop leaks phone numbers and email addresses by exchanging vulnerable hash values of the user's own contact identifiers during the authentication handshake with nearby devices. In a paper presented at USENIX Security'21, we theoretically describe two attacks to exploit these vulnerabilities and propose "PrivateDrop" as a privacy-preserving drop-in replacement for Apple's AirDrop protocol based on private set intersection.

OpenHaystack is an open-source framework for locating personal Bluetooth devices using Apple's Find My Network. A user can integrate it into Bluetooth-capable devices, such as notebooks, or create custom tracking accessories that can be attached to personal items (key rings, backpacks, etc.). We provide firmware images for the Nordic nRF5 chips and the ESP32. We show that they consume little energy and run from a single coin cell for a year. Our macOS application can locate personal accessories. Finally, we make both application and firmware available on GitHub.

Abstract Overnight, Apple has turned its hundreds-of-million-device ecosystem into the world’s largest crowd-sourced location tracking network called o~ine finding (OF). OF leverages online finder devices to detect the presence of missing o~ine devices using Bluetooth and report an approximate location back to the owner via the Internet. While OF is not the first system of its kind, it is the first to commit to strong privacy goals. In particular, OF aims to ensure finder anonymity, prevent tracking of owner devices, and confidentiality of location reports. This paper presents the first comprehensive security and privacy analysis of OF. To this end, we recover the specifications of the closed-source OF protocols by means of reverse engineering. We experimentally show that unauthorized access to the location reports allows for accurate device tracking and retrieving a user’s top locations with an error in the order of 10 meters in urban areas. While we find that OF’s design achieves its privacy goals, we discover two distinct design and implementation flaws that can lead to a location correlation attack and unauthorized access to the location history of the past seven days, which could deanonymize users. Apple has partially addressed the issues following our responsible disclosure. Finally, we make our research artifacts publicly available.

Wireless networks operating in the 60 GHz band have the potential to provide very high throughput but face a number of challenges (e.g., high attenuation, beam training, and coping with mobility) which are widely accepted but often not well understood in practice. Understanding these challenges, and especially their actual impact on consumer-grade hardware is fundamental to fully exploit the high physical layer rates in the 60 GHz band. To this end, we perform an extensive measurement campaign using two commercial off-the-shelf 60 GHz routers in real-world environments. Our results allow us to revisit a range of issues and provide much deeper insights into the reasons for specific performance compared to prior work on performance characterization. Further, our study goes beyond basic link characterization and explores for the first time practical considerations such as coverage and access point deployment. While some of our observations are expected, we also obtain highly surprising insights that challenge the prevailing wisdom in the community. We derive the shortcomings of current commercial 60 GHz devices, and the fundamental problems that remain open on the way to fast and efficient 60 GHz networking.

Achieving low latency remains a challenge in today's industrial Internet of Things (IoT) applications, particularly if operated over wireless multi-hop networks. One idea that can distinctly reduce the multi-hop latency is the so-called cut-through forwarding, i.e., a node starts relaying a packet after it has only received a fraction of it by leveraging two radios. This paper proposes the novel concurrent wireless cut-through (CWCT) protocol based on a prototype design which combines two off-the- shelf IoT devices. To improve reliability and eliminate routing overhead, CWCT applies concurrent transmission and Golay error correction coding. Evaluation on a controlled topology and on a medium-size testbed shows the large reduction in latency of CWCT compared to Glossy and the high synchronicity of concurrent transmission. To further improve packet reliability, we need to reduce the out-of-band leakage.

Cyclically shifted partial transmit sequences (CS-PTS) has conventionally been used in SISO systems for PAPR reduction of OFDM signals. Compared to other techniques, CS-PTS attains superior performance. Nevertheless, due to the exhaustive search requirement, it demands excessive computational complexity. In this paper, we adapt CS-PTS to operate in a MIMO framework, where singular value decomposition (SVD) precoding is employed. We also propose SWAN, a novel optimization method based on swarm intelligence to circumvent the exhaustive search. SWAN not only provides a significant reduction in computational complexity, but it also attains a fair balance between optimality and complexity. Through simulations, we show that SWAN achieves near-optimal performance at a much lower complexity than other competing approaches.

Industry 4.0 anticipates massive interconnectivity of industrial devices (e.g., sensors, actuators) to support factory automation and production. Due to the rigidity of wired connections to harmonize with automation, wireless information transfer has attracted substantial attention. However, existing solutions for the manufacturing sector face critical issues in coping with the key performance demands: ultra-low latency, high throughput, and high reliability. Besides, recent advancements in wireless millimeter-wave technology advocates hybrid precoding with affordable hardware and outstanding spatial multiplexing performance. Thus, we present HYDRAWAVE - a new paradigm that contemplates the joint design of group scheduling and hybrid precoding for multi-group multicasting to support ubiquitous low-latency communications. Our hybrid precoder, based on semidefinite relaxation and Cholesky matrix factorization, facilitates the robust design of the constant-modulus phase shifts rendering formidable performance at a fraction of the power required by fully-digital precoders. Further, our novel group scheduling formulation minimizes the number of scheduling windows while accounting for the channel correlation of the co-scheduled multicast receivers. Compared to exhaustive search, which renders the optimal scheduling at high overhead, HYDRAWAVE incursonly 9.5% more delay. Notoriously, HYDRAWAVE attains up to 102% gain when compared to the other benchmarked schemes.

Millimeter-wave (mmWave) communication plays a vital role in disseminating large volumes of data in beyond-5G networks efficiently. Unfortunately, the directionality of mmWave communication significantly complicates efficient data dissemination, particularly in multicasting, which is gaining more and more importance in emerging applications (e.g., V2X, public safety, massive IoT). While multicasting for systems operating at lower frequencies (i.e., sub-6GHz) has been extensively studied, they are sub-optimal for mmWave systems as mmWave has significantly different propagation characteristics, i.e., using the directional transmission to compensate for the high path loss and thus promoting spectrum sharing. In this paper, we propose novel multicast scheduling algorithms by jointly exploiting relaying and spatial sharing gains while aiming to minimize the multicast completion time. We first characterize the problem with a comprehensive model and formulate it with an integer linear program (ILP). We further design a practical and scalable semi-distributed algorithm named mmDiMu, based on gradually maximizing the transmission throughput over time. Finally, we carry out validation through extensive simulations in different scales, and the results show that mmDiMu significantly outperforms conventional algorithms with around 95% reduction on multicast completion time.

IoT devices penetrate different aspects of our life including critical services, such as health monitoring, public safety, and autonomous driving. Such safety-critical IoT systems often consist of a large number of devices and need to withstand a vast range of known Denial-of-Service (DoS) network attacks to ensure a reliable operation while offering low-latency information dissemination. As the first solution to jointly achieve these goals, we propose LIDOR, a secure and lightweight multihop communication protocol designed to withstand all known variants of packet dropping attacks. Specifically, LIDOR relies on an end-to-end feedback mechanism to detect and react on unreliable links and draws solely on efficient symmetric-key cryptographic mechanisms to protect packets in transit. We show the overhead of LIDOR analytically and provide the proof of convergence for LIDOR which makes LIDOR resilient even to strong and hard-to-detect wormhole-supported grayhole attacks. In addition, we evaluate the performance via testbed experiments. The results indicate that LIDOR improves the reliability under DoS attacks by up to 91% and reduces network overhead by 32% compared to a state-of-the-art benchmark scheme.

In recent years, the ubiquitous nature of Internet-of-Things (IoT) applications as well as the pervasive character of next-generation communication protocols, such as the 5G technology, have become widely evident. In this work, we identify the need for low-cost security in current and next-generation IoT networks and address this demand through the implementation, testing, and validation of an intrinsic low-cost and low-overhead hardware-based security primitive within an inherent network component. In particular, an intrinsic Physical Unclonable Function (PUF) is implemented in the peripheral network module of a tri-band commercial off-the-shelf router. Subsequently, we demonstrate the robustness of this PUF to ambient temperature variations and to limited natural aging, and examine in detail its potential for securing the next generation of IoT networks and other applications. Finally, the security of the proposed PUF-based schemes is briefly assessed and discussed.

Millimeter-wave (mmWave) communication is a promising technology to cope with the exponential increase in 5G data traffic. Such networks typically require a very dense deployment of base stations. A subset of those, so-called macro base stations, feature high-bandwidth connection to the core network, while relay base stations are connected wirelessly. To reduce cost and increase flexibility, wireless backhauling is needed to connect both macro to relay as well as relay to relay base stations. The characteristics of mmWave communication mandates new paradigms for routing and scheduling. The paper investigates scheduling algorithms under different interference models. To showcase the scheduling methods, we study the maximum throughput fair scheduling problem. Yet the proposed algorithms can be easily extended to other problems. For a full-duplex network under the no interference model, we propose an efficient polynomial-time scheduling method, the schedule-oriented optimization. Further, we prove that the problem is NP-hard if we assume pairwise link interference model or half-duplex radios. Fractional weighted coloring based approximation algorithms are proposed for these NP-hard cases. Moreover, the approximation algorithm parallel data stream scheduling is proposed for the case of half-duplex network under the no interference model. It has better approximation ratio than the fractional weighted coloring based algorithms and even attains the optimal solution for the special case of uniform orthogonal backhaul networks.

Multicast beamforming is known to improve spectral efficiency. However, its benefits and challenges for hybrid precoders design in millimeter-wave (mmWave) systems remain understudied. To this end, this paper investigates the first joint design of hybrid transmit precoders (with an arbitrary number of finite-resolution phase shifts) and receive combiners for mmWave multi-group multicasting. Our proposed design leverages semidefinite relaxation (SDR), alternating optimization and Cholesky matrix factorization to sequentially optimize the digital/analog precoders at the transmitter and the combiners at each receiver. By considering receivers with multiple-antenna architecture, our design remarkably improves the overall system performance. Specifically, with only two receive antennas the average transmit power per received message improves by 16.8% while the successful information reception is boosted by 60%. We demonstrate by means of extensive simulations that our hybrid precoder design performs very close to its fully-digital counterpart even under challenging scenarios (i.e., when co-located users belong to distinct multicast groups).

Wireless networks based on Bluetooth mesh (BM) promise a variety of Internet of Things applications from health-care monitoring to smart buildings. BM introduces a novel network concept that supports up to 32767 devices and 127 hops. So far no readily available dataset or toolset exists to perform systematic in-depth performance analysis of this standard. In this paper, we present insights on the performance and practical usability of BM. We conduct realistic smart office experiments with heterogeneous devices distributed throughout an area of approximately 1100m2. By varying network parameters and BM node features, we collect the first public available BM dataset. Based on our experience, the use of current implementations is error-prone due to the complexity of BM. To facilitate researchers to conduct further experiments, we propose a toolset to configure and systematically evaluate BM performance. Finally we discuss several pitfalls that should be avoided in designing and deploying such networks.

Bluetooth is one of the most established technologies for short range digital wireless data transmission. With the advent of wearables and the Internet of Things (IoT), Bluetooth has again gained importance, which makes security research and protocol optimizations imperative. Surprisingly, there is a lack of openly available tools and experimental platforms to scrutinize Bluetooth. In particular, system aspects and close to hardware protocol layers are mostly uncovered. We reverse engineer multiple Broadcom Bluetooth chipsets that are widespread in off-the-shelf devices. Thus, we offer deep insights into the internal architecture of a popular commercial family of Bluetooth controllers used in smartphones, wearables, and IoT platforms. Reverse engineered functions can then be altered with our InternalBlue Python framework---outperforming evaluation kits, which are limited to documented and vendor-defined functions. The modified Bluetooth stack remains fully functional and high-performance. Hence, it provides a portable low-cost research platform. InternalBlue is a versatile framework and we demonstrate its abilities by implementing tests and demos for known Bluetooth vulnerabilities. Moreover, we discover a novel critical security issue affecting a large selection of Broadcom chipsets that allows executing code within the attacked Bluetooth firmware. We further show how to use our framework to fix bugs in chipsets out of vendor support and how to add new security features to Bluetooth firmware.

Bluetooth is among the dominant standards for wireless short-range communication with multi-billion Bluetooth devices shipped each year. Basic Bluetooth analysis inside consumer hardware such as smartphones can be accomplished observing the Host Controller Interface (HCI) between the operating system's driver and the Bluetooth chip. However, the HCI does not provide insights to tasks running inside a Bluetooth chip or Link Layer (LL) packets exchanged over the air. As of today, consumer hardware internal behavior can only be observed with external, and often expensive tools, that need to be present during initial device pairing. In this paper, we leverage standard smartphones for on-device Bluetooth analysis and reverse engineer a diagnostic protocol that resides inside Broadcom chips. Diagnostic features include sniffing lower layers such as LL for Classic Bluetooth and Bluetooth Low Energy (BLE), transmission and reception statistics, test mode, and memory peek and poke.

The complexity of the mode selection and resource allocation (MS&RA) problem has hampered the commercialization progress of Device-to-Device (D2D) communication in 5G networks. Furthermore, the combinatorial nature of MS&RA has forced the majority of existing proposals to focus on constrained scenarios or offline solutions to contain the size of the problem. Given the real-time constraints in actual deployments, a reduction in computational complexity is necessary. Adaptability is another key requirement for mobile networks that are exposed to constant changes such as channel quality fluctuations and mobility. In this article, we propose an online learning technique (i.e., CBMoS) which leverages combinatorial multi-armed bandits (CMAB) to tackle the combinatorial nature of MS&RA. Furthermore, our two-stage CMAB design results in a tight model, which eliminates the theoretically feasible but practicality invalid options from the solution space. We prototype the first SDR-based D2D testbed to verify the performance of CBMoS under real-world conditions. The simulations confirm that the fast learning speed of CBMoS leads to outperforming the benchmark schemes by up to 132%. In experiments, CBMoS exhibits even higher performance (up to 142%) than in the simulations. This stems from the adaptability/fast learning speed of CBMoS in presence of high channel dynamics which cannot be captured via statistical channel models used in the simulators.

Millimeter-wave (mmWave) backhauling is key to ultra-dense deployments in beyond-5G networks because providing every base station with a dedicated fiber-optic backhaul link to the core network is technically too complicated and economically too costly. Self-backhauling allows the operators to provide fiber connectivity only to a small subset of base stations (Fiber-BSs), whereas the rest of the base stations reach the core network via a (multi-hop) wireless link towards the Fiber-BS. Although a very attractive architecture, self-backhauling is proven to be an NP-hard route selection and resource allocation problem. The existing self-backhauling solutions lack practicality because:$(i)$they require solving a fairly complex combinatorial problem every time there is a change in the network (e.g., channel fluctuations), or$(ii)$they ignore the impact of network dynamics which are inherent to mobile networks. In this article, we propose SCAROS which is a semi-distributed learning algorithm that aims at minimizing the end-to-end latency as well as enhancing the robustness against network dynamics including load imbalance, channel variations, and link failures. We benchmark SCAROS against state-of-the-art approaches under a real-world deployment scenario in Manhattan and using realistic beam patterns obtained from off-the-shelf mmWave devices. The evaluation demonstrates that SCAROS achieves the lowest latency, at least$1.8\times $higher throughput, and the highest flexibility against variability or link failures in the system.

Countless novel approaches to communication protocols, overlay networks, and distributed middleware are published every year, yet the adoption of such novel findings in the global Internet landscape progresses at a slow pace. Many of such new communication mechanisms excel (only) under specific deployment conditions, while user mobility and application usage patterns lead to dynamic operation conditions. This mismatch is one reason that makes a wide deployment of new specialized mechanisms particularly hard as observed, for example, for multipath transport protocol extensions until the emergence of multipath transmission control protocol (TCP). This paper formalizes the concept of Transitions, i.e., a method to instrumentalize adaptivity at runtime in communication systems. It allows to exchange communication mechanisms in a running system to optimize the communication quality. In the following, we describe the building blocks required to: 1) capture the features and relations within a communication system and 2) express and optimize the decision making process in such a system. We show how this concept maps intuitively to the Internet model which makes a protocol-independent deployment of applications feasible in the future Internet.

Millimeter-Wave (mmWave) bands have become the de-facto candidate for 5G vehicle-to-everything (V2X) since future vehicular systems demand Gbps links to acquire the necessary sensory information for (semi)-autonomous driving. Nevertheless, the directionality of mmWave communications and its susceptibility to blockage raise severe questions on the feasibility of mmWave vehicular communications. The dynamic nature of 5G vehicular scenarios, and the complexity of directional mmWave communication calls for higher context-awareness and adaptability. To this aim, we propose the first online learning algorithm addressing the problem of beam selection with environment-awareness in mmWave vehicular systems. In particular, we model this problem as a contextual multi-armed bandit problem. Next, we propose a lightweight context-aware online learning algorithm, namely FML, with proven performance bound and guaranteed convergence. FML exploits coarse user location information and aggregates received data to learn from and adapt to its environment. We also perform an extensive evaluation using realistic traffic patterns derived from Google Maps. Our evaluation shows that FML enables mmWave base stations to achieve near-optimal performance on average within 33 minutes of deployment by learning from the available context. Moreover, FML remains within ~ 5% of the optimal performance by swift adaptation to system changes such as blockage and traffic.

Millimeter-wave (mmWave) communication is a promising technology to cope with the expected exponential increase in data traffic in 5G networks. mmWave networks typically require a very dense deployment of mmWave base stations (mmBS). To reduce cost and increase flexibility, wireless backhauling is needed to connect the mmBSs. The characteristics of mmWave communication, and specifically its high directionality, imply new requirements for efficient routing and scheduling paradigms. We propose an efficient scheduling method, so-called schedule-oriented optimization, based on matching theory that optimizes QoS metrics jointly with routing. It is capable of solving any scheduling problem that can be formulated as a linear program whose variables are link times and QoS metrics. As an example of the schedule-oriented optimization, we show the optimal solution of the maximum throughput fair scheduling (MTFS). Practically, the optimal scheduling can be obtained even for networks with over 200 mmBSs. To further increase the runtime performance, we propose an efficient edge-coloring based approximation algorithm with provable performance bound. It achieves over 80% of the optimal max-min throughput and runs 5 to 100 times faster than the optimal algorithm in practice. Finally, we extend the optimal and approximation algorithms for the cases of multi-RF-chain mmBSs and integrated backhaul and access networks.

Practical solutions to bootstrap security in today's information and communication systems critically depend on centralized services for authentication as well as key and trust management. This is particularly true for mobile users. Identity providers such as Google or Facebook have active user bases of two billion each, and the subscriber number of mobile operators exceeds five billion unique users as of early 2018. If these centralized services go completely 'dark' due to natural or man made disasters, large scale blackouts, or country-wide censorship, the users are left without practical solutions to bootstrap security on their mobile devices. Existing distributed solutions, for instance, the so-called web-of-trust are not sufficiently lightweight. Furthermore, they support neither cross-application on mobile devices nor strong protection of key material using hardware security modules. We propose Sea of Lights (SOL), a practical lightweight scheme for bootstrapping device-to-device security wirelessly, thus, enabling secure distributed self-organized networks. It is tailored to operate `in the dark' and provides strong protection of key material as well as an intuitive means to build a lightweight web-of-trust. SOL is particularly well suited for local or urban operation in scenarios such as the coordination of emergency response, where it helps containing/limiting the spreading of misinformation. As a proof of concept, we implement SOL in the Android platform and hence test its feasibility on real mobile devices. We further evaluate its key performance aspects using simulation.

Beamforming is vital to overcome the high attenuation in wireless millimeter-wave networks. It enables nodes to steer their antennas in the direction of communication. To cope with complexity and overhead, the IEEE 802.11ad standard uses a sector codebook with distinct steering directions. In current off-the-shelf devices, we find codebooks with generic pre-defined beam patterns. While this approach is simple and robust, the antenna modules that are typically deployed in such devices are capable of generating much more precise antenna beams. In this paper, we adaptively adjust the sector codebook of IEEE 802.11ad devices to optimize the transmit beam patterns for the current channel. To achieve this, we propose a mechanism to extract full channel state information (CSI) regarding phase and magnitude from coarse signal strength readings on off-the-shelf IEEE 802.11ad devices. Since such devices do not expose the CSI directly, we generate a codebook with phase-shifted probing beams that enables us to obtain the CSI by combining strategically selected magnitude measurements. Using this CSI, transmitters dynamically compute a transmit beam pattern that maximizes the signal strength at the receiver. Thereby, we automatically exploit reflectors in the environment and improve the received signal quality. Our implementation of this mechanism on off-the-shelf devices demonstrates that adaptive codebook optimization achieves a significantly higher throughput of about a factor of two in typical real-world scenarios.

Apple Wireless Direct Link (AWDL) is a proprietary and undocumented IEEE 802.11-based ad hoc protocol. Apple first introduced AWDL around 2014 and has since integrated it into its entire product line, including iPhone and Mac. While we have found that AWDL drives popular applications such as AirPlay and AirDrop on more than one billion end-user devices, neither the protocol itself nor potential security and Wi-Fi coexistence issues have been studied. In this paper, we present the operation of the protocol as the result of binary and runtime analysis. In short, each AWDL node announces a sequence of Availability Windows (AWs) indicating its readiness to communicate with other AWDL nodes. An elected master node synchronizes these sequences. Outside the AWs, nodes can tune their Wi-Fi radio to a different channel to communicate with an access point, or could turn it off to save energy. Based on our analysis, we conduct experiments to study the master election process, synchronization accuracy, channel hopping dynamics, and achievable throughput. We conduct a preliminary security assessment and publish an open source Wireshark dissector for AWDL to nourish future work.

Apple Wireless Direct Link (AWDL) is a proprietary and undocumented wireless ad hoc protocol that Apple introduced around 2014 and which is the base for applications such as AirDrop and AirPlay. We have reverse engineered the protocol and explain its frame format and operation in our MobiCom '18 paper "One Billion Apples' Secret Sauce: Recipe of the Apple Wireless Direct Link Ad hoc Protocol." AWDL builds on the IEEE 802.11 standard and implements election, synchronization, and channel hopping mechanisms on top of it. Furthermore, AWDL features an IPv6-based data path which enables direct communication. To validate our own work, we implement a working prototype of AWDL on Linux-based systems. Our implementation is written in C, runs in userspace, and makes use of Linux's Netlink API for interactions with the system's networking stack and the pcap library for frame injection and reception. In our demonstrator, we show how our Linux system synchronizes to an existing AWDL cluster or takes over the master role itself. Furthermore, it can receive data frames from and send them to a MacBook or iPhone via AWDL. We demonstrate the data exchange via ICMPv6 echo request and replies as well as sending and receiving data over a TCP connection.

Wi-Fi chips offer vast capabilities, which are not accessible through the manufacturers' official firmwares. Unleashing those capabilities can enable innovative applications on off-the-shelf devices. In this work, we demonstrate how to transmit raw IQ samples from a large buffer on Wi-Fi chips. We further show how to extract channel state information (CSI) on a per frame basis. As a proof-of-concept application, we build a covert channel on top of Wi-Fi to stealthily exchange information between two devices by prefiltering Wi-Fi frames prior to transmission. On the receiver side, the CSI is used to extract the embedded information. By means of experimentation, we show that regular Wi-Fi clients can still demodulate the underlying Wi-Fi frames. Our results show that covert channels on the physical layer are practical and run on off-the-shelf smartphones. By making available our raw signal transmitter, the CSI extractor, and the covert channel application to the research community, we ensure reproducibility and offer a platform for further innovative applications on Wi-Fi devices.

Wireless networks operating in the 60 GHz band have the potential to provide very high throughput but face a number of challenges (e.g., high attenuation, beam training, and coping with mobility) which are widely accepted but often not well understood in practice. Understanding these challenges, and especially their actual impact on consumer-grade hardware is fundamental to fully exploit the high physical layer rates in the 60 GHz band. To this end, we perform an extensive measurement campaign using two commercial off-the-shelf 60 GHz routers in practical real-world environments. Our study is centered around two fundamental adaptation mechanisms in 60 GHz networks-beam training and rate control- whose interactions are key for performance. Understanding these interactions allows us to revisit a range of issues and provide much deeper insights into the reasons for specific performance compared to prior work on performance characterization. Further, our study goes beyond basic link characterization and explores for the first time practical considerations such as coverage and access point deployment. While some of our observations are expected, we also obtain highly surprising insights that challenge the prevailing wisdom in the community.

Millimeter-wave (mm-wave) communication systems provide high data-rates and enable emerging application scenarios, such as 'information showers' for location-based services. Devices are equipped with antenna arrays using dozens of elements to achieve high directionality and thus creating a signal beam that focuses only on a specific area-of-interest. This new communication paradigm of steerable links requires a rethinking of wireless networks and calls for efficient protocols to train the beam alignment among network nodes. The IEEE 802.1 lad standard defines the so-called sector sweep that sweeps through a predefined set of antenna-sectors to find the optimal antenna steerings. Such low-layer protocols lack proper security mechanisms and open unprecedented attack possibilities. Distant attackers might tamper with the beam-training and literally 'steal' the beam from other devices. In this work, we investigate the threat of such beam-stealing attacks that intercept the sector sweep. By injecting forged feedback, we force victims to steer their signals towards the attacker's location. We implement a proof-of-concept on commercial off-the-shelf devices and evaluate the impacts on eavesdropping and acting as a Man-in-the-Middle (MITM). Our practical experiments in typical indoor scenarios reveal that beam-stealing increases the eavesdropping performance by 38% and allow a MITM to relay packets with an average error of only 1%. With these results, we emphasize the threat of beam-training attacks on mm-wave networks and aim to raise the awareness of attack vectors that are emerging with new low-layer amendments in next-generation wireless networks.

Millimeter-Wave (mmWave) bands have become the de-facto candidate for 5G vehicle-to-everything (V2X) since future vehicular systems demand Gbps links to acquire the necessary sensory information for (semi)-autonomous driving. Nevertheless, the directionality of mmWave communications and its susceptibility to blockage raise severe questions on the feasibility of mmWave vehicular communications. The dynamic nature of 5G vehicular scenarios and the complexity of directional mmWave communication calls for higher context-awareness and adaptability. To this aim, we propose an online learning algorithm addressing the problem of beam selection with environment-awareness in mmWave vehicular systems. In particular, we model this problem as a contextual multi-armed bandit problem. Next, we propose a lightweight context-aware online learning algorithm, namely fast machine learning (FML), with proven performance bound and guaranteed convergence. FML exploits coarse user location information and aggregates the received data to learn from and adapt to its environment. Furthermore, we demonstrate the feasibility of a real-world implementation of FML by proposing a standard-compliant protocol based on the existing architecture of cellular networks and the forthcoming features of 5G. We also perform an extensive evaluation using realistic traffic patterns derived from Google Maps. Our evaluation shows that FML enables mmWave base stations to achieve near-optimal performance on average within 33 mins of deployment by learning from the available context. Moreover, FML remains within ~ 5% of the optimal performance by swift adaptation to system changes (i.e., blockage, traffic).

Achieving data-rates of multiple Gbps in 60 GHz millimeter-wave (mm-wave) communication systems requires efficient beam-steering algorithms. To find the optimal steering direction on IEEE 802.11ad compatible devices, state-of-the-art approaches sweep through all predefined antenna sectors. Recently, much more efficient alternatives, such as compressive path tracking, have been proposed, which scale well even with arrays with thousands of antenna elements. However, such have not yet been integrated into consumer devices. In this work, we adapt compressive path tracking for sector selection in off-the-shelf IEEE 802.1 lad devices. In contrast to existing solutions, our compressive sector selection tolerates the imperfections of low-cost hardware, tracks beam directions in 3D and does not rely on pseudo-random beams. We implement our protocol on a commodity router, the TP-Link Talon AD7200, by modifying the sector sweep algorithm in the IEEE 802.11ad chip's firmware. In particular, we modify the firmware to obtain the signal strength of received frames and to select custom sectors. Using this extension, we precisely measure the device's sector patterns. We then select the best sector based on the measured patterns and sweep only through a subset of probing sectors. Our results demonstrate, that our protocol outperforms the existing sector sweep, increases stability, and speeds up the sector selection by factor 2.3.

Software-defined networking paradigms have found their way into wireless edge networks, allowing network slicing, mobility management, and resource allocation. This paper presents dynamic role assignment as a novel approach to software-defined network topology management for wireless edge devices, such as laptops, tablets and smartphones. It combines the centralized control of wireless Network Interface Controller (NIC) modes with Network Function Virtualization (NFV) to integrate network topology transitions as well as network service and application service placement within a single mechanism. Our proposal is evaluated with respect to latency, bandwidth, and power consumption of the edge nodes. The experimental results show significant differences in both bandwidth (up to 18%) and power consumption (up to 15%) for playing different roles, and when using (a) a web proxy and (b) an intrusion prevention system as examples of application services.

The resource-constrained nature of sensor nodes makes wireless sensor networks (WSNs) especially susceptible to denial-of-service (DoS) attacks. Due to the wireless communication medium, it is difficult to prevent attacks such as jamming. Hence, mechanisms to detect attacks during operation are required. The current generation of intrusion detection systems are still rather heavyweight, as some form of collaboration is typically needed. In this paper, we study the behavior of a large number of node-centric metrics under jamming and blackhole attacks, by applying a logistic regression. In our experiments, we vary several parameters, such as traffic intensity, transmission power, and attacker location. We consider the most common topologies in wireless sensor networks such as central data collection and meshed multi-hop networks by using the collection tree and the mesh protocol. The created regression models are then used to implement a fully localized intrusion detection system requiring no collaboration, showing that certain models can be generalized to different networks.

To cope with the varying delay and bandwidth requirements of today's mobile applications, mobile wireless networks can profit from classifying and predicting mobile application traffic. State-of-the-art traffic classification approaches have various disadvantages: port-based classification methods can be circumvented by choosing non-standard ports, protocol fingerprinting can be confused by the use of encryption, and current supervised learning methods for analyzing the statistical properties of network flows try to detect predefined classes, such as e-mail or FTP traffic, learned during training. In this paper, we present a novel approach to unsupervised traffic flow classification using statistical properties of flows and clustering based on a neural auto encoder. A novel time interval based feature vector construction and a semi-automatic cluster labeling method facilitate traffic flow classification independent of known traffic classes. An experimental evaluation on real data captured over a period of four months is presented. The obtained results show that 7 different classes of mobile traffic flows are detected with an average precision of 80% and an average recall of 75%.

During disasters, existing telecommunication infrastructures are often congested or even destroyed. In these situations, mobile devices can be interconnected using wireless ad hoc and disruption-tolerant networking to establish a backup emergency communication system for civilians and emergency services. However, such communication systems entail serious security risks, since adversaries may attempt to steal confidential data, fake notifications of emergency services, or perform denial-of-service (DoS) attacks. In this paper, we present SEDCOS, a secure device-to-device communication system for disaster scenarios. SEDCOS allows new users to join the network during disasters, mitigates flooding DoS attacks, and offers role revocation for detected adversaries to withdraw their permissions and exclude them from group communication. SEDCOS mitigates flooding DoS attacks and offers role revocation for detected adversaries to withdraw their permissions and exclude them from group communication. SEDCOS mitigates flooding DoS attacks and offers role revocation for detected adversaries to withdraw their permissions. We demonstrate the effectiveness of SEDCOS by large-scale network simulations.

We propose a privacy preserving mobile advertising system for in-app ad placement, that enables user profiling and targeted ads without revealing user interests to the mobile advertising companies. Our proposal relies on device-based user profiles, derived from app activity, on the use of Private Information Retrieval (PIR) to query ads database(s) for matching (to profile) ads, without the database(s) learning the content or the result of queries. We implement a Proof of Concept (POC) solution comprising critical system components for Android devices, including the profile builder and the PIR mechanism based on Percy++ library (ported to Android). We evaluate the practicality of selected PIR techniques in a mobile ads system using measured real world parameters. Overall, we show that a mobile PIR client can be effectively used for private advertising: for a single client connecting to a desktop PIR server, the Information theoretic (IT) and Hybrid PIR mechanisms allow close to real time ad retrieval. E.g., when querying a 1GB ad database for a block of 4 ads (total of 64KB), the ads are retrieved with a delay of around 2.5sec and utilising (for IT PIR) 1.25MB of data. The selected Computational PIR mechanism, however, introduces unacceptable overheads (the delay is of the order of 1300sec and 9.4GB of data is exchanged between the Android client and server for the same ad block). Further multi-client scalability tests indicate that, for all schemes, the server side is a performance bottleneck and, in addition to using commercial grade equipment, implementation enhancements including parallel processing would be necessary to have close to real time system responsiveness.

Delay/Disruption-Tolerant Networks (DTNs) have been around for more than a decade and have especially been proposed to be used in scenarios where communication infrastructure is unavailable. In such scenarios, DTNs can offer a best-effort communication service by exploiting user mobility. Natural disasters are an important application scenario for DTNs when the cellular network is destroyed by natural forces. To assess the performance of such networks before deployment, we require appropriate knowledge of human mobility. In this paper, we address this problem by designing, implementing, and evaluating a novel mobility model for large-scale natural disasters. Due to the lack of GPS traces, we reverse-engineer human mobility of past natural disasters (focusing on 2010 Haiti earthquake and 2013 Typhoon Haiyan) by leveraging knowledge of 126 experts from 71 Disaster Response Organizations (DROs). By means of simulation-based experiments, we compare and contrast our mobility model to other well-known models, and evaluate their impact on DTN performance. Finally, we make our source code available to the public.

While radio-based indoor localization schemes achieve decimeter-scale accuracy, they typically require precise reference measurements, multiple infrastructure nodes, or a multi-RF-chain anchor. In this paper, we propose Pseudo LATeration (PLAT), an indoor localization protocol that requires only a single RF chain infrastructure anchor and does not require prior knowledge of the environment. PLAT leverages the directionality and propagation characteristics of millimeter-wave transmissions to relax the requirement of multiple infrastructure anchors and RF chains by constructing pseudo anchors from reflected signal paths. By combining these pseudo anchors with time-of-flight measurements for distance estimation, PLAT can localize a user's device in indoors. Our evaluation reveals centimeter scale location accuracy for typical office environments. In testbed measurements and simulations, localization errors are centimeter scale for distances up to 1.5 m and beamwidths at or below 8.6 degrees. Although accuracy decreases to decimeter scale with additional propagation distance, we show that multiple reflection paths can mitigate this effect.

Reactive Wi-Fi jammers on off-the-shelf hardware that may facilitate mobile friendly jamming applications have only been shown recently. Until now, no demonstrators existed to reproduce the results obtained with these systems, hence, inhibiting re-use for further research or educational applications. In this work, we present an Android app that allows to create advanced jamming scenarios with four Nexus 5 smartphones. We use two of them to inject Wi-Fi frames with UDP payload, one to receive frames and analyze if they were corrupted and one that acts as a reactive jammer that selectively jams according to a UDP port. The user can choose between a simple reactive jammer and an acknowledging jammer. All jammers are implemented as Wi-Fi firmware patches by using the Nexmon framework. During the demonstration, users may adjust parameters of transmitted frames and observe the throughputs of correct and corrupted frames as bar graphs at the receiver. At the jamming node, users may design an arbitrary jamming signal in the frequency domain and adjust the jamming power, the target UDP port and the jammer type. The MAC addresses used during the experiments are hard coded to hinder users from simply abusing the app in other setups. Overall, the demonstration proofs that highly sophisticated Wi-Fi jammers can run on smartphones.

It is not commonly known that off-the-shelf smartphones can be converted into versatile jammers. To understand how those jammers work and how well they perform, we implemented a jamming firmware for the Nexus 5 smartphone. The firmware runs on the real-time processor of the Wi-Fi chip and allows to reactively jam Wi-Fi networks in the 2.4 and 5 GHz bands using arbitrary waveforms stored in IQ sample buffers. This allows us to generate a pilot-tone jammer on off-the-shelf hardware. Besides a simple reactive jammer, we implemented a new acknowledging jammer that selectively jams only targeted data streams of a node while keeping other data streams of the same node flowing. To lower the increased power consumption of this jammer, we implemented an adaptive power control algorithm. We evaluated our implementations in friendly jamming scenarios to oppress non-compliant Wi-Fi transmissions and to protect otherwise vulnerable devices in industrial setups. Our results show that we can selectively hinder Wi-Fi transmissions in the vicinity of our jamming smartphone leading to an increased throughput for other nodes or no blockage of non-targeted streams on a jammed node. Consuming less than 300 mW when operating the reactive jammer allows mobile operation for more than 29 hours. Our implementation demonstrates that jamming communications was never that simple and available for every smartphone owner, while still allowing surgical jamming precision and energy efficiency. Nevertheless, it involves the danger of abuse by malicious attackers that may take over hundreds of devices to massively jam Wi-Fi networks in wide areas.

Proximity services are widely used in mobile applications for fast and easy data transfer and control of various systems within a defined range. Authorization is achieved by proximity detection mechanisms that surrogate extensive pairing processes. In this work, we present our Nearby Distance Fraud Framework (NeDiFF) to investigate distance fraud on various proximity services. NeDiFF cheats on proximity checks in services as Google Nearby Messages, Chromecast guest mode and Android device location. Our results emphasize that proximity services currently used for mobile devices are prone to relay attacks and should not be used in security-sensitive applications.

Ethernet technology dominates enterprise and home network installations and is present in datacenters as well as parts of the backbone of the Internet. Due to its wireline nature, Ethernet networks are often assumed to intrinsically protect the exchanged data against attacks carried out by eavesdroppers and malicious attackers that do not have physical access to network devices, patch panels and network outlets. In this work, we practically evaluate the possibility of wireless attacks against wired Ethernet installations with respect to resistance against eavesdropping by using off-the-shelf software-defined radio platforms. Our results clearly indicate that twisted-pair network cables radiate enough electromagnetic waves to reconstruct transmitted frames with negligible bit error rates, even when the cables are not damaged at all. Since this allows an attacker to stay undetected, it urges the need for link layer encryption or physical layer security to protect confidentiality.

After being widely studied in theory, physical layer security schemes are getting closer to enter the consumer market. Still, a thorough practical analysis of their resilience against attacks is missing. In this work, we use software-defined radios to implement such a physical layer security scheme, namely, orthogonal blinding. To this end, we use orthogonal frequency-division multiplexing (OFDM) as a physical layer, similarly to WiFi. In orthogonal blinding, a multi-antenna transmitter overlays the data it transmits with noise in such a way that every node except the intended receiver is disturbed by the noise. Still, our known-plaintext attack can extract the data signal at an eavesdropper by means of an adaptive filter trained using a few known data symbols. Our demonstrator illustrates the iterative training process at the symbol level, thus showing the practicability of the attack.

FullMAC WiFi chips have the potential to realize modifications to WiFi implementations that exceed the limits of current standards or to realize the implementation of new standards, such as 802.11p, on off-the-shelve hardware. As a developer, one, however, needs access to the firmware source code to implement these modifications. In general, WiFi firmwares are closed source and do not allow any modifications. With our C-based programming framework, NexMon, we allow the extension of existing firmware of Broadcom's FullMAC WiFi chips. In this work, we demonstrate how to get started by running existing example projects and by creating a new project to transmit arbitrary frames with a Nexus 5 smartphone.

Physical layer security for wireless communication is broadly considered as a promising approach to protect data confidentiality against eavesdroppers. However, despite its ample theoretical foundation, the transition to practical implementations of physical-layer security still lacks success. A close inspection of proven vulnerable physical-layer security designs reveals that the flaws are usually overlooked when the scheme is only evaluated against an inferior, single-antenna eavesdropper. Meanwhile, the attacks exposing vulnerabilities often lack theoretical justification. To reduce the gap between theory and practice, we posit that a physical-layer security scheme must be studied under multiple adversarial models to fully grasp its security strength. In this regard, we evaluate a specific physical-layer security scheme, i.e. orthogonal blinding, under multiple eavesdropper settings. We further propose a practical "ciphertext-only attack" that allows eavesdroppers to recover the original message by exploiting the low entropy fields in wireless packets. By means of simulation, we are able to reduce the symbol error rate at an eavesdropper below 1% using only the eavesdropper's receiving data and a general knowledge about the format of the wireless packets.

Mobile ad hoc networks (MANETs) are emerging as a practical technology for emergency response communication in the case a centralized infrastructure malfunctions or is not available. Using smartphones as communication devices, MANETs may be readily established among the civilian population of affected areas. Beneficiaries would be civilian first responders, which may form small collaborating groups. Communication in such groups must be reliable for disaster response to be effective. In this paper, we address the issue of reliable group communication on the network layer. We design and implement the first secure explicit multicast routing protocol called Xcastor, in which we extend the secure and scalable routing concept of the Castor unicast routing protocol towards supporting reliable communication for large numbers of small groups. By simulation, we show significant performance improvements over Castor.

Microblogging is a popular form of online social networking activity. It allows users to send messages in a one-to-many publish-subscribe manner. Most current service providers are centralized and deploy a client-server model with unencrypted message content. As a consequence, all user behavior can, by default, be monitored, and censoring based on message content can easily be enforced on the server side. A distributed, peer-to-peer microblogging system consisting of mobile smartphone-equipped users that exchange group encrypted messages in an anonymous and censorship-resistant manner can alleviate privacy and censorship issues. We experimentally evaluate message spread of such systems with simulations that run on a range of synthetic and real-world mobility inputs, thus extending the previous work. We show that such systems are feasible for a range of mobility and network settings, both under normal and under adversarial conditions, e.g., under the presence of nodes which jam the network or send spam.

The Internet of Things (IoT) is increasingly used for critical applications and securing the IoT has become a major concern. Among other issues it is important to ensure that tampering with IoT devices is detected. Many IoT devices use WiFi for communication and Channel State Information (CSI) based tamper detection is a valid option. Each 802.11n WiFi frame contains a preamble which allows a receiver to estimate the impact of the wireless channel, the transmitter and the receiver on the signal. The estimation result - the CSI - is used by a receiver to extract the transmitted information. However, as the CSI depends on the communication environment and the transmitter hardware, it can be used as well for security purposes. If an attacker tampers with a transmitter it will have an effect on the CSI measured at a receiver. Unfortunately not only tamper events lead to CSI fluctuations; movement of people in the communication environment has an impact too. We propose to analyse CSI values of a transmission simultaneously at multiple receivers to improve distinction of tamper and movement events. A moving person is expected to have an impact on some but not all communication links between transmitter and the receivers. A tamper event impacts on all links between transmitter and the receivers. The paper describes the necessary algorithms for the proposed tamper detection method. In particular we analyse the tamper detection capability in practical deployments with varying intensity of people movement. In our experiments the proposed system deployed in a busy office environment was capable to detect 53% of tamper events (TPR = 53%) while creating zero false alarms (FPR = 0%).

Anonymous communication systems have recently increased in popularity in wired networks, but there are no adequate equivalent systems for wireless networks under strong surveillance. In this work we evaluate the performance of delay-tolerant friend-to-friend networking, which can allow anonymous communication in a wireless medium under strong surveillance by relying on trust relationships between the network's users. Since strong anonymity properties incur in performance penalties, a good understanding of performance under various conditions is crucial for the successful deployment of such a system. We simulate a delay-tolerant friend-to-friend network in several scenarios using real-world mobility data, analyze the trade-offs of network-related parameters and offer a preliminary throughput estimation.

Even avid users of mobile applications turn a blind eye to privacy settings. Still mobile applications remain the key means by which users share sensitive personal information. It is unclear if users just do not care, if they are missing the appropriate tools or user interfaces, or if they live in the delusion of being in control of their data. We argue that non-user-friendly design presents a key obstacle in making privacy controls work: it hinders users to effectively set up and maintain privacy settings. Our ultimate goal is to support the user by automatically suggesting access control lists based on an analysis of her communication metadata. To guide us in the design of such privacy suggestions, we perform an explorative questionnaire-based study with 42 participants. Our results confirm that users are overtaxed with existing schemes. We identify the expectations and preferences of users, thus facilitating the design of improved solutions.

Access control is a key principle to protect user privacy online. The combination of both the wealth of user-generated data in online social networks and overly complex user interfaces lead to a high user burden for privacy control, hence making the observance of the above principles difficult. We investigate how communication metadata on smartphones can facilitate providing tailored suggestions for restricted audience groups, thus limiting the sharing of data to the intended users only. To this end, we have performed a user study collecting a dataset including contact names, calls, SMS, MMS, and e-mail on personal smartphones in everyday use. In this paper, we examine which are the key features determining the social relationship category of a contact using machine learning. We obtain promising results for an automated classification of contacts into work-related, family-related and other social-interaction-related, thus enabling the possibility of user assistance for privacy control. Obtaining a more fine-grained categorization of the latter category into acquaintances, friends, and university-mates is shown to be difficult, since these categories blur in our study group.

Physical layer security schemes for wireless communications are currently crossing the chasm from theory to practice. They promise information-theoretical security, for instance by guaranteeing the confidentiality of wireless transmissions. Examples include schemes utilizing artificial interference---that is 'jamming for good'---to enable secure physical layer key exchange or other security mechanisms. However, only little attention has been payed to adjusting the employed adversary models during this transition from theory to practice. Typical assumptions give the adversary antenna configurations and transceiver capabilities similar to all other nodes: single antenna eavesdroppers are the norm. We argue that these assumptions are perilous and 'invite the thief'. In this work, we evaluate the security of a representative practical physical layer security scheme, which employs artificial interference to secure physical layer key exchange. Departing from the standard single-antenna eavesdropper, we utilize a more realistic multi-antenna eavesdropper and propose a novel approach that detects artificial interferences. This facilitates a practical attack, effectively 'lockpicking' the key exchange by exploiting the diversity of the jammed signals. Using simulation and real-world software-defined radio (SDR) experimentation, we quantify the impact of increasingly strong adversaries. We show that our approach reduces the secrecy capacity of the scheme by up to 97% compared to single-antenna eavesdroppers. Our results demonstrate the risk unrealistic adversary models pose in current practical physical layer security schemes.

Wireless, high-bandwidth data transfer gains increasing significance with a wider adoption of high-quality video streaming on mobile devices. Technologies enabling such data transfer (e.g., 802.11 or LTE) can adapt dynamically to changing conditions, which allows data transfers in a reliable way. However, applications have little or no influence on how those underlying systems execute their adaptations. Yet, in applications such as video streaming, this could provide important clues on what requirements are relevant for data delivery. In this demonstration, we present a system that allows application-defined underlay control to use such potentials in a mobile scalable video based streaming scenario by combining Android smartphones with software-defined radios (SDRs) for advanced physical layer control.

The recently proposed Glossy protocol demonstrated the high potential of constructive interference (CI) in improving communication performance in wireless sensor networks. This paper presents a network flooding protocol, Ripple, which also exploits CI while improving Glossy in terms of throughput and energy efficiency by a factor of three each. To this end, we propose to pipeline transmissions on multiple channels. Ripple uses a novel packet-based channel assignment to eliminate the time overhead occurring in traditional node-based channel assignment procedures. Moreover, if we apply the Reed-Solomon (RS) erasure code to Ripple, it pushes the reliability close to 100%, surpassing Glossy, being nonetheless computationally practical for TelosB motes. Still, the throughput after error coding doubles, or even triples that of the state-of-the-art reliable data dissemination protocol Splash. By tuning the transmission interval, Ripple balances between high throughput and high reliability, thus suiting an array of network broadcast applications with various QoS requirements.

Practical intrusion detection in Wireless Multihop Networks (WMNs) is a hard challenge. The distributed nature of the network makes centralized intrusion detection difficult, while resource constraints of the nodes and the characteristics of the wireless medium often render decentralized, node-based approaches impractical. We demonstrate that an active-probing-based network intrusion detection system (AP-NIDS) is practical for WMNs. The key contribution of this paper is to optimize the active probing process: we introduce a general Bayesian model and design a probe selection algorithm that reduces the number of probes while maximizing the insights gathered by the AP-NIDS. We validate our model by means of testbed experimentation. We integrate it to our open source AP-NIDS DogoIDS and run it in an indoor wireless mesh testbed utilizing the IEEE 802.11s protocol. For the example of a selective packet dropping attack, we develop the detection states for our Bayes model, and show its feasibility. We demonstrate that our approach does not need to execute the complete set of probes, yet we obtain good detection rates.

Geographic routing yields scalable operation in Wireless Multihop Networks. Nodes forward packets to the destination either in a greedy manner, or along arbitrary curves from source to destination. The latter allows for higher robustness, as paths are adjusted to avoid, for instance, congested areas or non-cooperative nodes. However, determining working curves is either based on unreliable trial-and-error approaches or requires global network knowledge. We propose two local schemes that dynamically adapt the curve defining the packet forwarding at node level. Our first procedure uses cached curves, and the second one builds local maps at each node. We implement them for the case of planar graph routing with guaranteed delivery but they can also be easily adapted to greedy routing. We evaluate our schemes by means of simulation in constrained multihop networks, and show that they reduce transmissions up to 74% compared to existing solutions.

Corridor-based Routing enables advanced physical layer schemes in Wireless Multihop Networks (WMNs). It widens paths in order to span multiple nodes per hop. As a result, groups of nodes cooperate locally at each hop to forward packets. Recent theoretical work suggests using Orthogonal Frequency-Division Multiple Access (OFDMA) in combination with Corridor-based Routing to improve throughput in WMNs. However, results focus on achievable capacity and do not consider practical issues such as modulation and coding schemes. In this paper, we study OFDMA for corridors in practice and implement it on software-defined radios. We show that OFDMA corridors provide significantly larger throughput gains when considering realistic modulation and coding, achieving up to 2x throughput gain compared to traditional routing not based on corridors.

Wireless sensor networks (WSNs) are especially susceptible to denial-of-service attacks due to the resource-constrained nature of motes. We follow a systematic approach to analyze the impacts of these attacks on the network behavior; therefore, we first identify a large number of metrics easily obtained and calculated without incurring too much overhead. Next, we statistically test these metrics to assess whether they exhibit significantly different values under attack when compared to those of the baseline operation. The metrics look into different aspects of the motes and the network, for example, MCU and radio activities, network traffic statistics, and routing related information. Then, to show the applicability of the metrics to different WSNs, we vary several parameters, such as traffic intensity and transmission power. We consider the most common topologies in wireless sensor networks such as central data collection and meshed multi-hop networks by using the collection tree and the mesh protocol. Finally, the metrics are grouped according to their capability of distinction into different classes. In this work, we focus on jamming and blackhole attacks. Our experiments reveal that certain metrics are able to detect a jamming attack on all motes in the testbed, irrespective of the parameter combination, and at the highest significance value. To illustrate these facts, we use a standard testbed consisting of the widely-employed TelosB motes.

Corridor-based Routing widens traditional hop-by-hop paths to enable advanced physical layer mechanisms in Wireless Multihop Networks. The key concept is to let groups of nodes cooperate to jointly forward data. Instead of establishing a path formed by a fixed sequence of nodes, the network layer builds a "corridor" from source to destination to allow for such an approach. The corridor is divided into stages, which consist of the aforementioned groups of nodes. Existing mechanisms for Corridor-based Routing focus on the physical layer and assume a routing protocol that builds the corridor. In this paper, we design a corridor construction algorithm and a practical protocol that implements it. In particular, we address in detail the overhead introduced by our protocol, since this is crucial for performance and an open issue of Corridor-based Routing. We implement our approach both in simulation and practice. We obtain the turning point at which corridors become profitable and show that our protocol builds corridors, which enable throughput gains up to 74%.

Transmission opportunities in delay- and disruption-tolerant networks (DTNs) may be scarce and short-lived. In consequence, the fragmentation of larger messages at intermediate nodes is an important requirement to efficiently utilize any available connectivity. At the same time, bandwidth must be protected against any unauthorized transmission attempt, which implies that source authentication mechanisms are needed. However, naive solutions for supporting both message fragmentation and authentication are inefficient in terms of bandwidth or computational requirements. The problem has been clearly identified in the literature and various solutions have been suggested, but a systematic treatment of the problem has not been carried out so far. In this work, we approach the problem of authenticated fragmentation by rephrasing it as a multicast authentication problem. We identify a number of computationally efficient multicast authentication protocols that are suitable for DTN scenarios and highlight known computational or bandwidth optimality results for two classes of solutions. We generalize the remaining protocols into a single third class and provide a theoretical analysis, which proves the bandwidth optimality of a protocol that has been independently suggested for the authenticated fragmentation problem. We extend the setting of the protocol by considering a network scenario where neighboring nodes can communicate reliably and show theoretically that in this scenario the amortized bandwidth overhead converges to the minimum possible. Finally, we review a number of approaches presented in the literature on the authenticated fragmentation problem and outline their inadequacies.

Wireless devices are often used in application scenarios with strict security requirements. Examples are physical intrusion detection systems commonly used to protect factories, airports or government buildings. In such scenarios, additional security features such as tamper detection are highly desirable to complement traditional cryptographic mechanisms. In this paper we use channel state information (CSI), extracted from off-the-shelf 802.11n Wi-Fi cards, to calculate a tamper-evidence value for transmitters. This value enables detection of tampering due to device movement or replacement. We describe algorithms for tamper-evidence value computation, discuss the interpretation of this value and evaluate its effectiveness.

Today, the performance of routing mechanisms in Wireless Multihop Networks (WMNs) is still limited by the lower layers. While recent cross-layer approaches take advantage of the characteristics of the medium, they are often based on traditional physical layers such as OFDM. State-of-the-art techniques used in one-hop scenarios, such as OFDMA or MIMO, pose a significant challenge in practical multihop networks, since typically Channel State Information (CSI) at the transmitter is required. Due to its volatile nature, disseminating timely CSI in the network is often infeasible. We generalize Corridor-based Routing to enable advanced physical layers in WMNs. Instead of routing packets from node to node, we forward them along fully-connected groups of nodes. As a result (1) CSI only needs to be exchanged locally to enable cooperation in a group, and (2) groups can adaptively choose the best physical layer technique according to CSI. We investigate the benefits of Corridor-based Routing and present a protocol design that enables operation of corridors in WMNs.

Physical layer techniques enable new security paradigms in wireless networks, such as node authentication based on channel characteristics. However, current approaches are often limited to one-hop scenarios. We investigate how the aforementioned authentication schemes can be extended to the multihop case. In particular, we design mechanisms to provide path signatures, which allow destination nodes to verify the path followed by packets in the network. This enables, for instance, detection of packets not being forwarded along the intended route directly at the physical layer and without the need for per-packet cryptographic schemes. We propose multiple approaches based on the accumulative effect of link CSI along multihop routes. We implement and evaluate them on a software-defined radio testbed. Our preliminary results show that we can successfully identify unauthorized nodes participating in the forwarding of packets up to a path length of six hops.

Interference alignment (IA) is often considered in the spatial domain in combination with MIMO systems. In contrast, aligning interference in the frequency domain among multiple subcarriers can also benefit single-antenna OFDM-based access networks. It allows for flexible operation on a per-subcarrier basis. We investigate the gains achievable by frequency IA in practice for a scenario with multiple access points and clients. Previous work is predominantly theoretical and focuses on idealized cases where all nodes have the same average signal-to-noise ratio (SNR). On the contrary, in practical networks, nodes typically have heterogeneous SNRs depending on channel conditions, which might have a significant impact on IA performance. We tackle this problem by designing mechanisms that adaptively choose which nodes shall perform IA on which subcarriers depending on current channel conditions. We implement and validate our approach on software-defined radios. To the best of our knowledge, this is the first practical implementation of IA in the frequency domain. Our measurements show that (1) frequency IA is feasible in practice, and (2) choosing appropriate nodes and subcarriers overcomes the main limitations due to heterogeneous SNRs. Our mechanisms enable IA in scenarios where it would be infeasible otherwise, achieving throughput gains close to the 33% theoretical maximum.

Current mobile sensing applications typically annotate the collected sensor readings with spatiotemporal information before reporting them to a central server. Such information can however endanger the users' privacy, as it reveals insights about their daily routines. Users must therefore trust the application administrators not to misuse the reported information. To diminish user dependence on administrators trustworthiness, we propose a privacy-preserving collaborative scheme, in which users exchange the collected sensor readings at opportunistic encounters. We model malicious administrators attempting to identify exchanged sensor readings based on spatial disparity by applying four state-of-the-art outlier detection algorithms. We thoroughly investigate the influence of different exchange patterns and the parameters of the algorithms on their performance based on a real-world dataset. The results for location traces of 20 users gathered during 14 days show that our algorithm achieves a high level of privacy protection.

Wireless sensor networks (WSNs) are increasingly being applied to scenarios that simultaneously demand for high packet reliability and short delay. A promising technique to achieve this goal is concurrent transmission, i.e. multiple nodes transmit identical or different packets in parallel. Practical implementations of concurrent transmission exist, yet its performance is not well understood due to the lack of expressive models that accurately predict the success of packet reception. We experimentally investigate the two phenomena that can occur during concurrent transmission depending on the transmission timing and signal strength, i.e. constructive interference and capture effect. Equipped with the thorough understanding of these two phenomena, we propose an accurate prediction model for the reception of concurrent transmission. The extensive measurements carried out with varying number of transmitters, packet length and signal strength verify the excellent quality of our model, which provides a valuable tool for protocol design and simulation of concurrent transmission in WSNs.

Mobile phones are increasingly leveraged as sensor platforms to collect information about user's context. The collected sensor readings can however reveal personal and sensitive information about the users and hence put their privacy at stake. In prior work, we have proposed different user interfaces allowing users to select the degree of granularity at which the sensor readings are shared in order to protect their privacy. In this paper, we aim at further increasing user awareness about potential privacy risks and investigate the introduction of picture-based warnings based on their current privacy settings. Depending on their privacy conception and the proposed warnings, users can then adapt their settings or leave them unchanged. We evaluate the picture-based warnings by conducting a user study involving 30 participants. The results show that more than 70% of the participants would change their settings after having seen the picture-based warnings.

State-of-the-art wireless technologies such as LTE employ OFDMA to enable robust and efficient frequency-division multiple access, which is also promising for other scenarios, such as Wireless Mesh Networks. OFDMA can improve throughput by allocating subchannels to the users which experience the best performance on the corresponding frequencies. This has lead to a large body of work on subchannel allocation schemes which optimize throughput while guaranteeing fairness. However, most solutions are discussed at a purely theoretical and/or simulative level. In this paper, we provide a framework for prototyping such schemes on the WARP Software Defined Radio to obtain practical results with small implementation overhead. We design a mechanism which allows to analyze offline how a certain allocation technique would have performed in a previously measured scenario. Moreover, we show that our approach is stable and robust regarding practical issues. While we focus on Wireless Mesh Networks, our system can easily be adapted to infrastructure-based systems.

In multi-hop networks, conventional forwarding along a unicast route forces the data transmission to follow a fixed sequence of nodes. In previous works, it has been shown that widening this path to create a corridor of forwarding nodes and applying OFDMA to split and merge the data as it travels through the corridor towards the destination node leads to considerable gains in achievable throughput compared to the case forwarding data along a unicast route. However, the problem of selecting potential nodes to act as forwarding nodes within the corridor has not been addressed in the literature, as in general a rather homogeneous network topology with equally spaced relay clusters per hop between source and destination node has been assumed. In this paper, a more realistic heterogeneous network is considered where the nodes in the area between source and destination are randomly distributed instead of being clustered with equal distance. A node selection scheme is presented which selects the forwarding nodes within the corridor based on a given unicast route between source and destination node. In simulations, it is shown that with the proposed node selection scheme, considerable throughput gains of up to 50 % compared to forwarding along unicast route can be achieved applying corridor-based routing in heterogeneous networks especially in sparse networks.

State-of-the-art physical layers such as OFDMA are widely used in infrastructure-based networks to enhance efficiency in one-to-many transmissions. Application to wireless mesh networks is highly promising, as the diversity increases in many-to-many scenarios. While theoretical work on OFDMA for this scenario exists, it has not yet been implemented in practice. In this demonstration, we show practical measurements of OFDMA in a topology with multiple transmitters and receivers, which represents a fully-connected segment of a mesh network. Moreover, we model our system analytically and in simulation. Our measurements show the validity of these models. We demonstrate over 90% reduction of the symbol error rate and a 29% channel capacity increase.

A plethora of (secure) routing protocols exists for wireless multihop networks. These protocols are mostly tailored to meet the performance and security requirements of specific application scenarios. As a result, the protocols cannot easily be adapted to novel application demands, organically growing networks, etc. We argue that the modular design of routing protocols and security mechanisms can remove the key limitations of today's monolithic routing protocols. We show the feasibility of a modular routing approach for wireless multihop networks using the example of a wireless mesh network. In particular, we demonstrate that a dynamic switch between protocol modules is possible at runtime by means of simulation as well as testbed experimentation. We further demonstrate that the security associations and the key material can be reutilized for bootstrapping novel protocol modules, thus minimizing the control overhead.

Secure initialization of sensor nodes with cryptographic keys is inherent to all security protocols and applicationsin the area of wireless sensor networks (WSN).We introduce a general framework, denoted TOPKEY, thatprovides tool assistance and performs secure initialization ofsensor nodes with cryptographic keys over the air by leveraging the transmission power to confine the area in which potential attackers can eavesdrop on communication. Our analysis shows that physical protection based on transmission power may, inpractice, lead to an acceptable level of key deployment security. Besides the fully automated key deployment, TOPKEY supports a five-step initialization process, suited to off-the-shelf sensor nodes that come without any pre-installed operating system. TOPKEY is currently tailored to static WSN topologies: it supports topology design and deploys topology-driven key generation for a range of WSN communication patterns. We implemented the framework and analyzed its performanceand scalability for commodity TelosB nodes and Contiki OS. Our analysis, performed with respect to different WSN topologies, shows that TOPKEY can be used to securely initialize a static network of about 100 nodes in less than one minute.

IEEE 802.11s is an emerging standard for wireless mesh networks. Networks based on IEEE 802.11s directly benefit from existing security mechanisms in IEEE 802.11. This limits the attack surface of IEEE 802.11s significantly for adversaries that cannot authenticate with the network. Mesh networks are, however, often conceived for community network scenarios, which are inherently more open than managed infrastructure networks. This openness entails an increased risk of insider attacks, i.e., attacks by compromised stations that can authenticate with the network. Currently, IEEE 802.11s is lacking adequate protection against such insider attacks. In this paper, we hence derive an attack model for insider attacks and present two insider attack strategies to which IEEE 802.11s networks are prone, namely impairing the network performance and preventing communication between a pair of nodes. We design countermeasures that allow to defend the wireless network against both types of attacks. Our implementations only incur marginal computational and memory overheads, while the network security is measurably strengthened.

The maintenance of Wireless Sensor Networks (WSNs) can carry high or prohibitive costs, particularly, if the WSN is deployed in unattended areas. Secure monitoring and control of the WSN is vital, however, practical systems are rare and limited with respect to their capabilities. We present a monitoring and control system for WSNs that is secure and additionally equipped with intrusion detection functionality. It allows to reliably assess the actual status of the network, to configure the sensor nodes, and to further use this data to highlight suspicious events.

Interference is one of the key factors impacting the performance and robustness of Wireless Sensor Networks (WSN) operation. For serious WSN applications, it is crucial that interference mitigation acts in a fast and reliable fashion. We describe an adaptive and distributed channel hopping scheme, HOPSCOTCH1. Our scheme is novel in the sense that (1) it is built on a lightweight yet accurate metric to describe the interference, and (2) it is fully distributed in nature and combines a proactive, consent-based as well as a reactive, rendezvous-based hopping technique, which allow for robust operation even in adverse conditions. We show by extensive experimentation that our channel metric models real-world conditions accurately and that HOPSCOTCH provides a very fast response time to adapt the network to interference.

By leveraging smartphones as sensing platforms, mobile sensing applications can collect information in an unprecedented quantity and granularity. The transmission of unprocessed sensor readings can, however, pose severe threats to the users' privacy. To protect their privacy, users can apply filters to eliminate privacy-sensitive elements of the sensor readings prior to transmission. The resulting privacy protection depends on the configuration of these filters, which is controlled by the users through a privacy interface. In this paper, we study interface elements for the realization of this interface in order to foster its acceptance and maximize the efficacy of the provided privacy protection. To this end, we have implemented six graphical privacy interfaces, which have been evaluated by 80 participants of our user study. The results show a preference of the users towards differently colored and sized elements to visualize the current level of privacy protection and define their preferred privacy settings.

Reputation systems rate the contributions to participatory sensing campaigns from each user by associating a reputation score. The reputation scores are used to weed out incorrect sensor readings. However, an adversary can deanonmyize the users even when they use pseudonyms by linking the reputation scores associated with multiple contributions. Since the contributed readings are usually annotated with spatiotemporal information, this poses a serious breach of privacy for the users. In this paper, we address this privacy threat by proposing a framework called IncogniSense. Our system utilizes periodic pseudonyms generated using blind signature and relies on reputation transfer between these pseudonyms. The reputation transfer process has an inherent trade-off between anonymity protection and loss in reputation. We investigate by means of extensive simulations several reputation cloaking schemes that address this tradeoff in different ways. Our system is robust against reputation corruption and a prototype implementation demonstrates that the associated overheads are minimal.

In multi-hop networks, conventional unipath routing approaches force the data transmission to follow a fixed sequence of nodes. In this paper, we widen this path to create a corridor of forwarding nodes. Within this corridor, data can be split and joined at different nodes as the data travels through the corridor towards the destination node. To split data, decode-and-forward OFDMA is used since with OFDMA, one can exploit the benefits of opportunistically allocating different subcarriers to different nodes according to their channel conditions. To avoid interference, each subcarrier is only allocated once per hop. For the presented scheme, the problem of optimizing the network throughput by means of resource and power allocation is formulated and two suboptimal algorithms are proposed to solve this problem with feasible effort. Simulations show that in multi-hop networks corridor-based routing using opportunistic forwarding outperforms conventional unipath routing approaches in terms of achievable throughput.

Localized geographic routing schemes operating on planar graphs promise scalability for use within large multihop wireless networks. Existing schemes base routing path construction on faces defined by the planar graph. Once running on a particular planar graph, none of the existing schemes is flexible enough to adapt the sequence of faces visited by the constructed path. Thus, real-world constraints such as network congestion, limited node energy levels, or non-cooperation of nodes might severely impact the performance and the robustness of existing planar graph routing variants. To address this problem, we extend planar graph routing with one further degree of freedom: control over the sequence of visited faces. Basically, our face routing extension now follows a sequence of faces intersected by any curve we can freely adjust. We investigate basic schemes for choosing curves dealing with imperfections in the network, and derive algorithms for routing and forwarding along these curves. We analytically prove that our scheme is loop free and allows for guaranteed delivery in arbitrary planar connected graphs. We implement curve-based routing and show its feasibility by means of a simulation study. As a proof-of-concept scenario, we investigate the case of non-cooperating nodes. Our results show that curve-based routing is able to sustain the delivery of packets where traditional schemes fail.

The use of Wireless Sensor Networks (WSN) in application domains such as industrial automation poses strict requirements in terms of communication delay, reliability, etc. Time Division Multiple Access (TDMA) is the preferred access scheme for the above applications, and leading industry standards such as WirelessHART employ it by centrally generating convergecast schedules. Despite the fact that techniques such as multi-channel communication and spatial re-use are currently not harnessed to their full potential, existing scheduling heuristics are often complex while performing far from the optimal solution. We investigate the tree convergecast scheduling with multiple channels (TCMC) problem. In particular, we derive an integer programming-based optimal solution to the min length and buffer size scheduling as well as the min length and channel number scheduling. We further describe TCMC scheduling as a decision problem, which allows us to create a general scheduling framework that is flexible and requires minimal code modification for implementing different TCMC scheduling strategies. Within our framework, we propose and implement four heuristics. Our novel busy-sender-first heuristic is significantly better than the state-of-the-art heuristic in both schedule length (within 0.22% of the optimum) and memory consumption, as well as being conceptually much simpler. Finally, based on the evaluation results of the busy-sender-first heuristic, we derive guidelines on the choice of number of channels and configuration of tree topology, respectively.

The performance of Wireless Mesh Networks under realistic conditions is not well understood. Given the huge design and parameter space for these networks, all-encompassing performance evaluations are unfeasible. We follow a practical approach and perform a targeted, in-depth investigation of the current state of the BATMAN Advanced (batman-adv) protocol in a realistic office environment, using the thoroughly studied AODV protocol as a baseline. In particular, we study the reachability, packet loss, delay and throughput of the network. We identify the main parameters influencing the routing performance and demonstrate failure modes of the studied protocols.

The presence of multimodal sensors on current mobile phones enables a broad range of novel mobile applications including, e.g., monitoring noise pollution or traffic and road conditions in urban environments. Data of unprecedented quantity and quality can be collected and reported by a possible user base of billions of mobile phone subscribers worldwide. The collection of detailed sensor and location data may however compromise user privacy. In this paper, we present a decentralized mechanism to preserve location privacy during the collection of sensor readings. As most sensor readings are geotagged, we propose to exchange them between users in physical proximity in order to jumble the paths followed by the users. We evaluate different strategies to exchange and report the sensor readings to the application using real-world GPS traces of mobile users. The results demonstrate the feasibility and efficacy of our proposed scheme, which can obfuscate up to 100% of the visited locations in the best instances.

Scalability of routing algorithms is a critical issue in large multihop wireless networks. In this sense, approaches like localized geographic routing are very promising. Existing schemes base routing path construction on faces defined by the planar graph of the network. Once running on a particular planar graph, none of the existing schemes is flexible enough to adapt the sequence of faces visited by the constructed path. To address this problem, we extend planar graph routing with one further degree of freedom: control over the sequence of visited faces. Basically, our face routing extension now follows a sequence of faces intersected by any curve we can freely adjust. We motivate our work by discussing application scenarios that benefit from our scheme and suggest basic mechanisms for choosing appropriate curves. We further present preliminary results from an implementation of our curve-based routing scheme.

In this paper we investigate the case of IEEE 802.11-based WLANs and first show that, given the existing diversity of power consumption figures among mobile devices, performing a fair allocation of resources among devices is challenging. We then propose a criterion to objectively balance between the most energy-efficient configuration (where all resources are given to the single most energy efficient device) and the throughput-optimal allocation (where all devices evenly share the resources regardless of their power consumption). We derive a closed-form expression for the optimal configuration of the WLANs with respect to the energy-efficiency criterion. We validate our analysis through simulations, and show that our approach betters the prevalent allocation schemes discussed in literature in terms of energy efficiency, while maintaining the notion of fairness among competing devices.

Abstract The class of Wireless Mesh Networks (WMN) supports an ample set of applications including wireless community networks, radio access networks in rural or metropolitan areas, or wireless backbones for factory/process automation. Guaranteeing security is crucial for within these application scenarios. While contemporary wireless technologies, such as the IEEE 802.16 or the IEEE 802.11s standard, provide the basic protocol mechanisms for mesh networking, they lack in comprehensive security mechanisms. Additionally, novel security features of the above standards such as per‐link encryption break existing security solutions that rely on overhearing of the wireless channel. We close this gap by developing a holistic approach toward securing WMNs with particular focus on the network layer. We perform a threat analysis and then develop solutions (1) guaranteeing the integrity and authenticity of routing messages, (2) to locally and globally detect misbehavior of nodes in forwarding data or routing messages even for settings that do not allow for overhearing the channel, and (3) to dynamically manage reputation of nodes throughout the network. The combination of these building blocks enables to provide for secure, self‐organizing WMNs. As a proof‐of‐concept, we tailor and implement our solutions for the setting of a realistic IEEE 802.16 mesh network; we discuss the protection achieved and assess selected performance trade‐offs for the developed mechanisms. Copyright © 2010 John Wiley & Sons, Ltd.

Abstract The IEEE 802.16 standard (WiMAX) specifies a MeSH mode which permits the deployment of Wireless Mesh Networks (WMNs) supporting carrier‐grade QoS. The network operator for such planned WMNs is interested in maximizing the traffic admitted in the WMN and simultaneously supporting QoS. Recently network coding has emerged as a promising technique for increasing the throughput in WMNs. This paper proposes CORE, which addresses the problem of jointly optimizing the routing, scheduling, and bandwidth savings via network coding. Prior solutions are either not applicable in the 802.16 MeSH mode or computationally too costly to be of practical use in the WMN under realistic scenarios. CORE's heuristics, in contrast, are able to compute solutions for the above problem within a operator definable maximum computational cost, thereby enabling the computation and near real‐time deployment of the computed solutions. We analyze the performance of CORE's heuristics via a thorough simulation study covering the typical usage scenarios for WMNs. The results presented demonstrate that CORE is able to increase the number of flows admitted considerably and with minimal computational costs. We also see that CORE successfully increases the number of network coding sessions which can be established in the WMN. Further, the results provide insights into limiting factors for the gains which can be obtained in different typical usage scenarios for WMNs. Copyright © 2010 John Wiley & Sons, Ltd.

Wireless Community Networks (WCN) are formed by the integration of user-operated wireless sensor networks that are internetworked by wireless mesh networks available within urban communities. WCNs enable novel applications for the members of the community. These include different sensing applications, where individuals contribute sensor data for further use within their community at large or with well-defined restrictions to certain users. Sensing application scenarios for WCNs differ from traditional sensor network applications with respect to their security and privacy requirements. In this paper, we define three representative scenarios-personal sensing, designated sensing, and community sensing. These scenarios are then studied with respect to their privacy and security implications. In particular, we identify main research questions and highlight the challenges of using various security and privacy approaches from networking and cryptography to make sensing applications in WCNs security and privacy aware.

Securing the routing service of Mobile Ad-hoc Networks (MANET) is a basic requirement for application scenarios such as emergency response operations. In this paper we analyze the effects of routing attacks on the Ad-hoc On-demand Distance Vector (AODV) protocol. We present results of a testbed-based analysis to consider real-world characteristics of hardware as well as wireless communications. As AODV is shown to produce unstable multi-hop routes, we design and implement a mechanism to address this issue. We then present an evaluation of three selected types of malicious behavior. Our results show that our protocol-variant delivers a reliable ad-hoc routing service. Yet, it is strongly affected by routing attacks.

We present an analytical model combining geometric and stochastic approaches to describe the effects of attacks and countermeasures on MANETs. In particular, we focus on the packet loss that can be charged to the misbehavior as well as to the countermeasures as a primary metric. For this, we model the entire chain of (1) MANET routing, (2) attack, (3) intrusion detection, and (4) intrusion response. We validate the models proposed by means of simulation.

Central trusted instances as well as predefined security policies are not available in spontaneously established peer-to-peer environments. The former can be addressed by joint decision processes based on threshold cryptography. To compensate the latter, users can be involved directly in security- relevant decisions. In this case, minimizing the number of users involved is a necessary optimization goal to keep user-based joint decisions feasible for real-world deployment. Still, a certain redundancy has to be introduced when taking into account users that do not provide their decision in a reasonable amount of time. In this paper we scrutinize different interaction schemes for joint decision processes. We develop stochastic models that describe the outcome subject to the number of users requested and the probability with which one user provides his decision in time. The derived closed-form representation of the models serves as a tool for governing the decision process, allowing for a real-time minimization of the number of users involved.

The IEEE 802.16 standard recently introduced an additional relay mode of operation permitting coverage extension of the point-to-multipoint (PMP) based WiMAX networks. Relays can further aid in increasing the achievable data rates for subscriber stations (SS) in the network. Although bandwidth management and scheduling have been studied in some detail in traditional IEEE 802.16 PMP networks, the corresponding study for relay networks is far from complete. A trivial extension to the scheduling and bandwidth allocation algorithms used in the PMP mode for the relay networks leads to inefficient bandwidth utilization and allocation. Of particular interest here is the possibility of spatial reuse of allocated blocks of bandwidth which is permissible in relay networks. This paper investigates and designs bandwidth allocation and scheduling algorithms for IEEE 802.16 based relay networks, considering the support for spatial reuse to additionally improve the throughput while at the same time supporting quality of service (QoS). We research the issues which need to be considered when designing bandwidth allocation algorithms for relay networks. Finally, as a proof of concept we provide a thorough simulation study to investigate the performance of the designed algorithms. The results validate the design choices we presented, and also provide insights into areas for further research in WiMAX relay networks.

The IEEE 802.16 standard specifies a mesh mode of operation which permits the setup of wireless mesh networks (WMN) with per-link QoS support. The standard specifies both distributed as well as centralized reservation schemes. Distributed scheduling is highly flexible, and enables operation of the WMN even in the absence of a central controlling instance or base station. A systematic study of strategies for distributed scheduling in the IEEE 802.16 MeSH mode is, however, missing. In this paper we model the individual links in the 802.16 WMN and design and derive efficient strategies for distributed scheduling to reserve bandwidth required for transmission on the modelled link. Additionally, we evaluate our proposed reservation model using simulations, study the impact of key parameters and identify issues for further research in WiMAX based WMNs.

In wireless sensor networks, energy is commonly a scarce resource, which should be used as sparingly as possible to allow for long node lifetimes. It is therefore mandatory to put a focus on the development of energy-efficient applications. In this paper, we analyze the achievable energy gains when packet payloads are compressed prior to their transmission. As the radio transceiver chips are the predominant power consumers on most current sensor node platforms, we present how local compression of data can be successfully employed to preserve energy. We compare two lossless mechanisms to eliminate redundancies in the packets with regard to the overall energy savings. The results prove that data compression is a viable approach to reduce a platform's energy consumption, as it can reduce the radio transmission durations of packets and thus shorten the duty cycles of the radio device.

In wireless sensor networks, the energy consumption of participating nodes has crucial impact on the resulting network lifetime. Data compression is a viable approach towards preserving energy by reducing packet sizes and thus minimizing the activity periods of the radio transceiver. In this paper, we propose a compression framework utilizing a stream-oriented compression scheme for sensor networks. It is specifically tailored to the capabilities of employed nodes and network traffic characteristics, which we determine in a characterization of WSN traffic patterns. To mitigate the inapplicability of traditional compression approaches, we present the squeeze KOM compression layer. By shifting data compression into a dedicated layer, only minor modifications to applications are required, while efficient data transfer between nodes is provided. As a proof-of-concept, we implement a stream-based compression algorithm on sensor nodes and perform an experimental analysis to determine the potential gains under realistic traffic conditions. Results indicate that our presented lossless stream-oriented payload compression leads to considerable savings.

Abstract With their wireless and infrastructureless nature, mobile ad hoc networks offer new possibilities for communication, but also new possibilities for attacks. An intrusion detection system combined with intrusion response mechanisms is a promising approach which mitigates the effects of attacks, but cannot be taken directly from wired or infrastructure‐based environments. In this paper, we propose an intrusion response mechanism for mobile ad hoc networks that excludes detected adversaries from the network based on their geographical position. To this end, we establish geographical quarantine zones, which block communication around misbehaving nodes. Thus, we depart from the assumption that attacks can be uniquely bound to addresses. Without loss of generality, we show how our approach can be used together with the AODV routing protocol to provide an intrusion response to a combination of Blackhole and Sybil attacks. In a series of simulation studies, we compare our approach with a ‘traditional’, address‐based intrusion response strategy. Copyright © 2008 John Wiley & Sons, Ltd.

The IEEE 802.16 standard specifies a MeSH mode which permits the deployment of Wireless Mesh Networks (WMNs) supporting carrier-grade QoS. The network operator for such planned WMNs is interested in maximizing the traffic admitted in the WMN and simultaneously supporting QoS. Recently network coding has emerged as a promising technique for increasing the throughput in WMNs. This paper proposes CORE, which addresses the problem of jointly optimizing the routing, scheduling, and bandwidth savings via network coding. Prior solutions are either not applicable in the 802.16 MeSH or computationally too costly to be of practical use in the WMN under realistic scenarios. COREpsilas heuristics, in contrast, are able to compute solutions for the above problem within a operator definable maximum computational cost, thereby enabling the computation and near real-time deployment of the computed solutions. We analyze the performance of COREpsilas heuristics via a thorough simulation study covering the typical usage scenarios for WMNs. The results presented demonstrate that CORE is able to increase the number of flows admitted considerably and with minimal computational costs. Further, the results provide insights into limiting factors for the gains which can be obtained in different usage scenarios.

Future buildings and environments are envisioned to provide ambient intelligence, adapting to a userpsilas preferences based on information about his context and status. Smart heterogeneous sensor networks are well suited data sources for such environments, because they allow for dynamic adaptation to newly added sensor types and novel tasks. Realistic verification of protocols and algorithms for smart networks poses special constraints on testbeds, necessitating support for heterogeneous platforms and mobility in the network. These distinct requirements limit the usability of many known testbeds of purely homogeneous nature. In this paper, we determine a minimum set of premises for smart heterogeneous sensor network testbeds and evaluate existing architectures with respect to these requirements. We then present our tubicle node platform, an integrated sensor network node providing inherent support for heterogeneity and fulfilling the determined set of requirements in their entirety. A set of twenty tubicles forms the basis for our TWiNS.KOM testbed. Specifically designed for heterogeneity, the architecture allows rapid validation of smart sensor network algorithms and quick experimental setup.

Delay tolerant applications allow time to be used as an additional degree of freedom for security mechanisms in mobile ad hoc networks. By introducing artificial delays for the communication of delay tolerant applications, we optimize the point in time for starting or continuing a transmission. We develop mechanisms to exploit the knowledge on the proximity of the sender, the receiver, and intermediate, relaying nodes to misbehaving nodes detected. We propose different strategies for delayed transmission and provide a performance analysis based on a series of simulation studies. Our results show that we reduce the effects of misbehavior by keeping away data from misbehaving nodes.

In 1969, Thomas Schelling proposed one of the most cited models in economics to explain how similar people (e.g. people with the same race, education, community) group together in American neighborhoods. Interestingly, we observe that the analogies of this model indeed exist in numerous scenarios wh

Ubiquitous network connectivity and mobile communications have recently attracted remarkable attention. Wireless multihop networks such as Mobile Ad hoc Networks or Wireless Mesh Networks have been proposed to cater to the arising needs. Various security challenges persist, esp. because these networks build on the premise of node cooperation. Secure routing protocols and mechanisms to detect routing misbehavior in the direct neighborhood exist; however, collusion of misbehaving nodes has not been adequately addressed yet. We presentLeakDetector, a mechanism to detect colluding malicious nodes in wireless multihop networks. In combination with proactive secure multipath routing algorithms,LeakDetectorenables the calculation of the packet-loss ratio for the individual nodes. We perform an experimental analysis, which shows the excellent detection quality ofLeakDetector.

The IEEE 802.16 standard represents the state-of-the-art for quality of service (QoS) aware broadband wireless access networks. Initially the standard provided sophisticated QoS mechanisms only for a static network (i.e. stationary subscribers), but recently the amendment IEEE 802.16e-2005 introduced mobility support for the individual subscriber stations. Network entry is the first step required for nodes to register themselves with the 802.16 network. The performance of the network entry process is crucial to support QoS, especially if node churn is high. In this paper, we develop an analytical model of the network entry process in IEEE 802.16. This model enables us to predict the effect and influence of important protocol parameters for joining the network. Using our model, we show that the selection of correct and appropriate protocol parameters is crucial to support setup-delay sensitive applications such as emergency services or IP-telephony. Our model can be used as a tool to derive the feasible range for individual network parameters in selected application scenarios.

Wireless mesh networks (WMNs) build on user nodes to form the network's routing infrastructure. In particular, the correct forwarding behaviour of each intermediate node on a multihop path from a source node to a destination node is crucial for the functioning of the mesh network. However, current secure routing solutions and misbehaviour detection mechanisms are not sufficient and are mostly inapplicable in mesh networks based on state-of-the-art wireless technology. In particular, hop- by-hop per-link encryption mechanisms break solutions that are based on the overhearing of the wireless channel, which leads to severe problems in the presence of misbehaving nodes. We present AntSec, WatchAnt, and AntRep, which together address the above security gap. AntSec guarantees integrity and authenticity of routing messages, WatchAnt detects misbehaviour in forwarding data messages as well as routing messages and in addition is able to cope with per-link encryption at the MAC layer. AntRep is a reputation management system and helps take punitive action against misbehaving nodes. AntSec, WatchAnt, and AntRep are well suited for WMNs with a quasi-static network topology. Through a thorough evaluation we show the improved routing performance of AntSec working together with WatchAnt and AntRep.

Network coding has been successfully applied to contemporary wireless Mesh networks (WMNs) to reduce intra-network interference and enhance the capacity of the WMN. State-of-the-art WMNs, however, introduce features such as explicit per-link bandwidth reservation and per-link encryption, which make the application of prior network coding approaches in these WMNs suboptimal, if not impossible. In this paper we look at the above challenge from a new perspective and present efficient heuristics for tackling the joint QoS routing, scheduling, and network coding problem. An experimental evaluation shows that the designed heuristics are able to yield excellent solutions in real-time, even if we assume dynamically changing traffic in the WMN.

The IEEE 802.16-2004 standard specifies wireless broad-band networks with optional support for multi-hop mesh operation (mesh mode). The provision and support of high-quality real-time services such as voice over IP is crucial, if wireless networks based on the IEEE 802.16-2004 standard are to challenge wired network services. In this paper we investigate and identify critical factors in enabling real-time services in 802.16 based networks operating in the mesh mode. We present an analytical performance analysis and a simulation study investigating the coordinated centralized scheduling mechanism as specified in the 802.16-2004 standard. Our results show that the scalability and efficiency of such mesh networks with respect to real-time services are at stake. Our results, moreover, aid in the adjustment of critical system parameters allowing for optimized network performance.

Today, we witness a transformation of radio access network topologies from strictly tree-structured towards meshed architectures. Yet, these edge networks follow mostly circuit-switched paradigms to support quality of service applications such as voice or video communication. In this work, we develop a novel quality of service aware routing framework to optimize the performance of edge networks in the packet-switched domain. Starting from the Internet's best-effort routing paradigm and building on related work, we formulate a near-optimal multiclass minimum-delay routing algorithm. Our algorithm optimizes network-wide end-to-end delay and allows for differentiation of service. We exploit two orthogonal dimensions namely multipath routing and class-based service prioritization. We provide a precise description of our algorithm and a detailed experimental analysis against state of the art routing algorithms. Our algorithm is able to achieve excellent performance while maintaining the simplicity of a decentralized and distributed routing algorithm, thus matching the requirements for future radio access networks.

The dependability of the routing system in ad hoc networks inherently relies on node behavior. In order to support multihop operation in the network, most ad hoc routing algorithms assume well-behaving nodes. However, in reality there may exist constrained, selfish or malicious nodes. We discuss the influence of node misbehavior on the routing process. In particular, we derive a classification for misbehaving nodes and extend an analytical model of the route acquisition process executed by the ad hoc on-demand distance vector (AODV) routing protocol to cover different classes of misbehavior. The validation of the behavior model, and the clarification of the impact misbehaving nodes impose onto the routing process, is completed using an experimental analysis.

We present an admission control scheme which provides per-flow delay and bandwidth guarantees based solely upon simple class-based strict priority queueing. We derive basic properties of the worst-case behaviour in strict priority queueing systems using network calculus. Building upon these properties, a flow admission control scheme is devised. The rationale behind this work is the appealing simplicity as well as the almost ubiquitous availability of strict priority queueing in today's routers and the thus promising applicability of our results for practical purposes in providing quality of service (QoS) in the Internet.

Currently, we see the evolution of large scale community and metropolitan area networks based on inexpensive wireless local area network technology. We present the results of an experimental analysis, which investigates the potential of quality of service routing mechanisms within this challenging environment. Our investigation is based on a model of a radio access network designed to cover a large city center by means of decentralized and distributed routers, which are tightly meshed. The workload is modeled to reflect the estimated usage patterns based on statistical data collection of user mobility and combined with synthetic traffic matrices. We present results for various routing strategies including shortest path routing, delay constrained routing as well as various multipath quality of service routing variants. Moreover, we investigate different traffic distributions. Our findings are, that multipath routing is able to enhance the utility of the network significantly.