Smartphones incorporate a plethora of diverse and powerful sensors that enhance user experience. Two such sensors are accelerometer and gyroscope, which measure acceleration in all three spatial dimensions and rotation along the three axes of the smartphone, respectively. These sensors are used primarily for screen rotations and advanced gaming applications. However, they can also be employed to gather information about the user's activity and phone positions. In this work, we investigate using accelerometer and gyroscope as a side-channel to learn highly sensitive information, such as the user's gender. We present an unobtrusive technique to determine the gender of a user by mining data from the smartphone sensors, which do not require explicit permissions from the user. A preliminary study conducted on 18 participants shows that we can detect the user's gender with an accuracy of 80%.

Future cities are to be not only an intelligent and green living environment but also provide human-centered public services at a lower cost. The Internet of Things (IoT) and artificial intelligence (AI) are two cornerstone technologies enabling the smart city concept, which are fusing into an organic whole in recent years. Some particular joint points where IoT meets AI are intelligent IoT devices, smart sensing boosted by AI, and IoT big data mining with AI. Such “IoT meets AI” trend is already casting significant impact to enable a smart city. Some examples are: smartphones are able to learn the touching pattern of users; home Wi-Fi router can intelligently detect and locate an intruder; vehicles locations and movement information can be exploited for traffic control; video cameras installed in the street can perform face recognition locally.

Over the past decade, Hardware Trojans (HTs) research community has made significant progress towards developing effective countermeasures for various types of HTs, yet these countermeasures are shown to be circumvented by sophisticated HTs designed subsequently. Therefore, instead of guaranteeing a certain (low) false negative rate for a smallconstantset of publicly known HTs, a rigorous security framework of HTs should provide an effective algorithm to detect any HT from anexponentially largeclass (exponential in number of wires in IP core) of HTs with negligible false negative rate. In this work, we present HaTCh, the first rigorous algorithm of HT detection within the paradigm of pre-silicon logic testing based tools. HaTCh detects any HT from$H_D$, a huge class of deterministic HTs which is orders of magnitude larger than the small subclass (e.g., TrustHub) considered in the current literature. We prove that HaTCh offers negligible false negative rate and controllable false positive rate for the class$H_D$. Given certain global characteristics regarding the stealthiness of the HT within$H_D$, the computational complexity of HaTCh for practical HTs scales polynomially with the number of wires in the IP core. We implement and test HaTCh on TrustHub and other sophisticated HTs.

The expansion of monitoring systems for power grids from the traditional transmission lines to include the distribution grid - closer to the end-user - is largely due to the advance in electrical monitoring devices and their increasing affordability. This paradigm-shift benefits from new algorithms that can be implemented at the grid edge (as opposed to the transmission grid) to detect anomalies faster, more efficiently, and in real-time. Micro-PMUs (μ-PMUs) are phasor measurement units that can be placed on the distribution lines to provide real-time data about the state of the grid and can detect fast transients. In this paper, we use data from (μ-PMUs to engineer physics-based features for a novel anomaly detection algorithm that detects anomalies based on the transient properties of the power grid. This allows for a more capable, agile, and reliable anomaly scoring system that can learn normal behavior patterns and detect anomalous behavior efficiently. We show that by combining the classical data-based approaches with physics-based features in the anomaly detection algorithm, the machine learning algorithm proposed is capable of detecting different classes of anomalies (such as edge devices on-off attacks, single line-to-ground (SLG) faults, etc.). Simulation results on IEEE 34-node test feeder show that we can achieve better detection performance than traditional techniques for a broader class of anomalies.

This paper presents context-aware security technology for responsive and adaptive protection (CASTRA), an “always-on” context-aware authentication and access control framework that seamlessly and unobtrusively authenticate users to mobile applications of varying sensitivity levels. CASTRA uses a continuous and multifaceted behavioral biometrics authentication that passively authenticates the user in the background while the device is being in contact with the user, and a context-aware risk assessment and access control that provides access to applications based on the perceived threat level around the device. The behavioral authentication module is constructed by exploiting a combination of supervised and unsupervised learning techniques on raw sensor and GPS data passively gathered from the mobile device. Multiple inferences about the user (or user behavioral traits) such as frequently visited locations, location transition patterns, physical proximity of user with the device (e.g., device in the pocket or placed on the table), and walking patterns are automatically inferred and extracted. Analytical studies were conducted to derive optimal thresholds to fuse these multiple traits and an adaptive trust score is generated every user-defined time period to determine the degree to which the user is trustworthy to access the applications. CASTRA is implemented in a client-server mode, utilizing the Android and the Amazon Cloud computing platform. The novelty of CASTRA stems from the design and fusion of multiple behavioral biometric-based authentication factors and the development and deployment of a practical end-to-end architecture that enables real-time data acquisition, automatic training and learning of user behavioral patterns, and context-aware risk assessment and access control. The performance of CASTRA was evaluated under natural settings, on 15 subjects, using different variants of the Samsung devices. Multiple realistic attack scenarios (e.g., stolen, lost, and shared devices) targeting mobile devices were designed to prove the security and user-friendliness of the proposed scheme. We also present techniques to reduce energy and bandwidth consumption and ways to unobtrusively acquire data for supervised learning algorithms without requiring explicit user annotation.

ZigBee has been widely recognized as an important enabling technique for Internet of Things (IoT). However, the ZigBee nodes are normally resource-limited, making the network susceptible to a variety of security threats. This paper closely investigates a severe attack on ZigBee networks termed as ghost, which leverages the underlying vulnerabilities of the IEEE 802.15.4 security suites to deplete the energy of the nodes. We show that the impact of ghost is very large and that it can facilitate a variety of threats including denial of service and replay attacks. We highlight that merely deploying a standard suite of advanced security techniques does not necessarily guarantee improved security, but instead might be leveraged by adversaries to cause severe disruption in the network. We propose several recommendations on how to localize and withstand the ghost and other related attacks in ZigBee networks. Extensive simulations are provided to show the impact of the ghost and the performance of the proposed recommendations. Moreover, physical experiments also have been conducted and the observations confirm the severity of the impact by the ghost attack. We believe that the presented work will aid the researchers to improve the security of ZigBee further.

The greedy maximal scheduling (GMS) and maximal scheduling (MS) algorithms are well-known low-complexity scheduling policies with guaranteed capacity region in the context of single-radio single-channel (SR-SC) wireless networks. However, how to design maximal scheduling algorithms for multiradio multichannel (MR-MC) wireless networks and the associated capacity analysis are not well understood yet. In this paper, we develop a new model by transforming an MR-MC network node to multiple node-radio-channel (NRC) tuples. Such a framework facilitates the derivation of a tuple-based back-pressure algorithm for throughput-optimal control in MR-MC wireless networks and enables the tuple-based GMS and MS scheduling as low-complexity approximation algorithms with guaranteed performance. An important existing work on GMS and MS for MR-MC networks is that of Lin and Rasool (IEEE/ACM Trans. Networking, vol. 17, no. 6, 1874-1887, Dec. 2009), where link-based algorithms are developed. Compared to the link-based algorithms, the tuple-based modeling has significant advantages in enabling a fully decomposable cross-layer control framework. Another theoretical contribution in this paper is that we, for the first time, extend the local-pooling factor analysis to study the capacity efficiency ratio of the tuple-based GMS in MR-MC networks and obtain a lower bound that is much tighter than those known in the literature. Moreover, we analyze the communications and computation overhead in implementing the distributed MS algorithm and present simulation results to demonstrate the performance of the tuple-based maximal scheduling algorithms.

In this work, we propose a modified DEFENSE architecture termed as xDEFENSE that can detect and react to hardware attacks in real-time. In the past, several Root of Trust architectures such as DEFENSE and RETC have been proposed to foil attempts by hardware Trojans to leak sensitive information. In a typical Root of Trust architecture scenario, hardware is allowed to access the memory only by responding properly to a challenge requested by the memory guard. However in a recent effort, we observed that these architectures can in fact be susceptible to a variety of threats ranging from denial of service attacks, privilege escalation to information leakage, by injecting a Trojan into the Root of Trust modules such as memory guards and authorized hardware. In our work, we propose a security monitor that monitors all transactions between the authorized hardware, memory guard and memory. It also authenticates these components through the use of Hashed Message Authentication Codes (HMAC) to detect any invalid memory access or denial of service attack by disrupting the challenge-response pairs. The proposed xDEFENSE architecture was implemented on a Xilinx SPARTAN 3 FPGA evaluation board and our results indicate that xDEFENSE requires 143 additional slices as compared to DEFENSE and incurs a monitoring latency of 22ns.

Hardware Trojan Threats (HTTs) are stealthy components embedded inside integrated circuits (ICs) with an intention to attack and cripple the IC similar to viruses infecting the human body. HTTs are easily introduced into the IC using untrusted tools and unauthenticated intellectual property (IP). Previous efforts have focused essentially on systems being compromised using HTTs and the effectiveness of physical parameters including power consumption, timing variation and utilization for detecting HTTs. Less attention has been devoted to the monitoring of the system to analyze the HTT infection using a combination of affected physical parameters. We propose a novel metric for hardware Trojan detection, termed as HTT detectability metric (HDM) that leverages a weighted combination of normalized physical parameters. As opposed to existing studies, this work investigates a system model from a designer perspective in increasing the security of the device and an adversary model from an attacker perspective exposing and exploiting the vulnerabilities in the device. Based on the models, seven malicious HTTs were designed and implemented on a FPGA testbed to perform a variety of threats ranging from sensitive information leak, denial of service to beat the Root of Trust (RoT). Security analysis on the implemented Trojans clearly showed that existing detection techniques based on physical characteristics such as power consumption, timing variation or utilization does not necessarily capture the existence of HTTs as HTTs can be optimally designed and placed into the hardware that masks within these parameters. Our results showed that using HDM, 86% of the implemented Trojans were detected as opposed to using power, timing and utilization alone.

With the rapid growth of smartphone and tablet users, Device-to-Device (D2D) communications have become an attractive solution for enhancing the performance of traditional cellular networks. However, relevant security issues involved in D2D communications have not been addressed yet. In this paper, we investigate the security requirements and challenges for D2D communications, and present a secure and efficient key agreement protocol, which enables two mobile devices to establish a shared secret key for D2D communications without prior knowledge. Our approach is based on the Diffie-Hellman key agreement protocol and commitment schemes. Compared to previous work, our proposed protocol introduces less communication and computation overhead. We present the design details and security analysis of the proposed protocol. We also integrate our proposed protocol into the existing Wi-Fi Direct protocol, and implement it using Android smartphones.

Hardware Trojan Threats (HTTs) are stealthy components embedded inside integrated circuits (ICs) with an intention to attack and cripple the IC similar to viruses infecting the human body. Previous efforts have focused essentially on systems being compromised using HTTs and the effectiveness of physical parameters including power consumption, timing variation and utilization for detecting HTTs. We propose a novel metric for hardware Trojan detection coined as HTT detectability metric (HDM) that uses a weighted combination of normalized physical parameters. HTTs are identified by comparing the HDM with an optimal detection threshold; if the monitored HDM exceeds the estimated optimal detection threshold, the IC will be tagged as malicious. As opposed to existing efforts, this work investigates a system model from a designer perspective in increasing the security of the device and an adversary model from an attacker perspective exposing and exploiting the vulnerabilities in the device. Using existing Trojan implementations and Trojan taxonomy as a baseline, seven HTTs were designed and implemented on a FPGA testbed; these Trojans perform a variety of threats ranging from sensitive information leak, denial of service to beat the Root of Trust (RoT). Security analysis on the implemented Trojans showed that existing detection techniques based on physical characteristics such as power consumption, timing variation or utilization alone does not necessarily capture the existence of HTTs and only a maximum of 57% of designed HTTs were detected. On the other hand, 86% of the implemented Trojans were detected with HDM. We further carry out analytical studies to determine the optimal detection threshold that minimizes the summation of false alarm and missed detection probabilities.

The main-thread approach for optimizing the throughput capacity over a multihop wireless network is to apply a multi-commodity flow (MCF) formulation, augmented with a scheduling constraint derived from the conflict graph associated with the network. A fundamental issue with the conflict graph based MCF formulation is that finding all independent sets (ISs) for scheduling is NP-hard in general. If we express the MCF formulation in a matrix format, the constraint matrix will contain a very large number of columns, with each IS being associated with one column. According to the linear programming theorem, such a type of problem can be addressed with the delayed column generation (DCG) method. Unfortunately, applications of the DCG in wireless networks have not received much attention. To the best of knowledge, none of the existing work conducted theoretical studies of the performance of DCG in wireless networks. In this paper, we study the DCG method in the context of a general network flow problem. With a protocol interference model, we rigorously prove that searching an entering column in the DCG operation is equivalent to a maximum weighted independent set (MWIS) problem. A prominent theoretical contribution of this paper is the theorem that: if an MWIS approximation algorithm with the approximation ratio β (<1) is applied in the DCG method, the maximum flow solved will be at least β of the optimal solution. Furthermore, the DCG method is also applied to the multi-radio multi-channel (MR-MC) networks. With extensive numerical results comparing to the existing methods, we show that the DCG method achieves the most preferred tradeoff between computation complexity and network capacity and maintains good scalability when addressing large-scale networks, particularly in the complex MR-MC context.

Field programmable gate arrays (FPGA) are extensively used for rapid prototyping in embedded system applications. While hardware acceleration can be done via specialized processors like a Graphical Processing Unit (GPU), they can also be accomplished with FPGAs for more specialized scenarios. GPUs essentially consist of massively parallel cores and have high memory bandwidth; FPGAs, on the other hand, provide flexibility in terms of customizable I/O and computational resources. In this paper, we explore the usage of GPUs and FPGAs as cryptographic co-processors in streaming dataflow systems with huge rate of data inhalation. Two classic lightweight encryption algorithms, Tiny Encryption Algorithm (TEA) and Extended Tiny Encryption Algorithm (XTEA), are targeted for implementation on GPUs and FPGAs. The GPU implementations of TEA and XTEA in this study depict a maximum speedup of 13x over CPU based implementation. The pipelined FPGA implementation is able to realize a throughput of 6-9x more than the GPU for small plaintext sizes.

The main focus of this paper is to show theoretically that power is a crucial factor in multi-radio multi-channel (MR-MC) wireless networks and hence by judiciously leveraging the power, one can realize a considerable gain on the capacity for MR-MC wireless networks. Such a capacity gain through power enhancement is revealed by our new insights of a co-channel enlarging effect. In particular, when the number of available channels (c) in a network is larger than that necessary for enabling the maximum set of simultaneous transmissions (c̃), allocating transmissions to those additional c-c̃ channels could enlarge the distance between the co-channel transmissions; the larger co-channel distance then allows a higher transmission power for higher link capacity. The finding of this paper specifically indicate that by exploiting the co-channel enlarging effect with power, one can realize the following gain on the capacity for MR-MC wireless networks: (i) In the channel-constraint region (c̃minto Pminc/c̃α/2, then a gain of Θ(log(c/c̃)α/2) is achieved; (ii) In the power-constraint region (c ≥ nφ/2), if each node sends at the maximum power level, Pmax= Pmin.nKor Pmin.2nφ/2, depending on the power availability at a node, then a gain of Θ(log n) or Θ(n) is achieved, respectively.

How much information can one transmit over a randomly distributed ad hoc network of n secondary devices, overlaid with m primary devices? Such a network model is referred to as cognitive wireless network (CWN) and our paper addresses the above question by characterizing its throughput capacity. Although a handful of research efforts related to throughput capacity exist in the area of CWNs, most of these solutions under-explore the capacity analysis. Their analysis particularly indicates that secondary devices can realize only a less or no gain on throughput capacity, in comparison to classical ad hoc networks, when the primary devices are densely placed in the network. Our detailed investigation shows that this unsatisfying capacity figure is due to the unrealistic assumptions and inefficient allocation of wireless spectrum for secondary devices, while formulating the capacity analysis. By resolving the issues in existing research efforts, we enhance the throughput capacity of secondary devices in CWN and at the heart of our analysis lies a novel spectrum usage policy known as γ-distance spectrum usage policy for secondary devices. In contrast to classical ad hoc networks, our results stipulate that when primary devices are densely placed in the network with an i.i.d inactive period of Poff, cognitive wireless network can realize an aggregate throughput capacity of WPoffγ√(m)off/γ√(n/log n) under the constraint Poffγ√(m)off/γ>; 1. This is in fact an interesting result which claims that by judiciously allocating the traffic of secondary devices in the licensed and unlicensed spectrum bands, one can enhance the throughput capacity of cognitive wireless networks.

In our previous work [9], we investigated the capacity and delay of a static hybrid wireless network, consisting of n static wireless nodes overlaid with a cellular architecture of m base stations. By employing a more practical and simple routing policy, we proved that each wireless node can be realized with a throughput that scales sublinearly or linearly with m. This was in fact a significant result as opposed to prior works on hybrid wireless networks which claims that if m grows slower than some threshold, the benefit of augmenting those base stations to the pure ad hoc network is insignificant. Albeit our novel approach can render improved benefits in terms of capacity and delay as opposed to prior efforts, the analysis shows that one requires a large deployment cost in order to achieve a Θ(1) capacity. Existing research efforts also indicate that for pure mobile ad hoc networks, a capacity of Θ(1) can be achieved by exploiting the mobility of the nodes, at the expense of very high end-to-end delay. This larger delay, nevertheless, stems from the assumption of global mobility, where nodes move around the entire network. In this paper, by leveraging a more practical and restricted mobility model, we investigate the capacity and delay of our hybrid wireless network design with n mobile nodes and m base stations, termed as mobile hybrid wireless network. Interestingly, our results show that each node can be realized with a capacity of Θ(1), while keeping the average end-to-end delay smaller by a factor of m than the pure mobile ad hoc networks.

How much information can one send through a random ad hoc network of n nodes, if overlaid with a cellular architecture of m base stations? This network model is commonly referred to as hybrid wireless networks and our paper analyzes the above question by characterizing its throughput capacity. Although several research efforts related to throughput capacity exist in the area of hybrid wireless networks, most of these solutions under-explore the capacity analysis. Their results particularly indicate that one can realize only a less than log or no gain on capacity, as compared to pure ad hoc networks, when m scales slower than some threshold. This unsatisfying capacity gain is due to the fact that the base stations were not properly exploited while formulating the capacity analysis. Moreover, these research efforts also assume an one-hop wireless uplink between a node and its associated base station. Nevertheless, with those power-constrained wireless nodes, this assumption clearly indicates an unrealistic scenario. In this paper, we establish the bounds on capacity and delay by resolving the issues in existing efforts and at the heart of our analysis lies a simple routing policy known as same cell routing policy. Our findings particularly stipulate that whether m = O(n/log n) or Ω(n/log n), each node can realize a throughput that scales, sublinearly or linearly, with m. This is in fact a significant result as opposed to previous efforts which claims that if m grows slower than some threshold, the benefit of augmenting those base stations to the original ad hoc network is insignificant. Our analysis also shows that for a maximum per node throughput Λ(n, m), the average end-to-end delay in a hybrid network can be bounded by Θ(Λ(n, m)n/m), which has an inverse relationship to m.

One of the crucial challenges in practical wireless networks is how to provide robust communication over fading channels. Recently, cooperative communications have emerged as a promising approach to achieve spatial diversity and thereby reduce the negative effects of fading on wireless channels. Nevertheless, a few existing works indicate that deploying cooperative relays in large-scale wireless networks can lead to an elevated level of interference which in turn leads to degraded throughput and higher packet losses. It is also well-known that the use of multiple frequency channels can mitigate the wireless interference to a greater extent and thus improve the overall performance of a wireless network. Therefore, it is interesting and important to design and evaluate protocols that can provide the combined potential of both cooperation communication and multiple channels. In this paper, we propose a novel cooperative multi-channel MAC protocol that integrates the capabilities of both multiple channels and cooperative communications at the MAC layer to improve the performance of wireless networks. The performance improvement of our proposed solution is further evaluated by extensive simulations.

The existence of channel variations (or fading) is one of the crucial challenges that affects the capacity of wireless networks. Recently, cooperative communications have emerged as a promising approach to achieve spatial diversity and thereby reduce the negative effects of fading on wireless channels. On the other hand, in addition to channel variations, it is well-known that interference among concurrent transmissions also severely limits the network capacity particularly in multi-hop settings. Recent studies indicate that the use of multiple channels can reduce the wireless interference and thus greatly improve the overall network capacity. In this paper, we propose a model termed as CoopMC which employs multiple channels in cooperative networks to mitigate the impact of interference. This work primarily investigates the capacity of CoopMC in multi-hop settings and derive the asymptotic capacity bounds under random placements of nodes. Our analysis reveals the important insights on when a network can benefit from cooperative communications and how multi-channel networking can further improve the network capacity.

Transmission power plays a crucial role in the design and performance of wireless networks. The issue is therefore complex since an increase in transmission power implies that a high quality signal is received at the receiver and hence an increase in channel capacity. Conversely, due to the shared nature of the wireless medium an increase in transmission power also implies high interference in the surrounding region and hence a quadratic reduction in the capacity of wireless networks. Recent literatures indicate that employing multiple channels can mitigate the negative effects of wireless interference and thus greatly improve the overall network capacity. Therefore, it is worth investigating the effect of exploiting power on the capacity of multi-channel multi-radio (MC-MR) wireless networks. Specifically, in this paper we address the following questions: (a) Can we maximize the capacity of MC-MR wireless networks by exploiting power? (b) Under what criteria can we increase the transmission power of the nodes in a MC-MR network? When n nodes each with m half-duplex interfaces are optimally deployed in a torus of unit area, traffic patterns are optimally assigned, each transmission's range is optimally chosen and in the presence of c channels, we show that in contrast to the setting where nodes transmit at minimum power level Po the transport capacity, measured in bit-meters per second, of MC-MR network exploiting power is increased by Θ(cmin) in region cmin0(c/cmin)α/2and P0nα/2respectively-where cminis the minimum number of channels required to achieve conflict-free transmissions in a network. Our analysis also sheds light into several insights that designers may want to consider to improve the performance of energy-efficient bandwidth-constrained wireless networks.

In this paper, we consider a special case of denial of service (DoS) attack in wireless mesh networks (WMNs) known as selective forwarding attack (a.k.a gray hole attacks). With such an attack, a misbehaving mesh router just forwards a subset of the packets it receives but drops the others. While most of the existing studies on selective forwarding attacks focus on attack detection under the assumption of an error-free wireless channel, we consider a more practical and challenging scenario that packet dropping may be due to an attack, or normal loss events such as medium access collision or bad channel quality. Specifically, we develop a channel aware detection (CAD) algorithm that can effectively identify the selective forwarding misbehavior from the normal channel losses. The CAD algorithm is based on two strategies, channel estimation and traffic monitoring. If the monitored loss rate at certain hops exceeds the estimated normal loss rate, those nodes involved will be identified as attackers. Moreover, we carry out analytical studies to determine the optimal detection thresholds that minimize the summation of false alarm and missed detection probabilities. We also compare our CAD approach with some existing solutions, through extensive computer simulations, to demonstrate the efficiency of discriminating selective forwarding attacks from normal channel losses.

Gray hole attacks (a.k.a selective forwarding attacks) are a special case of denial of service (DoS) attack, where a misbehaving mesh router just forwards a subset of the packets it receives but drops the others. In wireless networks, it is particularly hard to detect the presence of such attackers because a packet loss over the wireless link can be due to bad channel quality, medium access collisions, or intentional dropping. In contrast to existing studies, we propose a more practical algorithm known as channel aware detection (CAD) that adopts two strategies, hop-by-hop loss observation and traffic overhearing, to detect the mesh nodes subject to the attack. We derive the optimal detection thresholds by analyzing the false alarm and missed detection probabilities of CAD. We also compare our approach to existing solutions and demonstrate that CAD detects the attackers effectively even in harsh channel conditions.

The static nature of mesh nodes imposes requirements for designing routing metrics that support high throughput and low packet delay. This paper considers the problem of interference-load aware routing in multi channel wireless mesh networks. We propose a new Interference-Load Aware routing metric, ILA, that finds paths with reduced inter-flow and intra-flow interference. The aim of this metric is to route the traffic through congestion free areas and balance the load amongst the network nodes. We incorporate this new metric in the well known AODV routing protocol and study the performance of ILA through simulations. We show that the proposed metric is able to adapt to changes in interfering traffic better than existing link metrics such as ETT and MIC. We also demonstrate that our metric delivers high throughput in multi channel networks.