Credential fraud is a widespread practice that undermines investment and confidence in higher education systems and bears significant economic and social costs. Legacy credential verification systems are typically time-consuming, costly, and bureaucratic, and struggle against certain classes of credential fraud. In this article, we propose a comprehensive blockchain-based credential verification solution, Cerberus, which is considerably more efficient, easy, and intuitive to use, and effectively mitigates widespread manifestations of credential fraud. Cerberus also improves significantly upon other blockchain-based solutions in the research literature: it adheres closely to the existing credential verification ecosystem and addresses real-world fraud scenarios. Moreover, Cerberus uses on-chain smart contracts for credential revocation, and it does not entail students or employers to manage digital identities or cryptographic credentials to use the system. We prototype our solution and describe our attempt to design an online verification service with a rich feature set, including data privacy, transcript verification, and selective disclosure of data. We hope this effort contributes positively to alleviating the problem of fake credentials.

Abstract Internet privacy is threatened by expanding use of automated mass surveillance and censorship techniques. In this paper, we investigate the feasibility of using video games and virtual environments to evade automated detection, namely by manipulating elements in the game environment to compose and share text with other users. This technique exploits the fact that text spotting in the wild is a challenging problem in computer vision. To test our hypothesis, we compile a novel dataset of text generated in popular video games and analyze it using state-of-the-art text spotting tools. Detection rates are negligible in most cases. Retraining these classifiers specifically for game environments leads to dramatic improvements in some cases (ranging from 6% to 65% in most instances) but overall effectiveness is limited: the costs and benefits of retraining vary significantly for different games, this strategy does not generalize, and, interestingly, users can still evade detection using novel configurations and arbitrary-shaped text. Communicating in this way yields very low bitrates (0.3-1.1 bits/s) which is suited for very short messages, and applications such as microblogging and bootstrapping off-game communications (dialing). This technique does not require technical sophistication and runs easily on existing games infrastructure without modification. We also discuss potential strategies to address efficiency, bandwidth, and security constraints of video game environments. To the best of our knowledge, this is the first such exploration of video games and virtual environments from a computer vision perspective.

Wearable technology is increasingly being used for medical applications such as continuous monitoring of chronically ill patients in homes and hospitals. The various stakeholders (patients, doctors, insurers) have an interest in ensuring not only that the data is untampered, but also that the context is verifiable (e.g., correct time and location can be associated with the data collected). Prior works have studied these aspects in isolation, typically using cryptographic techniques. In this paper, we develop a new solution that leverages the density of wireless devices in the vicinity of the transaction to create witness records ensuring data is tamper-protected and bound to its time and location context. Our first contribution is to develop a secure logging architecture that compacts witness records using Bloom filters and hash-chains them to bind them to the data, allowing fast and reliable forensic verification. Our second contribution is to identify the various configuration parameters influencing the performance of our scheme in terms of storage, processing, and transmission efficiency, and to quantify their effect on verification accuracy. Our third contribution implements and demonstrates the feasibility of our scheme, and quantifies its efficacy via simulation using real trace data from a multi-storey building representing a hospital environment.

The use of wearable devices, such as smartwatches, glasses, clothes, and fitness bracelets is increasing at an ever-growing pace. Major corporations and insurance companies have started mandating their use for their employees and clients. Data from such devices have begun to feature in settlement claims and as evidence in courts as well, requiring it to be irrefutable and tamper-proof. Lack of protection for personal data as well as the contextual information such as location tracking and its use by law enforcement agencies is raising serious privacy concerns among the general public and civil liberty advocates. In this article, we propose a novel scheme to secure the wearable sensor's communication through its crowdsourced logging by neighboring wearable and smart devices called witnesses preserving the contextual information (such as time and location) as well. To ensure witness privacy, gateway and witness devices use the reciprocity property of wireless medium between them to generate pairs of closely matching link signatures, which not only provide the proof of presence for the witnesses in the vicinity but also act as their time-varying pseudonyms. We demonstrate the feasibility and efficacy of our scheme through the prototype implementation using real wireless devices, and via simulation and experimental results.

Residential broadband gateways (comprising modem, router, and Wi-Fi access point), though individually consuming only 5-10 Watts of power, are significant contributors to overall network energy consumption due to large deployment numbers. Moreover, home gateways are typically always on, so as to provide continuous online presence to household devices for VoIP, smart metering, security surveillance, medical monitoring, etc. A natural solution for reducing the energy consumption of home gateways is to leverage the overlap of Wi-Fi networks common in urban environments and aggregate user traffic on to fewer gateways, thus putting the remaining to sleep. In this paper we propose, evaluate, and prototype an architecture that overcomes significant challenges in making this solution feasible at large-scale. We advocate a centralized approach, whereby a single authority co-ordinates the home gateways to maximize energy savings in a fair manner. Our solution can be implemented across heterogeneous ISPs, avoids client-side modifications (thus encompassing arbitrary user devices and operating systems), and permits explicit control of session migrations. We apply our solution to Wi-Fi traces collected in a building with 30 access points and 25,000 client connections, and evaluate via simulation the tradeoffs between energy savings, session disruptions, and fairness. We then prototype our system on commodity Wi-Fi access points, test it in a two-storey building emulating 6 residences, and demonstrate radio energy reduction of over 60 percent with little impact on user experience.

Software Defined Networking (SDN) is rapidly emerging as a new paradigm for managing and controlling the operation of networks ranging from the data center to the core, enterprise, and home. The logical centralization of network intelligence presents exciting challenges and opportunities to enhance security in such networks, including new ways to prevent, detect, and react to threats, as well as innovative security services and applications that are built upon SDN capabilities. In this paper, we undertake a comprehensive survey of recent works that apply SDN to security, and identify promising future directions that can be addressed by such research.

Wireless bodyworn sensing devices are fast becoming popular for fitness, sports training, and personalized healthcare applications. Securing data generated by these devices is essential if they are to be integrated into the current health infrastructure and employed in medical applications. In this paper, we propose a mechanism to secure the data provenance for these devices by exploiting spatio-temporal characteristics of the wireless channel that these devices use for communication. Our solution enables two parties to generate closely matching link fingerprints, which uniquely associate a data session with a wireless link such that a third party can later verify the details of the transaction, particularly the wireless link on which the data was transmitted. These fingerprints are very hard for an eavesdropper to forge; they are lightweight compared with traditional provenance mechanisms and enable interesting security properties such as accountability, nonrepudiation, and resist man-in-the-middle attacks. We validate our technique with experiments using bodyworn sensors in scenarios approximating actual device deployment and present some extensions, which reduce energy consumption. We believe this is a promising first step toward using wireless-link characteristics for the data provenance in body area networks.

Medical data collected by wearable wireless sensor devices must be adequately secured. A prerequisite for mass deployment of these secure systems is the ability to periodically renew cryptographic keys without user involvement. Recent work has shown that two communicating devices can generate secret keys directly from measurements of their common wireless channel, which is symmetric but cannot be inferred in detail by an eavesdropper. These schemes may, however, yield mismatching keys at the two ends, requiring reconciliation mechanisms with high implementation and energy costs, unsuitable for resource-poor body-worn devices. In this work, we demonstrate a scheme for secret-key generation able to construct shared keys with near-perfect agreement, thereby avoiding reconciliation costs. Our specific contributions are: (1) we identify non-simultaneous probing of the channel by the link end-points as the dominant cause of channel measurement disagreement; (2) we develop a practical filtering scheme to reduce this disagreement, dramatically improving signal correlation between the two ends without affecting key entropy; and (3) we show that by restricting key generation to periods of significant channel fluctuation, we achieve near-perfect key agreement. We demonstrate in several representative body-worn settings that our scheme can generate secret bits with 99.8% agreement, and so yield near-perfect matching 128-bit keys approximately every half hour.

Wireless bodyworn sensing devices are becoming popular for fitness, sports training and personalized healthcare applications. In this paper, we demonstrate a mechanism to secure data provenance for these devices by exploiting symmetric spatio-temporal characteristics of the wireless link between two communicating parties. Our solution enables both parties to generate closely matching 'link' fingerprints which uniquely associate a data session with a wireless link such that a third party, at a later date, can verify the links the data was communicated on. These fingerprints are unique, they are very hard for an eavesdropper to forge, lightweight compared to traditional provenance mechanisms, and allow for certain interesting security properties such as system accountability and non-repudiation.

Recent research has demonstrated that two communicating parties can generate shared secret keys by exploiting characteristics of the wireless fading channel between them. These channel characteristics are symmetric, dependent on position and orientation, highly sensitive to motion, and cannot be deduced in detail by an eavesdropper. One problem with this approach, however, is that over small channel sampling intervals, successively sampled values are correlated in time, which therefore yields keys with reduced entropy. In this paper, we undertake experiments to determine the efficacy of using channel hopping to increase diversity and improve secret key entropy, in the context of body area networks. We conduct extensive experiments using off-the-shelf IEEE 802.15.4 devices, mounted on the human body, in a real indoor environment. Our experimental results show that: (i) channel hopping increases frequency diversity and effectively decorre-lates successive channel samples, significantly increasing entropy (at minimum approximately 20%) and thereby improving the strength of the secret key, (ii) the benefit can be maximized by devising a hopping strategy that takes into account the number of channels available, the spacing between them, and the activity of the user.

Growing pressures on healthcare costs are spurring development of lightweight bodyworn sensors for real-time and continuous physiological monitoring. Data from these sensors is streamed wirelessly to a handheld device such as a mobile phone, and then archived over the Internet at a central database. Authenticating the data is vital to ensure proper diagnosis, traceability, and validation of claims. Digital signatures at the packet-level are too resource-intensive for bodyworn devices, while block-level signatures are not robust to loss. In this paper we propose, analyse, and validate a practical, lightweight robust authentication scheme suitable for health-monitoring. We make three specific contributions: (a) We develop an authentication scheme that is both low-cost (using a Merkle hash tree to amortise digital signature costs), and loss-resilient (using network coding to recover strategic nodes within the tree). (b) We develop a framework for optimising placement of network coding within the tree to maximise data verifiability for a given overhead and loss environment. (c) We validate our scheme using experimental traces of typical operating conditions to show that it achieves high success (over 99% of the medical data can be authenticated) at very low overheads (as low as 5% extra transmissions) and at very low cost (the bodyworn device has to perform a digital signature operation no more than once per hour). We believe our novel authentication scheme can be a key ingredient in the integration of wearable medical monitoring devices into current healthcare systems.

Wearable wireless sensor devices are key components in the emerging technology of personalized healthcare monitoring. Medical data collected by these devices must be secured, especially on the wireless link to the gateway equipment. However, it is difficult to manage the required cryptographic keys, as users may lack the awareness or requisite skills for this task. Alternatively, recent work has shown that two communicating devices can generate secret keys derived directly from symmetrical properties of the wireless channel between them. This channel is also strongly dependent on positioning and movement and cannot be inferred in detail by an eavesdropper. Existing schemes, however, yield keys with mismatching bits at the two ends, requiring reconciliation mechanisms with high implementation and energy costs that are unsuitable for resource-poor body-worn devices.

In this paper, we investigate the feasibility of real time derivation of cryptographic keys in body area networks using unique characteristics of the underlying wireless channel. We perform experiments to confirm that motion does indeed provide significant highly correlated randomness on either end of the wireless link between base station and mobile mote to enable real-time key generation. Furthermore, we demonstrate that channel characteristics for a dynamic body area network consist of two different components, a fast and a slow component, each of which make a qualitatively different contribution to key generation. These components can be isolated to address specific needs of the application scenario: the fast component can yield high entropy keys at a fast rate between base station and mobile mote with some bit disagreement between the two devices, the slow component generates keys at a lower rate but with very high level of bit agreement. Our experimental results highlight this tradeoff, and our key generation protocol details the key extraction process.

Certain popular wireless sensor network applications, including disaster recovery, battlefield communication and athlete monitoring, are characterized by extensive node mobility, intermittent contact between nodes and a highly dynamic network topology. Traditional routing protocols and security schemes are designed for essentially static networks and do not perform well in this case. This has given rise to a new multi-hop routing paradigm, that of ldquomobility-assistedrdquo routing in which nodes make strategic data store-and-forward decisions on a per-hop basis. In this paper we discuss the security challenges relevant to mobility-assisted routing and propose a scheme to secure data communication between nodes in highly mobile sensor networks. Our solution utilizes symmetric-key encryption to ensure data confidentiality and varies encryption key in a verifiable, non-forgeable manner to allow easy authentication. This scheme also provides data freshness, semantic security and per-hop encryption to enable secure data aggregation. To validate our basic assumptions and fine-tune our scheme, we collect and analyze link connectivity statistics from a dynamic sensor network application, athlete monitoring during a first-division university soccer club match. We show that our scheme is well-suited for certain dynamic environments and serves as an effective first step towards securing communications for mobile sensor networks.

Authenticity and secrecy of broadcast message content is important in wireless sensor networks deployed for battlefield control, emergency response, and natural resource management. Encryption of broadcast data requires the key to vary in time, typically via a key chain, so that a key compromised at a receiver does not compromise broadcast security for the entire network. An unfortunate consequence of time-varying keys is that a receiver that misses (due to packet loss) one or more keys from the chain cannot decrypt subsequent messages, thereby getting excluded from all broadcasts. In this paper we develop a scheme that allows receivers to recover from one or a few lost keys by having the transmitter probabilistically reuse old keys from the chain. Our scheme makes the broadcast system more robust to packet loss, at the expense of increasing vulnerability to compromised old keys. Analysis of our scheme shows how the trade-off can be controlled by tuning parameters, and a prototype implementation on a MicaZ mote testbed demonstrates the feasibility of our scheme in real sensor network platforms.