In recent years, the security of automotive Cyber-Physical Systems (CPSs) is facing urgent threats due to the widespread use of legacy in-vehicle communication systems. As a representative legacy bus system, the Controller Area Network (CAN) hosts Electronic Control Units (ECUs) that are crucial for the vehicles functioning. In this scenario, malicious actors can exploit the CAN vulnerabilities, such as the lack of built-in authentication and encryption schemes, to launch CAN bus attacks (e.g., suspension, injection, and masquerade attacks) with life-threatening consequences (e.g., disabling brakes). In this article, we present TACAN (Transmitter Authentication in CAN), which provides secure authentication of ECUs on the legacy CAN bus by exploiting thecovert channels, without introducing CAN protocol modifications or traffic overheads (no extra bits or CAN messages are used). TACAN turns upside-down the originally malicious concept of covert channels and exploits it to build an effective defensive technique that facilitates transmitter authentication via a centralized, trusted Monitor Node. TACAN consists of three different covert channels for ECU authentication: 1) the Inter-Arrival Time (IAT)-based, leveraging the IATs of CAN messages; 2) the Least Significant Bit (LSB)-based, concealing authentication messages into the LSBs of normal CAN data; and 3) a hybrid covert channel, exploiting the combination of the first two. In order to validate TACAN, we implement the covert channels on the University of Washington (UW) EcoCAR (Chevrolet Camaro 2016) testbed. We further evaluate the bit error, throughput, and detection performance of TACAN through extensive experiments using the EcoCAR testbed and a publicly available dataset collected from Toyota Camry 2010. We demonstrate the feasibility of TACAN and the effectiveness of detecting CAN bus attacks, highlighting no traffic overheads and attesting the regular functionality of ECUs.

This paper presents a new masquerade attack called the cloaking attack and provides formal analyses for clock skew-based intrusion detection systems (IDSs) that detect masquerade attacks in the controller area network (CAN) in automobiles. In the cloaking attack, the adversary manipulates the message inter-transmission times of spoofed messages by adding delays so as to emulate a desired clock skew and avoid detection. In order to predict and characterize the impact of the cloaking attack in terms of the attack success probability on a given CAN bus and IDS, we develop formal models for two clock skew-based IDSs, i.e., the state-of-the-art (SOTA) IDS and its adaptation to the widely used network time protocol (NTP), using parameters of the attacker, the detector, and the hardware platform. To the best of our knowledge, this is the first paper that provides formal analyses of clock skew-based IDSs in automotive CAN. We implement the cloaking attack on two hardware testbeds, a prototype and a real vehicle (the University of Washington EcoCAR), and demonstrate its effectiveness against both the SOTA and NTP-based IDSs. By comparing each predicted attack success probability curve against its experimental curve, we find that the average prediction error is within 3.0% for the SOTA IDS and 5.7% for the NTP-based IDS.

The paradigm of shared spectrum allows secondary devices to opportunistically access spectrum bands underutilized by primary owners. Recently, the FCC has targeted the sharing of the 3.5 GHz (3550-3700 MHz) federal spectrum with commercial systems such as small cells. The rules require a spectrum access system (SAS) to accommodate three service tiers: 1) incumbent access; 2) priority access (PA); and 3) generalized authorized access (GAA). In this paper, we study the SAS-assisted dynamic channel assignment (CA) for PA and GAA tiers. We introduce the node-channel-pair conflict graph to capture pairwise interference, channel and geographic contiguity constraints, spatially varying channel availability, and coexistence awareness. The proposed graph representation allows us to formulate PA CA and GAA CA with binary conflicts as max-cardinality and max-reward CA, respectively. Approximate solutions can be found by a heuristic-based algorithm that searches for the maximum weighted independent set. We further formulate GAA CA with non-binary conflicts as max-utility CA. We show that the utility function is submodular, and the problem is an instance of matroid-constrained submodular maximization. A local-search-based polynomial-time algorithm is proposed which provides a provable performance guarantee. Extensive simulations using a real-world Wi-Fi hotspot location data set are performed to evaluate the proposed algorithms. Our results have demonstrated the advantages of the proposed graph representation and improved performance of the proposed algorithms over the baseline algorithms.

Coexistence of Wi-Fi and LTE Unlicensed (LTE-U) in shared or unlicensed bands has drawn growing attention from both academia and industry. An important consideration is fairness between Wi-Fi and duty cycled LTE-U, which is often defined in terms of channel access time, as adopted by the LTE-U Forum. Despite many studies on duty cycle adaptation design for fair sharing, one crucial fact has often been neglected: LTE-U systems unilaterally control LTE-U duty cycles; hence, as selfinterested users, they have incentives to misbehave, e.g., transmitting with a larger duty cycle that exceeds a given limit, so as to gain a greater share in channel access time and throughput. In this paper, we propose a scheme that allows the spectrum manager managing the shared bands to estimate the duty cycle of a target LTE-U cell based on PHY layer observations from a nearby Wi-Fi AP, without interrupting normal Wi-Fi operations. We further propose a thresholding scheme to detect duty cycling misbehavior (i.e., determining if the duty cycle exceeds the assigned limit), and analyze its performance in terms of detection and false alarm probabilities. The proposed schemes are implemented in ns3 and evaluated with extensive simulations. Our results show that the proposed scheme provides an estimate within ± 1% of the true duty cycle, and detects misbehavior with a duty cycle 2.8% higher than the limit with a detection probability of at least 95%, while keeping the false alarm probability less than or equal to 1%.

It is a promising vision to exploit white spaces , that is, vacant VHF and UHF TV channels, to meet the rapidly growing demand for wireless data services in both outdoor and indoor scenarios. While most prior works have focused on outdoor white space, the indoor story is largely open for investigation. Motivated by this observation and discovering that 70% of the spectrum demand comes from indoor environment, we carry out a comprehensive study to explore indoor white spaces. We first conduct a large-scale measurement study and compare outdoor and indoor TV spectrum occupancy at 30+ diverse locations in a typical metropolis—Hong Kong. Our results show that abundant white spaces are available in different areas in Hong Kong, which account for more than 50% and 70% of the entire TV spectrum in outdoor and indoor scenarios, respectively. Although there are substantially more white spaces indoors than outdoors, there have been very few solutions for identifying indoor white space. To fill in this gap, we develop the first data-driven, low-cost indoor white space identification system for White-space Indoor Spectrum EnhanceR (WISER), to allow secondary users to identify white spaces for communication without sensing the spectrum themselves. We design the architecture and algorithms to address the inherent challenges. We build a WISER prototype and carry out real-world experiments to evaluate its performance. Our results show that WISER can identify 30%--40% more indoor white spaces with negligible false alarms, as compared to alternative baseline approaches.

White Space (WS) Networking crucially relies on the active monitoring of spatio-temporal spectrum usage (to identify WS opportunities). To achieve this, one way is to gather spectrum data via wide-area sensor deployment and construct better Radio Environment Maps (REMs) with spatial models such as Kriging and Gaussian Process (GP). An economically viable alternative is via incentivized crowdsourcing, i.e., outsourcing sensing tasks to mobile users who have sensorized high-end client devices like tablets or smartphones, and providing proper incentives to compensate for users' sensing costs. In crowdsourced REM, features that impact REM performance and economic cost include user locations and the heterogeneity of user devices, which impact data quality and sensing costs. In this work, we emphasize the use of a hardware noise term in the GP model to account for data quality, and adopt mutual information to quantify sampling performance; we further design a pricing mechanism that allows the platform to maximize its expected utility at each stage and send optimal price offers to users sequentially, with joint consideration of sampling value, data quality and cost. We conduct simulations to evaluate the performance. Simulation results show that our mechanism outperforms two baseline mechanisms, and benefits from more users and less hardware noise (i.e., better data quality).

It is a promising vision to utilize white spaces, i.e., vacant VHF and UHF TV channels, to satisfy skyrocketing wireless data demand in both outdoor and indoor scenarios. While most prior works have focused on exploring outdoor white spaces, the indoor story is largely open for investigation. Motivated by this observation and that 70% of the spectrum demand comes from indoor environments, we carry out a comprehensive study of exploring indoor white spaces. We first present a large-scale measurement of outdoor and indoor TV spectrum occupancy in 30+ diverse locations in a typical metropolis Hong Kong. Our measurement results confirm abundant white spaces available for exploration in a wide range of areas in metropolises. In particular, more than 50% and 70% of the TV spectrum are white spaces in outdoor and indoor scenarios, respectively. While there are substantially more white spaces in indoor scenarios than in outdoor scenarios, there is no effective solution for identifying indoor white spaces. To fill in this gap, we propose the first system WISER (for White-space Indoor Spectrum EnhanceR), to identify and track indoor white spaces in a building, without requiring user devices to sense the spectrum. We discuss the design space of such system and justify our design choices using intensive real-world measurements. We design the architecture and algorithms to address the inherent challenges. We build a WISER prototype and carry out real-world experiments to evaluate its performance. Our results show that WISER can identify 30%-50% more indoor white spaces with negligible false alarms, as compared to alternative baseline approaches.