The rise of wearables such as fitness trackers and smartwatches has increased the need for strong security to protect personal data. Although two-factor authentication methods improve security, they often require additional user input, making them inconvenient. Recently, hardware flaws in accelerometers and WiFi interfaces have been leveraged to create low-effort two-factor authentication methods. However, these hardware-based device credentials are static, necessitating device replacement if the credentials are compromised. In this study, we introduce an innovative device authentication system that identifies wearables using vibration-based credentials. By utilizing built-in vibration motors and motion sensors (i.e., accelerometers and gyroscopes), our system establishes a unique communication channel to capture the distinct characteristics of each device. Unlike existing methods, our vibration-based credentials are reprogrammable and user-friendly. We develop advanced data processing techniques to minimize the impact of noise, body motion artifacts, and wearing position. We design a lightweight convolutional neural network for feature extraction and device authentication, with a majority vote mechanism to improve identification robustness. Extensive experiments with five different smartwatches demonstrate that our system achieves an average precision of 98% and a recall of 94% under various attacks, demonstrating that including gyroscope data significantly improves performance across different wearing poses and watch orientations.

With the extensive deployment of smart environments and IoT devices, WiFi sensing has proven its significant convenience and contact-free sensing capabilities in supporting a wide range of applications. However, designing a ubiquitous WiFi sensing system for diverse real-world scenarios presents a substantial dilemma, as the system performance deteriorates when the testing data diverges significantly from the training data due to domain variations. To address this dilemma, existing studies need extra efforts to develop new features or even retrain the original model under environmental variations. However, these approaches have not efficiently resolved the dilemma. In this study, we conduct a comprehensive study on the domain variation problem to make WiFi sensing robust and accurate in practical applications. Our definition of domains is comprehensive and includes environmental conditions, surrounding settings, user differences, user orientations, user's positions relative to WiFi sensors, and user participation time frames. We design a novel conformal prediction framework that quantifies the conformity (i.e., similarity) between the testing and training WiFi samples, then labels the testing samples with the most probable class(es). Unlike traditional conformal prediction which relies on data from a single domain, we develop a new statistical (Type I) approach to assess the conformity of the testing WiFi samples to individual training domains and aggregate the outcomes. To further improve the framework's generalization, we design a (Type II) fusion approach that utilizes the inter-relationships among domains for more accurate conformity quantification. Built upon these two methods, kernel density estimation-based and SVM-based methods are developed to compute the conformity scores for new testing samples to make conformal predictions. Extensive experiments, utilizing both self-collected and publicly available datasets show that our framework can improve prediction accuracies ranging from 20.1% to 77.1% in three of the most representative WiFi-based applications across six types of domain variations.

Maintaining concentration is essential for productivity, learning and safety, yet it remains difficult to assess objectively in everyday settings. Traditional methods such as self-reporting and observational studies are subjective and labor-intensive. Wearable sensors can provide physiological data but require constant contact with the user, while camera-based systems raise privacy concerns and are sensitive to illumination and occlusion.

Wearable devices (e.g., fitness trackers and smartwatches) integrating sophisticated sensors are pervasively used in our daily lives these days. Recent research has demonstrated that the vibration motors and motion sensors in these devices offer a powerful sensing channel for various applications including human-computer interaction (HCI) [6, 7], health monitoring [5], and user authentication [1, 3]. However, vibration signals collected from wearable devices are highly susceptible to distortion from body motion artifacts and variations across different devices [4]. Therefore, a comprehensive and systematic sensing testbed is essential to facilitate research in vibration sensing for wearable devices across a wide range of applications.

Reliable and ubiquitous user authentication has become essential in smart cities, connected vehicles, and smart homes where users interact with multiple devices in their daily lives. However, existing biometric approaches, such as fingerprint, facial, or voice recognition, often require expensive hardware intrusive interaction, or raise privacy concerns, limiting their scalability in everyday settings [1–3]. To address these limitations, we explore a millimeter-wave (mmWave) testbed that enables palm-based user authentication through fine-grained sensing of palm geometry, skin thickness, and surface texture. By leveraging the widespread integration of mmWave technology in WiGig and 5G, this approach provides a low-cost, contactless, and privacy-preserving alternative to conventional biometrics. This work presents how the mmWave testbed is utilized to investigate cross-environment modeling and robustness in palm-based user authentication. Our system, named mmPalm, captures the reflections of Frequency-Modulated Continuous Wave (FMCW) signals from a user's palm to construct a distinctive palm profile that represents both structural and material characteristics of the hand. These reflections contain rich information about the three-dimensional geometry of the palm, sub-surface tissue variations, and fine surface textures, allowing unique identification without visual or physical contact. The mmWave testbed allows us to systematically collect palm data under varied distances, angles, and environments, providing a consistent platform for model development and evaluation.

The Internet has opened the floor to stakeholders by redefining the way of organizing, communicating, and collaborating that was initiated by the Web’s development. The advancement of the World Wide Web is an outright phenomenon and significant and we witnessed the evolution of the Web. As decentralized technologies continue to gain traction, Web3, or the decentralized internet, has emerged as a promising approach to enable a more secure, transparent, and privacy-preserved digital landscape. In this paper, we thoroughly conduct a systematic study to explore the challenges and opportunities encountered by blockchain developers in the context of decentralized applications (dApps) in Web3. We analyze a set of peer-reviewed research articles, whitepapers, and technical reports and present an in-depth understanding of the current state of Web3 development and its implications. Our finding indicates the opportunities that Web3 can facilitate, such as expanded use cases, enhanced security and privacy, decentralized infrastructure, and the potential for enabling inclusive development resources for blockchain developers. Additionally, we highlight various challenges that blockchain developers deal with including scalability, security, privacy, interoperability, and the need for standardized tools and frameworks along with various challenges in the software development lifecycle (SDLC). While there are significant challenges to overcome, the potential benefits of Web3 are substantial and could lead to a more inclusive, secure, and transparent digital ecosystem. Furthermore, we emphasize the importance of continued research, collaboration, and innovation among stakeholders to address the identified challenges and capitalize on Web3’s opportunities.

Biometric authentication systems are increasingly needed across a broad range of applications including in smart city environments (e.g., entering hotels, high-rise buildings, train stations, hospitals, and personalizing vehicles settings), and in smart home environments (e.g., controlling smart devices, en-hancing VR/AR experience). Traditional methods, such as face-based and fingerprint-based authentication, usually incur high cost to be installed in all this kind of environments, making them hard to become a ubiquitous authentication approach. In this paper, we develop a ubiquitous low-effort user authentication approach based on palm recognition using millimeter wave (mmWave) signals. Extensive experiments demonstrate that our system achieves 99% authentication accuracy.

Software Engineering (SE) education aims to seamlessly blend theoretical knowledge with practical exposure, ensuring students the grasp of SE's foundational principles, design methodologies, implementation, testing, and maintenance capabilities with communication paradigms and problem-solving strategies. Under rapid evolvement and advancement, new technologies such as blockchain and artificial intelligence are poised to redefine the SE landscape. However, traditional SE curricula often lag behind in incorporating cutting-edge technologies, particularly in student class projects. This paper underscores the significance of blockchain within the SE pedagogical framework. Specifically, we introduce a project-based learning approach with blockchain technology to create an open-source software repository for students to engage in requirement analysis, design, implementation, and maintenance of blockchain-oriented software development. These activities will allow students to understand the nature and architecture of blockchain applications that have long been ignored in both computer science and SE education. Practicing these projects will enable learners to become experts in blockchain software development and rethink the need for improving requirements elicitation, design, development, and testing strategies. The repository consists of ten modules, each of which contains real-world topics. We have developed one of ten modules so far, which focuses on a blockchain-based student record database. A preliminary survey, both pre and post-exposure, was conducted with 24 university students of both undergraduate and graduate levels pursuing degrees in either computer science or software engineering programs. The feedback was overwhelmingly positive, highlighting the value of our approach in enhancing the learning experience of novel technologies. The participants also emphasized the need for adopting blockchain-based ideas in course projects. Our future endeavors will focus on expanding the repository to encompass a diverse range of topics, further embedding the role of blockchain in SE education.

Many mobile applications have resorted to deep neural networks (DNNs) because of their strong inference capabilities. Since both input data and DNN architectures could be sensitive, there is an increasing demand for secure DNN execution on mobile devices. Towards this end, hardware-based trusted execution environments on mobile devices (mobile TEEs), such as ARM TrustZone, have recently been exploited to execute CNN securely. However, running entire DNNs on mobile TEEs is challenging as TEEs have stringent resource and performance constraints. In this work, we develop a novel mobile TEE-based security framework that can efficiently execute the entire DNN in a resource-constrained mobile TEE with minimal inference time overhead. Specifically, we propose a progressive pruning to gradually identify and remove the redundant neurons from a DNN while maintaining a high inference accuracy. Next, we develop a memory optimization method to deallocate the memory storage of the pruned neurons utilizing the low-level programming technique. Finally, we devise a novel adaptive partitioning method that divides the pruned model into multiple partitions according to the available memory in the mobile TEE and loads the partitions into the mobile TEE separately with a minimal loading time overhead. Our experiments with various DNNs and open-source datasets demonstrate that we can achieve 2-30 times less inference time with comparable accuracy compared to existing approaches securing entire DNNs with mobile TEE.

Managing and exchanging sensitive information securely is a paramount concern for different domains such as scientific, finance, cybersecurity, and healthcare. The increasing reliance on computing workflows and digital data transactions requires ensuring that sensitive information is protected from unauthorized access, tampering, or misuse and ensuring data integrity and transparency. To address this need, several approaches have been proposed such as JWT, SciTokens, Verifiable Credentials, and Smart Contracts which provide different methods for managing and exchanging information securely in centralized or decentralized and trustworthy environments. However, each technology offers unique advantages and limitations that require a comprehensive analysis to understand its potential and challenges. In our previous study, we conducted a comprehensive analysis of these approaches for authenticating and securing access to scientific data. This research further proposes a novel blockchain-based verifiable credentials that integrate the concept of Smart Contracts. The aim of this study is to introduce a decentralized and privacy-preserving authentication mechanism to enable stakeholders to share, verify, or revocation of their data with enhanced security, transparency, and trust. The proposed framework utilizes two different blockchain frameworks, Hyperledger Fabric and Ethereum to conduct comprehensive research to evaluate the effectiveness of both frameworks for the development of verifiable credentials. Our analysis indicates that Hyperledger Fabric offers enhanced security and ensures robust integrity through a private network and chaincode mechanism for authentication and access to data. As a result of our analysis, we adopt Hyperledger Fabric for the implementation and demonstration of the final version of our framework. We evaluate the proposed approach with a set of educational data to measure the effectiveness of the system. We find the proposed framework enables users to share data effectively within a secure network and only authorized stakeholders are allowed to access the shared data.

There is a growing trend for people to perform work-outs at home due to the global pandemic of COVID-19 and the stay-at-home policy of many countries. Since a self-designed fitness plan often lacks professional guidance to achieve ideal outcomes, it is important to have an in-home fitness monitoring system that can track the exercise process of users. Traditional camera-based fitness monitoring may raise serious privacy concerns, while sensor-based methods require users to wear dedicated devices. Recently, researchers propose to utilize RF signals to enable non-intrusive fitness monitoring, but these approaches all require huge training efforts from users to achieve a satisfactory performance, especially when the system is used by multiple users (e.g., family members). In this work, we design and implement a fitness monitoring system using a single COTS mm Wave device. The proposed system integrates workout recognition, user identification, multi-user monitoring, and training effort reduction modules and makes them work together in a single system. In particular, we develop a domain adaptation framework to reduce the amount of training data collected from different domains via mitigating impacts caused by domain characteristics embedded in mm Wave signals. We also develop a GAN-assisted method to achieve better user identification and workout recognition when only limited training data from the same domain is available. We propose a unique spatialtemporal heatmap feature to achieve personalized workout recognition and develop a clustering-based method for concurrent workout monitoring. Extensive experiments with 14 typical workouts involving 11 participants demonstrate that our system can achieve 97% average workout recognition accuracy and 91% user identification accuracy.

For decades, one-time verification has been the standard for user verification at entry points, office rooms, etc. However, such approaches request users to provide their secrets (e.g., entering passwords and collecting fingerprints) and re-verify (e.g., screen shutdown) manually. Thus, they cannot confirm whether the user is a legitimate or an imposter after verification, which raises the urgent demand for a more convenient and secure solution to perform continuous user verification. However, existing continuous verification methods heavily rely on users' active participation, which is inconvenient. Toward this end, we propose a continuous user verification system, BioTag, which utilizes the low-cost radio frequency identification (RFID) technology to capture unique physiological characteristics rooted in the users' respiration motions for continuous user verification. Specifically, we use two RFID tags attached to a user's chest and abdomen to capture the user's intrinsic respiratory patterns via RFID signals. We develop respiratory feature extraction methods based on waveform morphology analysis and fuzzy wavelet transformation (FWPT) to derive unique biometric information from the user's respiration signals. Furthermore, we develop an adaptive classifier using the gradient boosting decision tree (GBDT) to identify legitimate users and attackers accurately. Extensive experiments involving 41 participants demonstrate that BioTag can robustly authenticate users and detect various types of adversaries with low training effort. In particular, our system can achieve over 95.2% and 94.8% verification accuracy on random attack and imitation attack scenarios, respectively.

Millimeter wave (mmWave)-based human activity recognition (HAR) systems have emerged in recent years due to their better privacy preservation and higher-resolution sensing. However, these systems are vulnerable to adversarial attacks. In this work, we propose a universal targeted attack method for mmWave-based HAR system. In particular, a universal perturbation is generated in advance which can be added to new-coming mmWave data to deceive the HAR system, causing it to output our desired label. We validate our proposed attack using a public mmWave dataset. We demonstrate the effectiveness of our proposed universal attack with a high attack success rate of over 95%.

With the wide deployment of smart environments and IoT devices, WiFi sensing has demonstrated its great convenience and contactless sensing capabilities in supporting a broad array of applications. However, designing a ubiquitous WiFi sensing system for heterogeneous scenarios in practice is still a big dilemma as the system performs poorly when the testing data is significantly different from the training data caused by domain variations. To address this dilemma, existing studies involve extra efforts to develop new features or even to retrain the original model under environmental variations. However, none of them can resolve the dilemma completely. In this work, we conduct a comprehensive study on the domain variation problem to make WiFi sensing robust and accurate in reality. Our definition of domains is comprehensive and includes environments, surrounding settings, user differences, user's facing directions, user's positions relative to WiFi sensors, and user participating time frames. Our innovation is to achieve reliable WiFi sensing across all the domains based on the conformal prediction framework. Our approach quantifies the conformity (i.e., similarity) between the testing WiFi samples and the training samples, then labels the testing samples with the most probable class(es). We develop a novel cross-domain transformal prediction scheme based on the multivariate kernel density estimation to effectively assess and learn the conformity of each domain in the training data. To meet various application-specific requirements, we further develop two approaches to fuse the knowledge of conformity derived from the training domains to perform predictions. Extensive experiments with both self-collected and public datasets show that our framework can improve prediction accuracies from 30% to 74% improvements in three most representative WiFi-based applications across six types of domain variations.

The Internet of Things (IoT) has grown over decades to encompass many forms of sensing modalities, and continues to improve in terms of sophistication and lower costs. The trend of hardware miniaturization and emphasis on user convenience has inspired numerous studies to integrate more varied devices within the IoT into modernizing healthcare systems, facilitating applications, such as activity recognition, fitness assistance, vital signs monitoring, daily dietary tracking, and sleep monitoring. These applications are vital for prevention, detection, and treatment of ailments and can be realized using both dedicated health sensors as well as general-purpose sensors not originally designed for health monitoring. This article surveys such studies, detailing smart health monitoring systems, and the types of sensor components utilized within the IoT. We categorize and analyze these works based on their leverage of device-based techniques (i.e., use of sensors worn or carried by the person) and device-free techniques (i.e., wireless sensing without need to carry hardware), as well as signal processing and classification techniques utilized. In particular, we discuss how different combinations of these techniques can be creatively applied to support professional and commercial health-monitoring IoT networks. We also identify limitations and potential directions that future research may explore.

Traditional one-time user authentication is vulnerable to attacks when an adversary can obtain unauthorized privileges after a user’s initial login. Continuous user authentication (CA) has recently shown its great potential by enabling seamless user authentication with few users’ participation. We devise a low-cost system that can exploit users’ pulsatile signals from photoplethysmography (PPG) sensors in commodity wearable devices to perform CA. Our system requires zero user effort and applies to practical scenarios that have nonclinical PPG measurements with human motion artifacts (MAs). We explore the uniqueness of the human cardiac system and develop adaptive MA filtering methods to mitigate the impacts of transient and continuous activities from daily life. Furthermore, we identify general fiducial features and develop an adaptive classifier that can authenticate users continuously based on their cardiac characteristics with little additional training effort. Experiments with our wrist-worn PPG sensing platform on 20 participants under practical scenarios demonstrate that our system can achieve a high CA accuracy of over 90% and a low false detection rate of 4% in detecting random attacks. We show that our MA mitigation approaches can improve the CA accuracy by around 39% under both transient and continuous daily activity scenarios.

Deep learning (DL) has demonstrated great performance in various applications on powerful computers and servers. Recently, with the advancement of more powerful mobile devices (e.g., smartphones and touch pads), researchers are seeking DL solutions that could be deployed on mobile devices. Compared to traditional DL solutions using cloud servers, deploying DL on mobile devices have unique advantages in data privacy, communication overhead, and system cost. This article provides a comprehensive survey for the current studies of adopting and deploying DL on mobile devices. Specifically, we summarize and compare the state-of-the-art DL techniques on mobile devices in various application domains involving vision, speech/speaker recognition, human activity recognition, transportation mode detection, and security. We generalize an optimization pipeline for bringing DL to mobile devices, including model-oriented optimization mechanisms (e.g., pruning and quantization) and nonmodel-oriented optimization mechanisms (e.g., software accelerator and hardware design). Moreover, we summarize popular DL libraries regarding their support to state-of-the-art models (software) and processors (hardware). Based on our summarization, we further provide insights into potential research opportunities for developing DL for mobile devices.

Neuron networks pruning is effective in compressing pre-trained CNNs for their deployment on low-end edge devices. However, few works have focused on reducing the computational cost of pruning and inference. We find that existing pruning methods usually remove parameters without fine-grained impact analysis, making it hard to achieve an optimal solution. This work develops a novel mixture pruning mechanism, MIXP, which can effectively reduce the computational cost of CNNs while maintaining a high weight compression ratio and model accuracy. We propose to remove neuron bond that can effectively reduce convolution computations and weight size in CNNs. We also design an influence factor to analyze the importance of neuron bonds and weights in a fine-grained way so that MIXP could achieve precise pruning with few retraining iterations. Experiments with MNIST, CIFAR-10, and ImageNet datasets demonstrate that MIXP could achieve significantly fewer FLOPs and retraining iterations on four widely-used CNNs than existing pruning methods.

Drivers' identities are essential information that can facilitate a broad range of applications. For example, by understanding who is driving the vehicle when an accident happens, insurance companies could determine the liability and payment in a car accident claim case with high confidence. Another example, pick-up service companies could track the identities of their drivers to ensure that authorized drivers are driving esteemed clients to their destinations. While there are existing studies that can utilize video cameras and dedicated sensors to identify drivers, they either have privacy issues or require additional hardware, which is not practical enough for daily uses. In this paper, we devise a low-cost driver identification system, which can determine drivers' identities by using sensors readily available in wearable devices. Our system captures the unique driving behaviors during pervasive but momentary driving events (i.e., turning at intersections) with motion sensors, which are widely integrated into commodity wearable devices (e.g., smartphones and activity trackers). Toward this end, we extensively analyze people's driving behaviors and identify the critical turning events that capture people's unique behavioral patterns for driver identification. We design a fine-grained turning segmentation method that divides sensor data into critical turning stages (i.e., before, during, and after-turn stages), which provide multiple dimensions of turning behavioral metrics facilitating driver identification. The system extracts unique turning behavior features from time and frequency domains to enable driver identification based on drivers' turning behaviors at different types of turns. Extensive experiments are conducted with 12 drivers and various types of turns in real-road conditions. The results demonstrate that our system can identify drivers with high accuracy and low falsepositive rate based on one single turning event.

Traditional one-time user authentication processes might cause friction and unfavorable user experience in many widely-used applications. This is a severe problem in particular for security-sensitive facilities if an adversary could obtain unauthorized privileges after a user's initial login. Recently, continuous user authentication (CA) has shown its great potential by enabling seamless user authentication with few active participation. We devise a low-cost system exploiting a user's pulsatile signals from the photoplethysmography (PPG) sensor in commercial wrist-worn wearables for CA. Compared to existing approaches, our system requires zero user effort and is applicable to practical scenarios with non-clinical PPG measurements having motion artifacts (MA). We explore the uniqueness of the human cardiac system and design an MA filtering method to mitigate the impacts of daily activities. Furthermore, we identify general fiducial features and develop an adaptive classifier using the gradient boosting tree (GBT) method. As a result, our system can authenticate users continuously based on their cardiac characteristics so little training effort is required. Experiments with our wrist-worn PPG sensing platform on 20 participants under practical scenarios demonstrate that our system can achieve a high CA accuracy of over 90% and a low false detection rate of 4% in detecting random attacks.

Tracking human sleeping postures and vital signs of breathing and heart rates during sleep is important as it can help to assess the general physical health of a person and provide useful clues for diagnosing possible diseases. Traditional approaches (e.g., polysomnography) are limited to clinic usage. Recent radio frequency-based approaches require specialized devices or dedicated wireless sensors and are only able to track breathing rate. In this paper, we propose to track the vital signs of both breathing rate and heart rate during sleep by using off-the-shelf WiFi without any wearable or dedicated devices. Our system reuses existing WiFi network and exploits the fine-grained channel information to capture the minute movements caused by breathing and heart beats. Our system thus has the potential to be widely deployed and perform continuous long-term monitoring. The developed algorithm makes use of the channel information in both time and frequency domain to estimate breathing and heart rates, and it works well when either individual or two persons are in bed. Our extensive experiments demonstrate that our system can accurately capture vital signs during sleep under realistic settings, and achieve comparable or even better performance comparing to traditional and existing approaches, which is a strong indication of providing noninvasive, continuous fine-grained vital signs monitoring without any additional cost.

Tracking human vital signs of breathing and heart rates during sleep is important as it can help to assess the general physical health of a person and provide useful clues for diagnosing possible diseases. Traditional approaches (e.g., Polysomnography (PSG)) are limited to clinic usage. Recent radio frequency (RF) based approaches require specialized devices or dedicated wireless sensors and are only able to track breathing rate. In this work, we propose to track the vital signs of both breathing rate and heart rate during sleep by using off-the-shelf WiFi without any wearable or dedicated devices. Our system re-uses existing WiFi network and exploits the fine-grained channel information to capture the minute movements caused by breathing and heart beats. Our system thus has the potential to be widely deployed and perform continuous long-term monitoring. The developed algorithm makes use of the channel information in both time and frequency domain to estimate breathing and heart rates, and it works well when either individual or two persons are in bed. Our extensive experiments demonstrate that our system can accurately capture vital signs during sleep under realistic settings, and achieve comparable or even better performance comparing to traditional and existing approaches, which is a strong indication of providing non-invasive, continuous fine-grained vital signs monitoring without any additional cost.

Wireless spoofing attacks are easy to launch and can significantly impact the performance of networks. Although the identity of a node can be verified through cryptographic authentication, conventional security approaches are not always desirable because of their overhead requirements. In this paper, we propose to use spatial information, a physical property associated with each node, hard to falsify, and not reliant on cryptography, as the basis for 1) detecting spoofing attacks; 2) determining the number of attackers when multiple adversaries masquerading as the same node identity; and 3) localizing multiple adversaries. We propose to use the spatial correlation of received signal strength (RSS) inherited from wireless nodes to detect the spoofing attacks. We then formulate the problem of determining the number of attackers as a multiclass detection problem. Cluster-based mechanisms are developed to determine the number of attackers. When the training data are available, we explore using the Support Vector Machines (SVM) method to further improve the accuracy of determining the number of attackers. In addition, we developed an integrated detection and localization system that can localize the positions of multiple attackers. We evaluated our techniques through two testbeds using both an 802.11 (WiFi) network and an 802.15.4 (ZigBee) network in two real office buildings. Our experimental results show that our proposed methods can achieve over 90 percent Hit Rate and Precision when determining the number of attackers. Our localization results using a representative set of algorithms provide strong evidence of high accuracy of localizing multiple adversaries.

Security and privacy are two major concerns in supporting roaming users across administrative domains. In current practices, a roaming user often uses encrypted tunnels, e.g., Virtual Private Networks (VPNs), to protect the secrecy and privacy of her communications. However, due to its encrypted nature, the traffic flowing through these tunnels cannot be examined and regulated by the foreign network's firewall, which may lead the foreign network widely open to various attacks from the Internet. This threat can be alleviated if the users reveal their traffic to the foreign network or the foreign network reveals its firewall rules to the tunnel endpoints. However, neither approach is desirable in practice due to privacy concerns. In this paper, we propose a Cross-Domain Cooperative Firewall (CDCF) that allows two collaborative networks to enforce each other's firewall rules in an oblivious manner. In CDCF, when a roaming user establishes an encrypted tunnel between his home network and the foreign network, the tunnel endpoint (e.g., a VPN server) can regulate the traffic and enforce the foreign network's firewall rules, without knowing these rules. The key ingredients in CDCF are the distribution of firewall primitives across network domains, and the enabling technique of efficient oblivious membership verification. We have implemented CDCF and integrated it with the OpenVPN software, and evaluated its performance using extensive experiments. Our results show that CDCF can protect the foreign network from encrypted tunnel traffic with minimal overhead.

Smartphones have recently become increasingly popular because they provide "all-in-one" convenience by integrating traditional mobile phones with handheld computing devices. However, the flexibility of running third-party softwares also leaves the smartphones open to malicious viruses. In fact, hundreds of smartphone viruses have emerged in the past two years, which can quickly spread through various means such as SMS/MMS, Bluetooth and traditional IP-based applications. Our own implementations of two proof-of-concept viruses on Windows Mobile have confirmed the vulnerability of this popular smartphone platform.

Distributed fair queueing in a multihop, wireless ad hoc network is challenging for several reasons. First, the wireless channel is shared among multiple contending nodes in a spatial locality. Location-dependent channel contention complicates the fairness notion. Second, the sender of a flow does not have explicit information regarding the contending flows originated from other nodes. Fair queueing over ad hoc networks is a distributed scheduling problem by nature. Finally, the wireless channel capacity is a scarce resource. Spatial channel reuse, i.e., simultaneous transmissions of flows that do not interfere with each other, should be encouraged whenever possible. In this paper, we reexamine the fairness notion in an ad hoc network using a graph-theoretic formulation and extract the fairness requirements that an ad hoc fair queueing algorithm should possess. To meet these requirements, we propose maximize-local-minimum fair queueing (MLM-FQ), a novel distributed packet scheduling algorithm where local schedulers self-coordinate their scheduling decisions and collectively achieve fair bandwidth sharing. We then propose enhanced MLM-FQ (EMLM-FQ) to further improve the spatial channel reuse and limit the impact of inaccurate scheduling information resulted from collisions. EMLM-FQ achieves statistical short-term throughput and delay bounds over the shared wireless channel. Analysis and extensive simulations confirm the effectiveness and efficiency of our self-coordinating localized design in providing global fair channel access in wireless ad hoc networks.

This paper describes an algorithm that achieves delay and throughput decoupling in distributed fair scheduling in multihop ad-hoc wireless networks. The solution allows to support both low-bandwidth, low-delay and high-bandwidth, high delay applications in a single framework, without wasting much bandwidth to realize the low-delay requirement. We demonstrate the effectiveness of our algorithm in servicing various types of applications through ns-2 simulations.

Routers are expected to play an important role in the IP-based wireless data network. Although a substantial number of techniques have been proposed to improve wireless network performance under dynamic wireless channel conditions and host mobility, a system support framework is still missing. In this paper, we describe DIRAC, a software-based router system that is designed for wireless networks to facilitate the implementation and evaluation of various channel-adaptive and mobility-aware protocols. DIRAC adopts a distributed architecture that is composed of two parts: a Router Core (RC) shared by the wireless subnets, and a Router Agent (RA) at each access point/base station. RAs expose wireless link-layer information to the RC and enforce the control commands issued by the RC. This approach allows the router to make adaptive decisions based on link-layer information feedback. It also permits the router to enforce its policies (e.g., policing) more effectively through underlying link-layer mechanisms. As showcases, we implement under DIRAC the prototypes of three wireless network services: link-layer assisted fast handover, channel-adaptive scheduling, and link-layer enforced policing. Our implementation and experiments show that our distributed wireless router provides a flexible framework, which enables advanced network-layer wireless services that are adaptive to channel conditions and host mobility.

Sink mobility brings new challenges to large-scale sensor networking. It suggests that information about each mobile sink's location be continuously propagated through the sensor field to keep all sensor nodes updated with the direction of forwarding future data reports. Unfortunately frequent location updates from multiple sinks can lead to both excessive drain of sensors' limited battery power supply and increased collisions in wireless transmissions. In this paper we describe TTDD, a Two-Tier Data Dissemination approach that provides scalable and efficient data delivery to multiple mobile sinks. Each data source in TTDD proactively builds a grid structure which enables mobile sinks to continuously receive data on the move by flooding queries within a local cell only. TTDD's design exploits the fact that sensor nodes are stationary and location-aware to construct and maintain the grid structures with low overhead. We have evaluated TTDD performance through both analysis and extensive simulation experiments. Our results show that TTDD handles multiple mobile sinks efficiently with performance comparable with that of stationary sinks.

Distributed fair queueing in shared-medium ad hoc wireless networks is non-trivial because of the unique design challenges in such networks, such as location-dependent contention, distributed nature of ad hoc fair queueing, channel spatial reuse, and scalability in the presence of node mobility. In this paper, we seek to devise new distributed, localized, scalable and efficient solutions to this problem. We first analyze an ideal centralized fair queueing algorithm developed for ad hoc networks, and extract the desired global properties that the localized algorithms should possess. We then propose three localized fair queueing models, in which local schedulers self-coordinate their local interactions and collectively achieve the desired global properties. We further describe a novel implementation of the proposed models within the framework of the popular CSMA/CA paradigm and address several practical issues. Our simulations and analysis demonstrate the effectiveness of our proposed design.