The deployment and management of 5G Open Radio Access Network (O-RAN) testbeds is a complex and time-consuming process that often requires significant manual effort and expertise. We present an open-source automation framework that simplifies testbed setup across diverse software platforms and environments. The framework automates setup and configuration, enables real-time monitoring and collection of key performance indicators (KPIs) via the O-RAN E2 interface with custom xApps, and enforces strict version control for reproducible experimentation. Clear documentation and consistent procedures let researchers quickly start experiments and share results, lowering barriers to entry and promoting collaboration within the 5G research community.

Cryptocurrency such as Bitcoin supports anonymous routing (Tor and I2P) because of the application requirements of anonymity and censorship resistance. In permissionless and open networking for cryptocurrency, an adversary can spoof to pretend to use Tor or I2P for anonymity and privacy protection, while in reality it is not using anonymous routing and forwarding its networking directly to the destination peer to reduce the networking overheads. Using profile detection to detect anonymous routing and false claims based on the deterministic features are vulnerable to spoofing, especially in the permissionless cryptocurrency bypassing registration control. We therefore design and build network fingerprinting using the networking behaviors to detect and classify the networking types. We build a network sensor to collect data on an active Bitcoin node connected to the Mainnet and apply supervised machine learning to classify if a peer node is using IP (not anonymous), Tor, or I2P. Our results show that our scheme is effective in accurately detecting the networking types and identifying spoofing attempts through supervised machine learning. Our machine learning model accurately classifies the networking types and detects fake claims of Tor usage with 90% accuracy and false claims of I2P with 87% accuracy in permisionless Bitcoin.

Current cellular networking remains vulnerable to fake base stations due to the lack of base station authentication mechanism or even a key to enable authentication. We design and build a base station certificate (certifying the base station’s public key and location) and a multi-factor authentication (making use of the certificate and the information transmitted in the online radio control communications) to provide authenticity of the source base station and its radio resource control communications. We advance beyond the state-of-the-art research by introducing greater authentication factors and by using blockchain to deliver the base station digital certificate offline, enabling greater key length/security strength and computational/networking efficiency. The multi-factor authentication at the user equipment involves multiple factors verified through the ledger database, the location sensing, and the cryptographic digital signature verification of the cellular radio control communication (SIB1 broadcasting). We analyze our scheme’s security, performance, and the fit to the existing standardized networking protocols. Our work involves the implementation building on X.509 certificate (adapted), smart contract-based blockchain, 5G-standardized radio resource control communications, and software-defined radios. Our analyses show that our scheme effectively defends against more security threats and can enable stronger security, i.e., ECDSA with greater key lengths. Furthermore, our scheme achieves over threefold improvement in computing and energy efficiency on the mobile user equipment compared to previous research.

Blockchain systems and cryptocurrencies rely on the peer-to-peer (P2P) networking to deliver and broadcast the latest blocks and transactions. Such networking is critical, because the delivered information enable the distributed consensus protocol and have direct impacts on the miner's rewards and incomes in the proof-of-work (PoW) cryptocurrencies such as Bitcoin. We study the interplay between the P2P networking and the PoW distributed consensus protocol by controlling the number of P2P connections and analyzing its impacts on the miner's rewards and costs. While the mining reward increases as the connection increases, which is known in the Bitcoin community, the optimal control for maximizing the income (reward minus cost) is bounded and finite in practice due to the networking and mining costs. In this paper, we theoretically model the utility and miner's net-income of the consensus protocol, capturing their dependence on the P2P connectivity control. We apply the model to analyze the optimal control of our active Bitcoin prototypes connected to the Mainnet to demonstrate the model's usefulness. To facilitate and encourage further use of our model and the R&D in cryptocurrency networking in general, we discuss about the model applications and future directions.

Cryptocurrency relies on the underlying P2P networking to deliver the up-to-date block and transaction information to synchronize and agree on the processed financial transactions. To maintain healthy connectivity, Bitcoin has implemented a negative reputation scheme based on ban score, which tracks the peer node behavior and results in dropping the peer connection if exceeding a threshold. Previous research in cryptocurrency security showed that such ban score can be both ineffective (easy to bypass to un-ban itself) and vulnerable (against spoofing-based defamation). We design and build a novel positive reputation scheme that addresses such deficiencies of ban score by having the peer behavior only positively impact our score and by disincentivizing switching the network ID for a new reputation score. We provide a general framework for the positive reputation scheme to enable the use of different networking sensing and measurements as well as different aggregate weights for scoring. Then, we provide a concrete instance and build of the positive reputation score scheme focusing on the peer's behavior in relaying unique/new blocks and transactions. We implement, experiment, and analyze our scheme on an active Bitcoin node connected to the Mainnet to show how our scheme provides the reputation and informs the beneficialness of each of its peer connections (delivering new block and transaction information).

Cryptocurrency is designed for anonymous financial transactions to avoid centralized control, censorship, and regulations. To protect anonymity in the underlying P2P networking, Bitcoin adopts and supports anonymous routing of Tor, I2P, and CJDNS. We analyze the networking performances of these anonymous routing with the focus on their impacts on the blockchain consensus protocol. Compared to non-anonymous routing, anonymous routing adds inherent-by-design latency performance costs due to the additions of the artificial P2P relays. However, we discover that the lack of ecosystem plays an even bigger factor in the performances of the anonymous routing for cryptocurrency blockchain. I2P and CJDNS, both advancing the anonymous routing beyond Tor, in particular lack the ecosystem of sizable networking-peer participation. I2P and CJDNS thus result in the Bitcoin experiencing networking partitioning, which has traditionally been researched and studied in cryptocurrency/blockchain security. We focus on I2P and Tor and compare them with the non-anonymous routing because CJDNS has no active public peers resulting in no connectivity. Tor results in slow propagation while I2P yields soft partition, which is a partition effect long enough to have a substantial impact in the PoW mining. To better study and identify the latency and the ecosystem factors of the cryptocurrency networking and consensus costs, we study the behaviors both in the connection manager (directly involved in the P2P networking) and the address manager (informing the connection manager of the peer selections on the backend). This paper presents our analyses results to inform the state of cryptocurrency blockchain with anonymous routing and discusses future work directions and recommendations to resolve the performance and partition issues.

Domain Name System Security Extensions (DNSSEC) uses public-key digital signatures to provide integrity and authentication for DNS query responses. The current standardized DNS for reliable UDP delivery limits DNS response (including the message, signature, and public key) to a maximum of 1232 bytes. Incorporating NIST's post-quantum digital signatures into the DNS protocol results in a response size that exceeds the limit set by the Ethernet standardization, making PQC incompatible with the current standardized DNS. To address the incompatibility and enable PQC to protect the authenticity against the quantum-equipped adversaries, previous research proposed fragmenting the DNSSEC messages. Fragmentation however exposes DNSSEC to Fragmentation Mis-Association threat, traditionally studied in the broader IP fragmentation contexts and not applicable in the current DNSSEC with classical/pre-quantum cipher (no fragmentation needed). We distinguish our work from the previous research incorporating PQC to DNSSEC to defend against the Fragmentation Mis-Association Threat by chaining the fragments and applying cryptographic commit-and-reveal. We also advance the previous research and further reduce the number of packet fragments, which can be particularly useful as the DNSSEC based on UDP is prone to packet transmission failure increasing the chance of the DNS response failure when sent in multiple fragments, by using blockchain to offload and enable the offline delivery of the public key. Our scheme thus even allows the Falcon-512 PQC cipher incorporation to forgo the fragmentation, in contrast to the previous research requiring fragmentation for Falcon-512; the other PQC ciphers, i.e., Dilithium ciphers and Falcon-1024, still require fragmentation in our scheme due to the standardized signature sizes. We implement our scheme and analyze the effectiveness and performances through experimentation.

A fake base station is a well-known security issue in mobile networking. The fake base station exploits the vulnerability in the broadcasting message announcing the base station’s presence, which is called SIB1 in telecommunications protocols such as 4G LTE and 5G NR, to get the user equipment to connect to itself. Once connected, the fake base station can deprive the user of connectivity and access to the Internet/cloud. We discover that a fake base station (which engages the user equipment until parts of the connectivity setup and then discontinues with the protocol) can disable the victim user equipment’s connectivity for an indefinitely long time, which we validate using our threat prototype against current 4G/5G practice. We design and build a detection and blacklisting identification of the fake base station so that the user equipment can avoid the base station and move on to connecting to a legitimate base station for the connectivity availability. Our detection and blacklisting scheme builds on the standardized 5G protocol and requires the implementation only on the user equipment (no further protocol changes), facilitating practicality. Our scheme uses the real-time information of both the time duration and the number of request transmissions, which features are directly impacted by the fake base station’s threat and have not been studied in the previous research. We implement both the base station and the user defense on software-defined radio using open-source 5G software (srsRAN and Open5GS) for validations. We vary the base station implementation to simulate legitimate vs. faulty-but-legitimate vs. fake-and-malicious base stations, where the faulty base station notifies the connectivity disruption and releases the session while the fake base station continues to hold the session. We empirically analyze the detection and identification thresholds, which vary with the fake base station’s power and the channel condition. By strategically selecting the threshold parameters, our scheme provides zero errors, including zero false positives to avoid blacklisting the temporarily faulty base stations which can not provide the connectivity at the time.

Cryptocurrency software implements the cryptocurrency operations, including the distributed consensus protocol and the peer-to-peer networking. We design a software assurance scheme for cryptocurrency and advance the cryptocurrency handshaking protocol. Since we focus on Bitcoin (the most popular cryptocurrency) for implementation and integration, we call our scheme Version++, built on and advancing the current Bitcoin handshaking protocol based on the Version message. Our Version++ protocol providing software assurance is distinguishable from the previous research because it is permissionless, distributed, and lightweight to fit its cryptocurrency application. Our scheme is permissionless since it does not require a centralized trusted authority (unlike the remote software attestation techniques from trusted computing); it is distributed since the peer checks the software assurances of its own peer connections; and it is designed for efficiency/lightweight due to the dynamic nature of the peer connections and the large-scale broadcasting in cryptocurrency networking. Utilizing Merkle Tree for the efficiency of the proof verification, we implement and test Version++ on Bitcoin software and conduct experiments in an active Bitcoin node prototype connected to the Bitcoin Mainnet. Our prototype-based performance analyses demonstrate the lightweight design of Version++. The peer-specific verification grows logarithmically with the number of software files in processing time and in storage. In addition, the Version++ verification overhead is small compared to the overall handshaking process; our measured overhead of 2.22% with minimal networking latency between the virtual machines provides an upper bound in the real-world networking with greater handshaking duration, i.e., the relative Version++ overhead in the real world with physically separate machines will be smaller.

Cryptocurrency software implements the cryptocurrency operations. We design a software assurance scheme for cryptocurrency and advance the cryptocurrency handshaking protocol. More specifically, we focus on Bitcoin for implementation and integration and advance its Version-message based hand-shaking and thus call our scheme Version++, The Version++ protocol provides software assurance, which is distinguishable from the previous research because it is permissionless, distributed, and lightweight to fit its cryptocurrency application. Utilizing Merkle Tree for the verification efficiency, we implement and test Version++ on Bitcoin software and conduct experiments in an active Bitcoin node prototype connected to the Bitcoin Mainnet. This paper for the conference demonstration supplements our technical paper at CCNC 2023 for synergy but highlights the prototyping and demonstration components of our research.

The distributed cryptocurrency networking is critical because the information delivered through it drives the mining consensus protocol and the rest of the operations. However, the cryptocurrency peer-to-peer (P2P) network remains vulnerable, and the existing security approaches are either ineffective or inefficient because of the permissionless requirement and the broadcasting overhead. We design and build a Lightweight and Identifier-Oblivious eNgine (LION) for the anomaly detection of the cryptocurrency networking. LION is not only effective in permissionless networking but is also lightweight and practical for the computation-intensive miners. We build LION for anomaly detection and use traffic analyses so that it minimally affects the mining rate and is substantially superior in its computational efficiency than the previous approaches based on machine learning. We implement a LION prototype on an active Bitcoin node to show that LION yields less than 1% of mining rate reduction subject to our prototype, in contrast to the state-of-the-art machine-learning approaches costing 12% or more depending on the algorithms subject to our prototype as well, while having detection accuracy of greater than 97% F1-score against the attack prototypes and real-world anomalies. LION therefore can be deployed on the existing miners without the need to introduce new entities in the cryptocurrency ecosystem.

Capture the Flag (CTF) games improve learners’ engagement and diversify pedagogy for education and training. We design and build a novel CTF game that includes coordination and interaction between the (virtually participating) participants to build fellowship and facilitate networking. Our work builds on the existing CTF components with educational benefits but differs from the traditional CTF approach which presents either an individual game with no participant interaction or a team-based game where the members already know each other and have formed teams. More specifically, we incorporate real-time interactions between participants who are new to each other and engage the participants to collectively solve the CTF challenges. We apply our CTF in both a cybersecurity scholarship program and an academic conference. This paper describes and explains the design, implementation, execution, and validation of our CTF, particularly focusing on the novel goal of including coordination and interaction in order to build fellowships with the participants. We validate our CTF design and build using multiple channels, including the real-time data provided by logging during the session, post-CTF survey, and interviews from the beta-testing session. Our evaluation results show that our novel CTF focusing on coordination and interaction aids in building fellowship and a collaborative environment. We envision our CTF design to help with the rapport building and collaboration among participants in classroom/course settings, workshops, conferences, or technical training sessions.

Bitcoin P2P networking is especially vulnerable to networking threats because it is permissionless and does not have the security protections based on the trust in identities, which enables the attackers to manipulate the identities for Sybil and spoofing attacks. The Bitcoin node keeps track of its peer’s networking misbehaviors through ban scores. In this paper, we investigate the security problems of the ban-score mechanism and discover that the ban score is not only ineffective against the Bitcoin Message-based DoS (BM-DoS) attacks but also vulnerable to the Defamation attack as the network adversary can exploit the ban score to defame innocent peers. To defend against these threats, we design an anomaly detection approach that is effective, lightweight, and tailored to the networking threats exploiting Bitcoin’s ban-score mechanism. We prototype our threat discoveries against a real-world Bitcoin node connected to the Bitcoin Mainnet and conduct experiments based on the prototype implementation. The experimental results show that the attacks have devastating impacts on the targeted victim while being cost-effective on the attacker side. For example, an attacker can ban a peer in two milliseconds and reduce the victim’s mining rate by hundreds of thousands of hash computations per second. Furthermore, to counter the threats, we empirically validate our detection countermeasure’s effectiveness and performances against the BM-DoS and Defamation attacks.

Software-defined radio (SDR) and the softwarization of the wireless and mobile systems enable intelligent processing and control in wireless networking. We design and build a lightweight code assurance proof scheme for wireless system software implementations. More specifically, our scheme assures that a wireless user/prover holds the correct software codes, e.g., the correct version, for its wireless networking implementations. In contrast to the previous research for code attestation in trusted computing, our scheme forgoes hardware-based security and real-time networking, thus substantially increasing the application feasibility. We further design our scheme to be efficient in computing by using a Merkle tree for the efficiency of the verification of the assurance proof. We implement our scheme for proof-of-concept on srsRAN (a popular open-source software for cellular technology) and conduct preliminary measurements to demonstrate the lightweight design. We envision our scheme to be orthogonal and supplementary to the previous trustworthy code attestation because it provides different properties (assurance vs. attestation) and because the lightweight aspect yields greater applicability and lower overheads in hardware and networking. Our scheme will therefore be appropriate for the wireless/mobile environment which uses broadcasting (where receiving/verifications occur more frequently than transmitting/generations) and whose devices are resource-constrained.

Post-quantum ciphers (PQC) provide cryptographic algorithms for public-key ciphers which are computationally secure against the threats from quantum-computing adversaries. Because the devices in mobile computing are limited in hardware and power, we analyze the PQC power overheads. We implement the new NIST PQCs across a range of device platforms to simulate varying resource capabilities, including multiple Raspberry Pis with different memories, a laptop, and a desktop computer. We compare the power measurements with the idle cases as our baseline and show the PQCs consume considerable power. Our results show that PQC ciphers can be feasible in the resource-constrained devices (simulated with varying Raspberry Pis in our case); while PQCs consume greater power than the classical cipher of RSA for laptop and desktop, they consume comparable power for the Raspberry Pis.

While blockchain technology provides strong cryptographic protection on the ledger and the system operations, the underlying blockchain networking remains vulnerable due to potential threats such as denial of service (DoS), Eclipse, spoofing, and Sybil attacks. Effectively detecting such malicious events should thus be an essential task for securing blockchain networks and services. Due to its importance, several studies investigated anomaly detection in Bitcoin and blockchain networks, but their analyses mainly focused on the blockchain ledger in the application context (e.g., transactions) and targets specific types of attacks (e.g., double-spending, deanonymization, etc). In this study, we present a security mechanism based on the analysis of blockchain network traffic statistics (rather than ledger data) to detect malicious events, through the functions of data collection and anomaly detection. The data collection engine senses the underlying blockchain traffic and generates multi-dimensional data streams in a periodic, real-time manner. The anomaly detection engine then detects anomalies from the created data instances based on semi-supervised learning, which is capable of detecting previously unseen patterns, and we introduce our profiling-based detection engine implemented on top of AutoEncoder (AE). Our experimental results evaluated with real and simulated traffic data support the effectiveness of our security mechanism and design choices based on the AE structure, with the approximate detection performance to the supervised learning methods only through the profiling of normal instances. The measured time complexity is sufficiently cheap to perform real-time analysis, with less than 1.4 msec for per-instance testing on a single core setting.

Public Key Infrastructure (PKI) generates and distributes digital certificates to provide the root of trust for securing digital networking systems. To continue securing digital networking in the quantum era, PKI should transition to use quantum-resistant cryptographic algorithms. The cryptography community is developing quantum-resistant primitives/algorithms, studying, and analyzing them for cryptanalysis and improvements. National Institute of Standards and Technology (NIST) selected finalist algorithms for the post-quantum digital signature cipher standardization, which are Dilithium, Falcon, and Rainbow. We study and analyze the feasibility and the processing performance of these algorithms in memory/size and time/speed when used for PKI, including the key generation from the PKI end entities (e.g., a HTTPS/TLS server), the signing, and the certificate generation by the certificate authority within the PKI. The transition to post-quantum from the classical ciphers incur changes in the parameters in the PKI, for example, Rainbow I significantly increases the certificate size by 163 times when compared with RSA 3072. Nevertheless, we learn that the current X.509 supports the NIST post-quantum digital signature ciphers and that the ciphers can be modularly adapted for PKI. According to our empirical implementations-based study, the post-quantum ciphers can increase the certificate verification time cost compared to the current classical cipher and therefore the verification overheads require careful considerations when using the post-quantum-cipher-based certificates.

Blockchain and the proof-of-work (PoW) distributed consensus protocol rely on peer-to-peer (P2P) networking. We build a PoW P2P simulator for the modeling and analyses of permissionless blockchain networking. Our simulator utilizes a built-in randomness generator for the simulations, has an easy-to-use interface and intuitive visualization, supports dynamic/programmable control and modifications, and can generate simulation data for further processing. We publish our simulator in open source to facilitate its use for blockchain and P2P networking research and especially recommend it for scalability research or preliminary testing. To highlight its features and capabilities, we demonstrate the simulator use in this paper to analyze the recent blockchain security research, including 51% attack, eclipse, partitioning, and DoS attack.

Blockchain relies on the underlying peer-to-peer (p2p) networking to broadcast and get up-to-date on the blocks and transactions. It is therefore imperative to have high p2p connectivity for the quality of the blockchain system operations. High p2p networking connectivity ensures that a peer node is connected to multiple other peers providing a diverse set of observers of the current state of the blockchain and transactions. However, in a permissionless blockchain network, using the peer identifiers—including the current approach of counting the number of distinct IP addresses and port numbers—can be ineffective in measuring the number of peer connections and estimating the networking connectivity. Such current approach is further challenged by the networking threats manipulating the identifiers. We build a robust estimation engine for the p2p networking connectivity by sensing and processing the p2p networking traffic. We implement a working Bitcoin prototype connected to the Bitcoin Mainnet to validate and improve our engine’s performances and evaluate the estimation accuracy and cost efficiency of our estimation engine.

Peer connectivity plays a significant role in a blockchain network since any poor connectivity may result in the nodes operating on outdated data (e.g., cryptocurrency transactions). Although connectivity information is maintained by individual nodes, such identifier-based information might be unreliable due to the possibility of bogus identifiers. This paper tackles the problem of peer connectivity estimation through data-driven analytics of blockchain traffic for reliable blockchain networking. We define a set of variables to represent traffic characteristics and estimate peer connectivity from the collected data using a machine learning methodology. We also investigate the feasibility of feature prioritization to minimize estimation complexities. Our experimental results show that the presented estimation mechanism makes accurate predictions, with less than 0.1 difference between the measurement and estimation for over 99.7% of predictions. The time complexity measured on a commodity machine shows a microsecond scale for completing a single prediction task, enabling real-time operations.