Cross-domain communication systems are important in multiple areas such as smart factories and automatic driving. Derived from real-life scenarios, each domain has a local network and accesses the public network via a central server, which makes it easy to manage the local network and protect entities in the domain. Based on this, a cross-domain communication system follows the “ device-server-server-device ” pattern. For each communication session, there are two steps: authentication and communication. The authentication phase helps two parties to build a secure communication channel. If the server is compromised, the authentication request can be sent to the attacker and then the attacker can impersonate the original receiver. As a result, it is necessary to effectively solve this server-compromise case. Further, anomaly detection is required to monitor the behaviors of entities in domains. Current deep learning solutions deploy autoencoder-based models to reconstruct input data and then detect anomalies. However, they feed raw input data into the models, which makes it hard to reconstruct evolving data streams. In this work, we focus on the detection of compromised entities for cross-domain communication systems. Specifically, we split the problem into two parts: the server-compromise case in the authentication phase and anomaly detection for the whole system. Toward the server-compromise case, we propose a blockchain-based “double verification” scheme to prevent the server from making decisions on its own. Specifically, nodes in the blockchain network evaluate submitted records using the public key infrastructure. Meanwhile, the distributed nature of blockchain allows us to deploy more machines as verifiers to monitor the behavior of servers. For anomaly detection, we propose to feed the degree of change of items instead of raw item values into deep learning models, which is more adaptive to evolving data streams. We propose to use the linear combination of historical data and recent data to compute the degree of change. Finally, we analyze the security properties of the proposed system and evaluate the proposed anomaly detection method using real datasets. We build a simple cross-domain communication system using the Fabric framework to simulate the “double verification” scheme and the proposed anomaly detection method achieves around 0.11 accuracy improvement on average.

Successful attacks against industrial control systems (ICSs) often exploit insufficient checking mechanisms. While firewalls, intrusion detection systems, and similar appliances introduce essential checks, their efficacy depends on the attackers’ ability to bypass such middleboxes. We propose a provenance solution to enable the verification of an end-to-end message delivery path and the actions performed on a message. Fast and flexible provenance verification (F2-Pro) provides cryptographically verifiable evidence that a message has originated from a legitimate source and gone through the necessary checks before reaching its destination. F2-Prorelies on lightweight cryptographic primitives and flexibly supports various communication settings and protocols encountered in ICS thanks to its transparent, bump-in-the-wire design. We provide formal definitions and cryptographically prove F2-Pro’s security. For human interaction with ICS via a field service device, F2-Profeatures a multi-factor authentication mechanism that starts the provenance chain from a human user issuing commands. We compatibility tested F2-Proon a smart power grid testbed and reported a sub-millisecond latency overhead per communication hop using a modest ARM Cortex-A15 processor.

Attacks against industrial control systems (ICSs) often exploit the insufficiency of authentication mechanisms. Verifying whether the received messages are intact and issued by legitimate sources can prevent malicious data/command injection by illegitimate or compromised devices. However, the key challenge is to introduce message authentication for various ICS communication models, including multicast or broadcast, with a messaging rate that can be as high as thousands of messages per second, within very stringent latency constraints. For example, certain commands for protection in smart grids must be delivered within 2 milliseconds, ruling out public-key cryptography. This paper proposes two lightweight message authentication schemes, named CMA and its multicast variant CMMA, that perform precomputation and caching to authenticate future messages. With minimal precomputation and communication overhead, C(M)MA eliminates all cryptographic operations for the source after the message is given, and all expensive cryptographic operations for the destinations after the message is received. C(M)MA considers the urgency profile (or likelihood) of a set of future messages for even faster verification of the most time-critical (or likely) messages. We demonstrate the feasibility of C(M)MA in an ICS setting based on a substation automation system in smart grids.

Communication availability is critical for the seamless and automated operation in urban transportation systems. Existing signaling systems for railways allow the trains to communicate only with the infrastructure, hence limiting the communication availability during handovers, failures, and unexpected operating conditions. We theoretically study the communication coverage improvements to be achieved by allowing the trains to relay signaling data to and from their neighboring trains under outage. We formulate a flexible spatial model to represent train locations statistically. Our model can be applied to different railway and traffic conditions by adjusting the distance-dependent probability function. We use the two-slope path loss model which has been shown to display good fit to signal measurements in tunnels. Our findings show that enabling cooperative relaying can reduce the outage events by up to 90% in dense railway networks.

For a radio resource-limited multi-tier machine-type communication (MTC) network, controlling random access congestion while satisfying the unique requirements of each tier (type) and guaranteeing fairness among nodes is always a challenge. In this paper, we study the network dimensioning and radio resource partitioning for the uplink of an MTC network with the signal-to-interference ratio-based clustering and relaying, where the MTC gateways (MTCGs) capture and forward the packets sent from MTC devices (MTCDs) to the base station (BS). Specifically, under transmission outage probability constraints, we investigate the trade-off between network utility (in terms of transmission capacity and revenue) and resource allocation fairness. With both outage probability constraints and minimum MTCD density constraints, we propose approaches to maximize the weighted sum of quality of experience of different tiers of MTCDs. Furthermore, a transmit power control strategy for MTCG-to-BS link is proposed to achieve a constant data rate.

To address the problem of multiple access for a large number of devices in machine-type communication (MTC), we study the use of full-duplex relays. In-band-full-duplex (IBFD) allows devices to receive and transmit concurrently on the same frequency band, potentially doubling the spectral efficiency. On the downside, the use of IBFD raises mutual interference due to an increased density of concurrently transmitting nodes. This paper deals with the tradeoff between the increased spectral efficiency and increased interference in utilizing the IBFD uplink relays in a densely deployed MTC network. Using stochastic geometry, we develop a framework to evaluate the end-to-end outage probability and the uplink data transmission rate in a single-hop relay network for MTC. A fraction of MTC devices (MTCDs) can be scheduled to transmit in the same band as the relay nodes, with the rest transmitting on an orthogonal band. The relay nodes, therefore, operate either as IBFD or out-band-full-duplex (OBFD) depending on their associated MTCD and forward packets to base stations (BSs). The BSs employ linear zero-forcing filters to cancel the interference from their associated relays. We calculate the optimal fraction of in-band MTCDs and relative transmit powers of relay and MTCDs to maximize the area spectral efficiency. The appeal of in-band scheduling increases as more antennas are deployed at the BS.

For a radio resource limited multi-tier Machine-type Communication (MTC) network, controlling random access congestion while satisfying the unique requirements of each tier and guaranteeing fairness among nodes is always a challenge. In this paper, we propose three approaches for network dimensioning and radio resource partitioning for the uplink of an MTC network with signal-to-interference ratio (SIR)-based clustering and relaying, where MTC gateways (MTCGs) capture and forward the packets sent from MTC devices (MTCDs) to the base station (BS). Assuming that each tier has a different outage probability constraint, our first resource allocation method achieves maximum sum network capacity, while the other two methods achieve suboptimal sum network capacity with higher degrees of fairness. The proposed methods are also applicable when the objective is the network operator's total revenue instead of sum network capacity.

To address massive access in machine-type communication (MTC), we consider in-band full- duplex (IBFD) relays to aggregate MTC packets. IBFD allows devices to receive and transmit concurrently on the same frequency band, potentially doubling the spectral efficiency. On the downside, the use of IBFD raises the interference due to an increased density of simultaneously transmitting nodes. This paper deals with a key trade-off between the increased spectral efficiency and interference in utilizing IBFD uplink relays in a densely deployed MTC network. Using stochastic geometry, we develop a framework to evaluate the end-to-end outage probability and uplink data aggregation rate. The model consists of MTC devices and IBFD relay nodes that forward MTC packets to base stations (BSs) over single-input-multiple-output channels. The BSs employ linear zero-forcing filters to cancel the interference from their associated relay nodes which may transmit simultaneously on the same frequency band. We show the somewhat surprising result that IBFD relaying does not lead to performance gains over half-duplex relays, when devices and relays are independently and homogeneously distributed in space.

To accommodate massive access for machine-type communication (MTC) in cellular networks, we propose two single-hop relaying schemes exclusively designed for the MTC: signal-to-interference ratio-based relaying and location-based relaying. The relay nodes capture one or more MTC device (MTCD) transmissions and forward them to the base station (BS), thus reducing the signaling overhead in the cellular network. To efficiently use the spectrum, MTCDs make concurrent transmissions, and therefore create interference with each other. Unlike related work assuming known interference values for each link, we use stochastic geometry to characterize the received signal and interference powers. We derive the outage probability expressions and analytically calculate the maximum density of MTCDs that can be supported under an outage constraint. Moreover, the optimal partitioning of spectrum resources into the MTCD-to-relay, and relay-to-BS links, for maximum transmission capacity is presented.

To accommodate massive access for machine-type communication (MTC) in cellular networks, we propose a signal-to-interference ratio based clustering for the MTC. The cluster heads operate as single hop relays between successfully decoded MTC devices (MTCDs) and the base station (BS), reducing the signaling overhead. MTCDs randomly select channels to transmit on, and therefore create interference to each other. Unlike related work assuming known interference values for each link, we use stochastic geometry to characterize the received signal and interference powers. Given limited spectrum resources for MTC, we derive the outage probability expression and analytically calculate the maximum density of MTCDs that can be supported under an outage constraint. Moreover, the optimal partitioning of spectrum resources into the MTCD-to-cluster head links and relay links for maximum transmission capacity is presented.

The transmission capacity of wireless networks is limited by the intensity of the interference received from concurrent transmissions. Interference causes serious performance degradation, particularly when no centralized controller within the network exists. Cognitive radio (CR) is a promising solution for distributed interference management as users with CR capabilities can acquire local activity and position information to achieve spatial reuse while limiting interference to neighboring users. Considering a two-tier network consisting of a licensed primary network overlaid by an unlicensed secondary tier, this paper proposes CR-based spectrum access schemes for secondary users (SUs). Acquiring the activity information of nearby users, the SUs are activated only when they are outside the exclusion zone of primary receivers. Additionally, the active secondary transmitters are separated from each other by forming secondary exclusion zones around themselves. Using stochastic geometry, primary and secondary exclusion zone sizes that maximize the transmission capacity under per-tier outage constraints are calculated. Analytical results supported by numerical simulations, suggest primary exclusion zones reduce predominantly the cross-tier interference while the secondary exclusion zone size is critical in mitigating the interference among SUs.

In cognitive radio networks, a pair of communicating nodes are required to rendezvous or meet on a common available channel prior to control information exchange. Maintaining a common control channel (CCC), has several drawbacks such as channel saturation, vulnerability to jamming attacks, and spatial variation in the CCC availability. Although channel-hopping (CH) approaches have been proposed to avoid these problems, most existing work on CH schemes assume that the nodes hop to one channel at a time. This paper proposes asynchronous CH schemes where the nodes listen to or transmit on an arbitrary number of channels at a time. The proposed schemes enable any pair of nodes to rendezvous on all common available channels in the shortest period of time. Simulations are performed to evaluate the expected time-to-rendezvous and robustness of our schemes to primary network activity.