We are used to the conventional model in which access control is provided by a trusted central entity or by a set of distributed entities that coordinate to mimic a central entity.Authorization decisions are based on a single, append-only total ordering of all actions, including policy updates, which leads to strong consistency guarantees.Recent systems based on conflict-free replicated data types (CRDTs) break with this conceptual model to gain fundamental advantages in latency, availability, resilience, and Byzantine fault tolerance.These systems replace up-front coordination with subsequent reconciliation of decentralized authorization decisions and policy updates.One of these is the Matrix group communication system, whose massive public sector deployments in Europe necessitate timely characterization of the underlying alternative conceptual model.Similarly to eventually consistent replication in CRDTs, we define 'eventually consistent access control' and present its consequences.Our model postulates thinking in two orderings of actions with different consequences for authorization: a partial ordering for storage, where the past of an action is final knowledge, and a total ordering for execution, where the past of an action is a mutable belief.

In the Ethereum system, the exclusion of specific transactions is currently feasible with minimal effort due to a power imbalance among entities. This censorship opportunity threatens the dependability of time-sensitive services deployable on Ethereum. In this paper, we look at this threat from an access control perspective and attribute it to a lack of accountability for censorship, a lack of policy definition and enforcement, as well as to the lack of disincentivization of policy violation. We propose an approach to enforceable policies in Ethereum. Furthermore, we demonstrate how a specific policy can address the shortcomings of existing censorship mitigation techniques, particularly Inclusion Lists. Under the assumption that block assemblers are unwilling to incur significant financial penalties as well as that the local view on the network messages is sufficiently consistent, the proposed approach guarantees the inclusion of a transaction in a block within 27 seconds in a non-saturated network. The empirical validation of sufficiently consistent views on outstanding transactions is currently in progress.

We present a simple approach to mitigate transaction-ordering dependent Maximum-Extractable-Value (MEV) opportunities in Ethereum. The approach is built on top of Proposer-Builder-Separation, restricts the freedom to order transactions within a block arbitrarily, and relies primarily on a non-malleable signature scheme and separation of responsibilities. In addition, we generalize the proposed approach to show that the property of unpredictable transaction arrangement can be transferred also to other blockchain systems. We discuss the gain in MEV mitigation, important limitations, and open issues.

Humanoid robots will be able to assist humans in their daily life, in particular due to their versatile action capabilities. However, while these robots need a certain degree of autonomy to learn and explore, they also should respect various constraints, for access control and beyond. We explore the novel field of incorporating privacy, security, and access control constraints with robot task planning approaches. We report preliminary results on the classical symbolic approach, deep-learned neural networks, and modern ideas using large language models as knowledge base. From analyzing their trade-offs, we conclude that a hybrid approach is necessary, and thereby present a new use case for the emerging field of neuro-symbolic artificial intelligence.

Humanoid robots will be able to assist humans in their daily life, in particular due to their versatile action capabilities. However, while these robots need a certain degree of autonomy to learn and explore, they also should respect various constraints, for access control and beyond. We explore incorporating privacy and security constraints (Activity-Centric Access Control and Deep Learning Based Access Control) with robot task planning approaches (classical symbolic planning and end-to-end learning-based planning). We report preliminary results on their respective trade-offs and conclude that a hybrid approach will most likely be the method of choice.

Asynchronous Byzantine Atomic Broadcast (ABAB) promises simplicity in implementation as well as increased performance and robustness in comparison to partially synchronous approaches. We adapt the recently proposed DAG-Rider approach to achieve ABAB with $n\geq 2f+1$ processes, of which $f$ are faulty, with only a constant increase in message size. We leverage a small Trusted Execution Environment (TEE) that provides a unique sequential identifier generator (USIG) to implement Reliable Broadcast with $n>f$ processes and show that the quorum-critical proofs still hold when adapting the quorum size to $\lfloor \frac{n}{2} \rfloor + 1$. This first USIG-based ABAB preserves the simplicity of DAG-Rider and serves as starting point for further research on TEE-based ABAB.

A recent spam wave of IP addresses in the Bitcoin P2P network allowed us to estimate the degree distribution of reachable peers. The resulting distribution indicates that about half of the reachable peers run with Bitcoin Core’s default setting of a maximum of 125 concurrent connections and nearly all connection slots are taken. We validate this result empirically. We use our observations of the spam wave to group IP addresses that belong to the same peer. By doing this grouping, we improve on previous measurements of the number of reachable peers and show that simply counting IP addresses overestimates the number of reachable peers by 15 %. We revalidate previous work by using our observations to estimate the number of unreachable peers.

A payment channel protocol does not only have to provide the payment functionality, it also has to fulfill security guarantees such as ensuring that an honest party receives their correct balance. For complexity reasons, it is typically difficult to assess the security of such a protocol or to find counterexamples in insecure protocols. In this poster, we present an approach to specify functional as well as security properties for a payment channel protocol in TLA+and show that a Lightning Network-style protocol fulfills the required properties. In case a counterexample is found, we provide protocol developers with a graphical and intuitive output. We present the challenges we faced and our approach to meeting these challenges.

In many public transport networks, multiple providers cooperate to offer integrated services and, conse-quently, provide integrated fare collection. Thus, ticket revenues need to be redistributed so that each provider receives its respective share. Typically, the customers' travel behavior is surveyed and the fares paid are aggregated over certain periods of time, and the revenue is periodically allocated based on this information. To avoid a centralized trusted third party or the exchange of sensitive information between providers, we present an approach that integrates revenue allocation directly into the payment process: The proposed approach is based on payment channel networks and utilizes multi-hop payments to perform revenue allocation. We thereby show how to make use of payment channel networks in this setting as well as the corresponding benefits.

In the not too distant future, assistive humanoid robots will provide versatile assistance for coping with everyday life. In their interactions with humans, not only safety, but also security and privacy issues need to be considered. In this Blue Sky paper, we therefore argue that it is time to bring task planning and execution as a well-established field of robotics with access and usage control in the field of security and privacy closer together. In particular, the recently proposed activity-based view on access and usage control provides a promising approach to bridge the gap between these two perspectives. We argue that humanoid robots provide for specific challenges due to their task-universality and their use in both, private and public spaces. Furthermore, they are socially connected to various parties and require policy creation at runtime due to learning. We contribute first attempts on the architecture and enforcement layer as well as on joint modeling, and discuss challenges and a research roadmap also for the policy and objectives layer. We conclude that the underlying combination of decentralized systems' and smart environments' research aspects provides for a rich source of challenges that need to be addressed on the road to deployment.

The Matrix message-oriented middleware (see https://matrix.org) is gaining momentum as a basis for a decentralized, secure messaging system as shown, for example, by its deployment within the French government and by the Mozilla foundation. Thus, understanding the corresponding access control approach is important. This paper provides an ab- straction and an analysis of the access control approach followed by Matrix. We show that Matrix can be seen as a form of Distributed Ledger Technology (DLT) based on Transaction-based Directed Acyclic Graphs (TDAGs). TDAGs connect individual transactions to form a DAG, instead of collecting transactions in blocks as in blockchains. These TDAGs only provide causal order, eventual consistency, and no finality. However, unlike conventional DLTs, Matrix does not aim for a strict system-wide consensus. Thus, there is also no guarantee for a strict consensus on access rights. By de- composition of the Matrix approach, we show that a sound decen- tralized access control can be implemented for TDAGs in general, and for Matrix in particular, despite those weak guarantees. In ad- dition, we discovered security issues in popular implementations and emphasize the need for a formal verification of the employed conflict resolution mechanism.

The integrity of executable binaries is essential to the security of any device that runs them. At best, a manipulated binary can leave the system in question open to attack, and at worst, it can compromise the entire system by itself. In recent years, supply-chain attacks have demonstrated that binaries can even be compromised unbeknownst to their creators. This, in turn, leads to the dissemination of supposedly valid binaries that need to be revoked later.

An essential, but nevertheless often neglected, objective for the design of safety-critical IEEE 802.11p-based application is: fail-safety. A fail-safe application is an application that incorporates features that automatically counteract the effect of anticipated sources of failure. In the context of a rear-end collision avoidance application two main possible sources of failure exist: an unpredictable human behavior and unreliable communication. This paper presents mechanisms that, when integrated into the design of rear-end collision avoidance application, counteract these failure cases and thus ensure fail-safety. However, fail-safety comes at a cost: either large inter-vehicle distances have to be kept to ensure that all drivers have enough time to react or the application has to take over vehicle control to allow smaller inter-vehicle distances and thus higher traffic efficiency. In this paper we analyze this tradeoff and quantify what part of drivers’ population has to be deprived of vehicle control in order to achieve acceptable traffic efficiency when deploying IEEE 802.11p-based rear-end collision avoidance application.

We present a simulation model of the Bitcoin peer-to-peer network, a widely deployed distributed electronic currency system. The model enables evaluations of the feasibility and cost of attacks on the Bitcoin network at full scale of 6,000 nodes. The simulation model is based on unmodified code from core segments of the Bitcoin reference implementation used by 99% of nodes. Parametrization of the model is performed based on large-scale measurements of the real-world network. We present preliminary validation results showing a reasonable correspondence of the propagation of messages in the Bitcoin network compared with simulation results. We apply the model to study the feasibility of a partitioning attack on the network and show that the attack is sensitive to the churn of the attacking nodes.

To achieve highest performance, parallel simulation of networks on modern hardware architectures depends on large numbers of independent computational tasks. However, the properties determining a network model's concurrency are still not well understood. In this paper, we propose an analytical model that enables concurrency estimations based on model knowledge and on statistics gathered from sequential simulation runs. In contrast to an automated concurrency analysis of event traces, the analytical approach enables insights into the relationship between the topology and communication patterns of the simulated network, and the resulting concurrency. We consider three fundamentally different network models as implemented in the network simulators PeerSim and ns-3: a large-scale application-layer peer-to-peer network, IP-based routing in a fixed topology, and a wireless ad-hoc network. For each model, we conduct an in-depth analysis, exposing the relationships between model characteristics and concurrency. Our analysis is validated by comparing estimated concurrency values to reference results of a trace-based analysis. The identification of key factors for concurrency forms a step towards a classification of network models according to their potential for parallelization.

Sharing data with client-side encryption requires key management. Selecting an appropriate key management protocol for a given scenario is hard, since the interdependency between scenario parameters and the resource consumption of a protocol is often only known for artificial, simplified scenarios. In this paper, we explore the resource consumption of systems that offer sharing of encrypted data within real-world scenarios, which are typically complex and determined by many parameters. For this purpose, we first collect empirical data that represents real-world scenarios by monitoring large-scale services within our organization. We then use this data to parameterize a resource consumption model that is based on the key graph generated by each key management protocol. The preliminary simulation runs we did so far indicate that this key-graph based model can be used to estimate the resource consumption of real-world systems for sharing encrypted data.

The suitability and performance of medium access protocols in vehicular environments is already being investigated over a long period of time. Carrier Sense Multiple Access (CSMA) has been shown to perform sufficiently well in most situations and being able to support safety and efficiency vehicular applications. Recently, Self-organizing Time-Division Multiple Access (STDMA) is being considered as an alternative and has been shown to coordinate the channel slightly better under certain situations. However, when comparing both protocols the precise details of radio and network conditions and parametrization of the protocols are decisive on which protocol takes a slight lead. Consequently, scenarios can be constructed quite easily in which one protocol is superior over the other one. The focus of this work is thus not to absolutely compare both protocols, but rather to understand the strengths and weaknesses of both protocols in certain situations. In particular, we consider i) to which degree hidden nodes influence the coordination ability, ii) how an extended carrier sensing range is beneficial and iii) how temporary fading influences the performance of both MAC protocols. Our results show that while an extended carrier sensing range is only beneficial for CSMA, the existence and severity of fading is far less detrimental for STDMA than for CSMA.

A user's online social network (OSN) friends commonly share information on their OSN profiles that might also characterize the user him-/herself. Therefore, OSN friends are potentially jeopardizing users' privacy. Previous studies demonstrated that third parties can potentially infer personally identifiable information (PII) based on information shared by users' OSN friends if sufficient information is accessible. However, when considering how privacy settings have been adjusted since then, it is unclear which attributes can still be predicted this way. In this paper, we present an empirical study on PII of Facebook users and their friends. We show that certain pieces of PII can easily be inferred. In contrast, other attributes are rarely made publicly available and/or correlate too little so that not enough information is revealed for intruding user privacy. For this study, we analyzed more than 1.2 million OSN profiles in a compliant manner to investigate the privacy risk due to attribute prediction by third parties. The data shown in this paper provides the basis for acting in a risk aware fashion in OSNs.

Whether a given simulation model of a computer network will benefit from parallelization is difficult to determine in advance, complicated by the fact that hardware properties of the simulation execution environment can substantially affect the execution time of a given simulation. We describe SONSim, an approach to predict the execution time based on a simulation of an envisioned distributed network simulation (second-order simulation). SONSim takes into account both network model characteristics and hardware properties of the simulation execution environment. To show that a SONSim prototype is able to predict distributed performance with acceptable accuracy, we study three reference network simulation models differing fundamentally in topology and levels of model detail - simple topologies comprised of interconnected subnetworks, peer-to-peer networks and wireless networks. We evaluate the performance predictions for multiple configurations by comparing predictions for the three reference network models to execution time measurements of distributed simulations on physical hardware using both Ethernet and InfiniBand interconnects. In addition, utilizing the freedom to vary simulation hardware and model parameters in the second-order simulation, we demonstrate how SONSim can be used to identify general model characteristics that determine distributed simulation performance.

To relieve users of the burden to memorize and manage their credentials while allowing for seamless roaming between various end devices, the idea of so-called credential repositories that store credentials for users came to attention. Both the risk of the credential repository being unavailable and the risk of the credentials becoming compromised are managed by the party that hosts the credential repository and that has to be trusted by the user. Removing the need for a trust relationship to a single party implies that users have to manage the risks themselves, for instance, by splitting the credentials across multiple systems/parties. However, if the systems differ in terms of availability and vulnerability, determining a suitable splitting strategy to manage the tradeoff between credential availability and vulnerability constitutes a complex problem. In this paper we present CREDIS, an approach that supports the user in building a credential repository based on heterogeneous systems that differ in terms of vulnerability and availability. CREDIS enables users to specify requirements on the availability and the vulnerability of the distributed credential repository and determines an optimal strategy on how to split secrets across the heterogeneous systems. We prove the NP-hardness of finding an optimal strategy, introduce an approach based on Integer Linear Programming to find optimal strategies for medium sized scenarios and propose heuristics for larger ones. We show that the CREDIS approach yields a reasonably secure and available credential repository even when the distributed repository is built based on low-grade devices or systems.

In order to interact with a Web site, humans must be able to distinguish and understand the purposes of different page blocks, e.g. header, navigation bar or content area. In case of navigational blocks, the block type determines the functionality of the hyperlinks it contains. For example, the hyperlinks in the main menu block represent the main topics of a site while the hyperlinks in a breadcrumb trail show the location in the content hierarchy. Hence, mining navigational blocks of specific types can provide valuable input for applications in the fields of crawling, ranking or presenting search results. However, analyzing visual features in order to identify specific navigational blocks as humans do is a difficult, resource-consuming task and a general solution does not exist yet. In this paper, we propose a novel approach to the problem and present the Graph-based block extraction method (GRABEX) that can be adapted to classify different types of navigational blocks. The fundamental concept is that a separate graph-based link-analysis is conducted for groups of blocks. Each block group consists of blocks from different pages that have similar CSS class attributes. This allows discovering navigational blocks of specific types, e.g. breadcrumb trails, without analyzing any presentational features. We apply our method to mine breadcrumb trails and are the first to describe an applicable solution to this problem. In an extensive evaluation including 700 different sites, the GRABEX-method performed with perfect precision and high recall.

For cloud-based outsourcing of confidential data, various techniques based on cryptography or data-fragmentation have been proposed, each with its own tradeoff between confidentiality, performance, and the set of supported queries. However, it is complex and error-prone to select appropriate techniques to individual scenarios manually. In this paper, we present a policy-based approach consisting of a domain specific language and a policy-transformator to automatically generate scenario-specific software adapters called mediators that set up data outsourcing and govern data access. Mediators combine state-of-the-art confidentiality techniques to ensure a user-specified level of confidentiality while still offering efficient data access. Thus, our approach simplifies data outsourcing by decoupling policy decisions from their technical implementation and realizes appropriate tradeoffs between confidentiality and efficiency.

Federated identity management yields many advantages such as enhanced usability and improved quality of identity information. Web-based services are already successfully and widely federated using the Security Assertion Markup Language (SAML). In terms of usability and quality of identity information non web-based services benefit from being federated in a similar way web-based services do. However, up to this point no versatile approach that can be easily integrated has emerged to federate them. In this paper, we present FACIUS, an architecture that enables the integration of non web-based services into SAML-based federations. FACIUS aims at minimizing the integration effort in terms of both usability and necessary adjustments to existing service deployments. Furthermore, to prove the practicability of the proposed architecture, we present an implementation to federate SSH services.

Distributed Hash Tables (DHTs) prove valuable for distributed architectures by providing distributed information lookup, routing, and data storage while promising good scalability and robustness at the same time. From this point of view, a DHT could be seen as a basic service that can be used to build distributed applications. Whereas today no widely deployed and publicly accessible basic DHT service exists and thus DHT-based applications have to deploy their very own DHT networks, DHTs consisting of millions of peers are formed by file sharing clients. Although the interfaces of typical DHTs used for file sharing are too narrow, a basic DHT service could probably be created by bundling a suitable client implementation with file sharing software. In this paper, we evaluate whether a basic DHT service could suit the needs of DHT- based applications in terms of stability, number of participating peers, the peers' session lengths, geographical distribution and peer connectivity when deployed similar to DHTs driven by file sharing. As these metrics mostly depend on end user behavior rather than on the DHT protocol, we report on measurement results gathered from monitoring of the BitTorrent Mainline client's DHT over six months. We analyze which metrics would fit a basic DHT service and which could prove problematic. Furthermore, we discuss resulting technical requirements for an appropriate DHT protocol.

The growing number of IT services in distributed systems is directly related to the security and privacy of personal data. User-centric federated identity management (FIM) attends to the privacy issue by enabling users to approve each data dissemination between the providers of identity-related information, so-called identity providers (IdPs), and the consumers of this information, the service providers (SPs). Furthermore, user-centric FIM tries to improve security and usability by providing users with a consistent digital-identity experience using so-called information cards (InfoCards). The InfoCard-based approach can help to improve usability, privacy and security, however, the approach is limited to front-channel communication and requires that each data exchange is manually approved by the user. A back-channel communication might be required in scenarios, in which an IdP wants to notify SPs about e.g. a deactivation of a user. In [3] we proposed an approach, named User-Controlled Automated Identity Delegation, that allows a back-channel communication by automating user approval based on delegation. In this paper we demonstrate the practicality of the approach in a real-world scenario by providing a performance evaluation conducted on a prototypical implementation.

Vehicular safety communication promises to prevent accidents by enabling new assistance systems. The information exchange is mostly foreseen to be handled via decentralized Dedicated Short Range Communication (DSRC). But, the required information could also be exchanged via cellular networks, potentially providing better coverage. The ability of cellular systems to handle the additional traffic is an open question. The introduced network load heavily depends on the number of communicating vehicles per cell. In this paper, we predict the number of communicating vehicles per cell. First, we analyze the coverage area of existing cells in the City of Munich. Second, we match street layout and traffic flow data with cells. The study shows that over 600 vehicles per cell might be reached. The resulting numbers are primarily discussed with regard to the communication demand of a cross-traffic assistance system. However, the results can also be used to predict load as introduced by other vehicular applications that communicate via cellular networks.

In recent years, a trend towards the usage of physical layer models with increased accuracy can be observed within the wireless network community. This trend has several reasons. The consideration of signals - instead of packets - as the smallest unit of a wireless network simulation enables the ability to reflect complex radio propagation characteristics properly, and to study novel PHY/MAC/NET cross-layer optimizations that were not directly possible before, e.g. cognitive radio networks and interference cancellation. Yet, there is a price to pay for the increase of accuracy, namely a significant decrease of runtime performance due to computationally expensive signal processing. In this paper we study whether this price can be reduced - or even eliminated - if GPU-based signal processing is employed. In particular, we present and discuss four different architectures that can be used to exploit GPU-based signal processing in discrete event-based simulations. Our evaluation shows that the runtime costs can not be cut down completely, but significant speedups can be expected compared to a non GPU-based solution.

Vehicle-to-vehicle and vehicle-to-roadside communications is required for numerous applications that aim at improving traffic safety and efficiency. In this setting, however, gauging system performance through field trials can be very expensive especially when the number of studied vehicles is high. Therefore, many existing studies have been conducted using either network or physical layer simulators; both approaches are problematic. Network simulators typically abstract physical layer details (coding, modulation, radio channels, receiver algorithms, etc.) while physical layer ones do not consider overall network characteristics (topology, network traffic types, and so on). In particular, network simulators view a transmitted frame as an indivisible unit, which leads to several limitations. First, the impact of the vehicular radio channel is typically not reflected in its appropriate context. Further, interference due to frame collisions is not modeled accurately (if at all) and, finally, the benefits of advanced signal processing techniques, such as interference cancellation, are difficult to assess. To overcome these shortcomings we have integrated a detailed physical layer simulator into the popular NS-3 network simulator. This approach aims to bridge the gap between the physical and network layer perspectives, allow for more accurate channel and physical layer models, and enable studies on cross-layer optimization. In this paper, we exemplify our approach by integrating an IEEE 802.11a and p physical layer simulator with NS-3. Further, we validate the augmented NS-3 simulator against an actual IEEE 802.11 wireless testbed and illustrate the additional value of this integration.

Cooperative vehicular systems have been identified as a promising solution to overcome the current and future needs for increasing traffic safety and efficiency, while providing infotainment and added-value services on the move. To achieve their objectives, cooperative vehicular systems will be based on wireless communications between vehicles and with other infrastructure nodes, and will have to deal with highly dynamic nodes, challenging propagation conditions, and stringent application requirements. By looking at cooperative applications and their data traffic, as well as the current and foreseen spectrum allocations for cooperative vehicular systems, there is a risk that the corresponding radio channels could easily be saturated if no control algorithms are used. The saturation of the radio channels would result in unstable vehicular communications, and thus in an inefficient operation of cooperative systems. As a prime example of upcoming ubiquitous networks contributing to the vision of “a thousand radios per person,” cooperative vehicular systems need to be designed to scale to high densities of radios without centralized coordination, while at the same time guaranteeing the requirements of the implemented applications and services, for example the stringent needs of active traffic safety applications. In this paper, we survey and classify various decentralized methods to control the load on the radio channels and to ensure each vehicle's capacity to detect and communicate with the relevant neighboring vehicles, with a particular focus on approaches based on transmit power and rate control. Finally, we discuss the open research challenges that are imposed by different application requirements and potential existing contradictions.

The wide scale deployment of cooperative vehicular ad-hoc networks will require the design of efficient congestion control policies that guarantee stable and reliable communications between vehicles and with infrastructure nodes. These policies should reduce the load on the communications channel, while satisfying the strict application's reliability requirements. To this aim, this letter proposes and evaluates a contextual cooperative congestion control policy that exploits the traffic context information of each vehicle to reduce the channel load, while satisfying the vehicular applications requirements.

Collaborations by the use of inter-organizational business processes can help companies to achieve a competitive edge over competing businesses. Typically, these collaborations require an efficient identity management (IdM) that ensures the authorized access to services in different security domains. The successful implementation of an IdM in distributed systems requires to cope with a diversity of systems and to manage the challenges of integration. While integration should not introduce an unnecessary degree of dependence and complexity, various IdM goals should be achieved by integration: in particular, collaboration-wide consistency of identity information. Due to its decentralized and modular design, a federated identity management (FIM) approach is a promising strategy in distributed systems. Our thesis is that the distributed character and heterogeneity of involved systems requires appropriate information-consistency mechanisms that go beyond what is offered by current FIM protocols and software in order to avoid inconsistencies in identity information. In this paper we identify causes leading to inconsistencies in FIM. We present requirements necessary to cope with the consistency issue and analyze research, FIM standards and protocols w.r.t. the stated requirements. An analysis showed that FIM does not consider the consistency issue sufficiently. However, we point out which parts can be used as building blocks to achieve information consistency. Therefore, we design a system called FedWare that combines identity-related middleware services with existing FIM technologies. To provide an efficient integration of systems, we reduce development effort by providing reusable services. By decoupling systems, e.g., via a publish/subscribe mechanism, we reduce operation effort.

The growing number of IT services in distributed systems increases the need to allow users to keep track of which personal data is retained by which service. User-centric federated identity management (FIM) tackles this goal by enabling users to approve each data dissemination between the providers of identity-related information, so-called identity providers (IdPs), and the consumers of this information, the service providers. To prevent a single IdP from gaining a comprehensive set of user information, user-centric FIM motivates the use of multiple IdPs even though this distribution of responsibilities might result in information redundancy and therefore raises consistency issues. User-centric FIM systems do not cope with information consistency sufficiently, mainly because these systems require that each dissemination of user attributes is manually approved by the user. We propose an approach, named User-Controlled Automated Identity Delegation, that allows a controlled data dissemination based on an automated user approval by introducing an additional party called Identity Delegate. The Identity Delegate is designed in consideration of the following central ideas: (i) user centricity - all data dissemination is still under user control, (ii) privacy - the delegate cannot read or gather personal data, (iii) efficiency - the effort to integrate and operate the delegate within an existing FIM system is kept low. We cover the experience made with an implementation based on Windows CardSpace.

In distributed IT systems, replication of information is commonly used to strengthen the fault tolerance on a technical level or the autonomy of an organization on a business level. In particular, information related to the identity of a user, which is used to authorize service access, is often replicated for these reasons. To ensure correct authorization decisions, replicas have to be kept consistent. However, an appropriate definition of “consistency” is required that takes into account the need for the following aspects: (i) semantic and causal relations between identity information, and (ii) temporal aspects with respect to an acceptable duration of the dissemination of occurring attribute changes. Both identity-information specifics and temporal aspects are not addressed sufficiently by existing consistency models. In this paper we introduce a consistency model for identity information in distributed systems named ID-consistency. ID-consistency is based on a formalization of identity information and considers semantic and causal relations as well as a so-called inconsistency window that denotes the time period between a change to information and the moment when the change is fully disseminated. Therefore, the model reveals the fundamental structure of an IdM system and helps in the design and analysis of corresponding dissemination middleware in distributed systems. We exemplarily show how to make use of the concept of ID-consistency to analyze and improve a real-world IdM system using CardSpace for demonstration purposes.

Current peer-to-peer (P2P) systems are vulnerable to a variety of attacks due to the lack of a central authorization authority. The Sybil attack, i.e., the forging of multiple identities, is crucial as it can enable an attacker to control a substantial fraction or even the entire P2P system. However, the correlation between the resources available to an attacker and the resulting influence on the P2P system has yet not been studied in detail. The contributions of our paper are twofold: i) we present an approach for assessing the actual threats of Sybil attacks and ii) we propose a distributed approach to limit the impact of Sybil attacks effectively. Therefore, we conduct a thorough analysis of the Sybil attack w.r.t. the resource requirements to operate Sybil nodes and we investigate the quantitative influence of Sybil nodes on the overall system. Our study focuses on Kademlia, a very popular distributed hash table (DHT) which is for instance used in BitTorrent. We ran extensive Internet measurements within the BitTorrent DHT to determine the actual required resources to operate nodes. To evaluate the quantitative influence of Sybil nodes, we additionally conducted a comprehensive simulation study. The results show that upstream network bandwidth is the dominating factor concerning resources. Furthermore, we illustrate that small portions of Sybil nodes are tolerable in terms of global system stability. Finally, we propose a new approach called *RACING* to improve the resistance of DHTs against Sybil attacks. By establishing a new distributed identity registration procedure based on IP addresses, we are able to effectively limit the number of Sybil nodes.

The distributed hash table (DHT) formed by BitTorrent has become very popular as a basis for various kinds of services. Services based on this DHT often assume certain characteristics of the DHT. For instance, for realizing a decentralized bootstrapping service a minimum number of peers running on a certain port are required. However, key characteristics change over time. Our measurements show that e.g. the number of concurrent users grew from 5 to over 7 millions of users during the last months. For making reliable assumptions it is thus essential to monitor the P2P network. This demo presents BitMON, a Java-based out-of-the-box platform for monitoring the BitTorrent DHT. This tool does not only crawl the network, but also automatically analyzes the collected data and visualizes the results. BitMON monitors the DHT's size in peers as well as the peers' IP addresses, port numbers, countries of origin and session length. Also, the long-term evolution of these indicators can be graphically displayed. Furthermore, BitMON is designed as a framework and can easily be extended or adapted to monitor other P2P networks.

In this paper we propose a simulation-as-a-service approach to evaluate ITS applications. We segment a simulation process in two building blocks: a web-interface/server front-end used by users to configure the remote simulations of their ITS application, and a back-end consisting of a controller and a HCC platform to conduct the remote simulations. The controller is in charge of configuring the HCC platform as well as distributing and scheduling the simulations on it. HCC platforms usually provide users with only a restricted control on the simulation environment and a limited set of available libraries. To mitigate these drawbacks, we make use of the virtualization support of recent HCC platforms and employ Kernel-based Virtual Machines.

Many of the simulations reported in wireless networking literature contain several abstractions at the physical layer and the corresponding channel models. In particular, the basic simulation unit assumed in such simulations is the frame (or packet), which omits considerations of the signal processing details at the physical layer, such as frame construction and reception. Due to this abstraction, available channel models for network simulators are applied to frames as a whole and cannot reflect properly the effects of fast fading or frequency-selective channels. Moreover, it is not possible to study the mechanisms of the physical layer and their impact on higher layers such as the MAC. Therefore, we propose to address the lack of accurate physical layer representation in modern network simulators by incorporating a physical layer emulator for OFDM-based IEEE 802.11 communications into the popular NS-3 simulator. In this paper, we outline the architecture of the physical layer emulator and present initial results which highlight the promise of the new architecture in providing more detailed simulations to the networking community. The additional memory and computational requirements of the new model are also discussed.

Vehicle-to-vehicle (V2V) or vehicle-to-infrastructure (V2I) communications are enabling technologies for a host of applications, ranging from infotainment and web browsing to cooperative driving for enhanced traffic safety and efficiency. The latter two application areas, traffic safety and efficiency, address the issue of sustainable mobility and are high on the political agendas around the world.

Vehicular ad hoc networks are conceived as a means to increase traffic safety. Primary means to demonstrate their beneficial impact before deployment are computer simulations that comprise communication models, mobility models of vehicles and models of VANET applications. In particular, the movement behavior of vehicles poses questions when evaluating traffic safety since driver models typically do not allow accidents to happen. In this paper we address modifications to the popular Wiedemann model and present an integration of the modified driving behavior to the traffic simulator VISSIM which thus enables simulations containing accidents. Finally, we show in a simulative study how locally available information on the current traffic situation can contribute to safer road traffic. Our contributions represent a first step on how to assess VANETs with respect to traffic safety.

The evaluation of data-dissemination protocols in network simulation is commonly based on statistical averaging. This macroscopic approach does not take into account spatio-temporal effects that may influence protocol behavior on microscopic level. In this paper, we introduce a visualization approach based on ns-2 trace files to graphically reproduce the dissemination process step by step. Our visualizer currently supports the data-dissemination protocol EMDV and can be extended to support other protocols as well.

NS-2, with its IEEE 802.11 support, is a widely utilized simulation tool for wireless communications researchers. However, the current NS-2 distribution code has some significant shortcomings both in the overall architecture and the modeling details of the IEEE 802.11 MAC and PHY modules. This paper presents a completely revised architecture and design for these two modules. The resulting PHY is a full featured generic module able to support any single channel frame-based communications (i.e. it is also able to support non-IEEE 802.11 based MAC). The key features include cumulative SINR computation, preamble and PLCP header processing and capture, and frame body capture. The MAC accurately models the basic IEEE 802.11 CSMA/CA mechanism, as required for credible simulation studies. The newly designed MAC models transmission and reception coordination, backoff management and channel state monitoring in a structured and modular manner. In turn, the contributions of this paper make extending the MAC for protocol researches much easier and provide for a significantly higher level of simulation accuracy.

Vehicular ad hoc networks, in which vehicles directly exchange information through wireless communication, promise to increase transport efficiency and traffic safety. In this paper we address the challenge of demonstrating the beneficial impact of vehicular ad hoc networks on traffic safety via simulation. We provide a blueprint for such a simulation experiment. The required building blocks discussed in this paper comprise accident modeling, safety metrics, design of an accident prevention application (APA) based on vehicular networks, and a model of the performance of the communication system. We then focus on the aspect of how an APA can be designed and formalized with the help of Markov reward processes, and show that the model is mathematically 'well-behaving'. The APA will allow us in the future to assess a communication system's performance with respect to traffic safety.

The robustness of peer-to-peer (P2P) networks, in particular of DHT-based overlay networks, suffers significantly when a Sybil attack is performed. We tackle the issue of Sybil attacks from two sides. First, we clarify, analyze, and classify the P2P identifier assignment process. By clearly separating network participants from network nodes, two challenges of P2P networks under a Sybil attack become obvious: i) stability over time, and ii) identity differentiation. Second, as a starting point for a quantitative analysis of time-stability of P2P networks under Sybil attacks and under some assumptions with respect to identity differentiation, we propose an identity registration procedure called self-registration that makes use of the inherent distribution mechanisms of a P2P network.

In wireless one-hop broadcast communications, each node broadcasts messages to inform all neighbors within an intended communication range. Clearly, the packet transmission of the various nodes might interfere with each other due to the overlapping communication ranges. IEEE 802.11 Distributed Coordination Function (DCF) provides some basic mechanisms for coordination of these transmissions. However, due to its distributed nature, DCF suffers from coordination failures, e.g., due to the very well-known hidden terminal problem. When considering realistic radio propagation phenomena to various degrees, these 'incoordination problems' can drastically increase. On the other hand, transceivers with packet capturing capability might be able to deal with some of the uncoordinated packets. In order to understand the effects of different radio propagation environments on packet level incoordination, we provide a detailed simulation study measuring six transmission success/failure categories and five performance metrics. We report quantitative results w.r.t. probability of incoordination and the effects of power-setting and packet retransmission strategies.

Improving the safety of drivers and passengers by wirelessly exchanging information between vehicles represents a major driving force for the design of vehicular ad hoc networks. In a heavy loaded 802.11-based network, however, safety-related packets might collide frequently and cannot be decoded by a receiver, thus they might not be effective in increasing the safety level on the roads. In this paper, we propose to use transmit power control in order to reduce packet collisions, while taking into account the major design goal of vehicular ad hoc networks, i.e. increasing safety. While previous work has addressed the issue of power control primarily for optimizing network capacity and/or connectivity, the optimization criterion for improving safety has to be built upon the concept of fairness: a higher transmit power of a sender should not be selected at the expense of preventing other vehicles to send/receive their required amount of safety information. In this paper, we propose a fully distributed and localized algorithm called D-FPAV (distributed fair power adjustment for vehicular networks) for adaptive transmit power adjustment which is formally proven to achieve max-min fairness. Furthermore, we investigate the effectiveness and robustness of D-FPAV through extensive simulations based on a realistic highway scenario and different radio propagation models

The discrepancy between real-world radio channel behavior and its standard modeling in simulations (unit disk graph) is a major reason for protocols to perform differently - often worse - than predicted when deployed in a real-world setup. As researchers having to deal with real ad hoc networks are aware of, assuming a fixed border for a node's communication range might not only lead to inaccurate results but also to a wrong judgment on the comparison between different protocols. We have set up a simulation study to investigate the effects of realistic channel characteristics on packet forwarding strategies for vehicular ad hoc networks. The contributions of this paper are threefold: i) we provide a performance evaluation of various routing/forwarding strategies under the realistic non-deterministic Nakagami radio propagation model and compare the results with the ones obtained using the standard two-ray-ground model. Validated German highway movement patterns are used to model node mobility. ii) We demonstrate that realistic channel conditions present an opportunity and not only a drawback for some forwarding strategies. More specifically, we show that for contention-based forwarding (CBF) techniques, realistic channel characteristics provide a positive impact in terms of an increased average hop distance. iii) We provide an analytical derivation of the expected hop distance for CBF that provides a basis to optimally adjust CBF parameters

This thesis is that a peer-to-peer network's overlay topology should adapt to match the demand graph of the peer-to-peer network. In order to assess the effectiveness of various adaptation mechanisms, a comparison with an optimal topology for a given demand graph would be helpful. However, several related optimization/decision problems have been shown to be NP-hard. The contributions of this paper are threefold: i) NP-hardness results related to assessing overlay adaptation strategies were briefly surveyed, ii) a specific optimization problem and metric was presented, and iii) experimental results indicating the potential of optimizing the overlay topology were provided. Finally, in the spirit of a 'challenge paper' various open issues were stated and discussed.

The degree of dynamics with respect to changes of the network's topology strongly affect the performance of a wireless mobile ad hoc network. Main reasons for topological changes are (i) node mobility and (ii) wireless radio fluctuations, e.g., due to fading effects. The impact of node mobility on ad hoc network performance has already been studied intensively. However these studies usually do not consider temporal fluctuations of the wireless channel. We quantitatively study the impact of radio fluctuations on the performance of wireless ad hoc networks. Based on field trial measurements of IEEE 802.11b wireless LAN communication in a static line-of-sight scenario, we derive a basic model for non-deterministic, but temporally dependent, received signal power variations. According to the derived model, we quantify the impact of radio fluctuations on topological change rate (TCR) and link stability as relevant ad hoc network performance metrics via simulation. The effects of pure node mobility and the effects of signal strength fluctuations, as well as the combination of node mobility and fluctuations, are studied. We demonstrate that signal strength fluctuations have a significant impact on ad hoc network performance metrics sometimes 'outperforming' the impact of node mobility. Thus, non-deterministic radio fluctuations cannot be ignored when designing robust ad hoc network protocols based on ad hoc network simulation and analysis.

The random waypoint model is a commonly used mobility model for simulations of wireless communication networks. In this paper, we present analytical derivations of some fundamental stochastic properties of this model with respect to: (a) the length and duration of a movement epoch, (b) the chosen direction angle at the beginning of a movement epoch, and (c) the cell change rate of the random waypoint mobility model when used within the context of cellular networks. Our results and methods can be used to compare the random waypoint model with other mobility models. The results on the movement epoch duration as well as on the cell change rate enable us to make a statement about the 'degree of mobility' of a certain simulation scenario. The direction distribution explains in an analytical manner the effect that nodes tend to move back to the middle of the system area.

The Fleetnet project aims at the development of a wireless ad hoc network for inter-vehicle communications. We present the rationale behind the choice of an appropriate radio hardware and the use of a position-based routing approach and outline applications to exploit the Fleetnet platform. In addition, we discuss simulation of vehicle movements as a basis for protocol evaluation as well as aspects of Internet integration of Fleetnet. We state the basic problems together with the intended approach of tackling these challenges, thereby providing an overview of the Fleetnet project

A fractal coder partitions an image into blocks that are coded via self-references to other parts of the image itself. We present a fractal coder that derives highly image-adaptive partitions and corresponding fractal codes in a time-efficient manner using a region-merging approach. The proposed merging strategy leads to improved rate-distortion performance compared to previously reported pure fractal coders, and it is faster than other state-of-the-art fractal coding methods.

Summary form only given. We present a new AVQ-based video coder for very low bitrates. To encode a block from a frame, the encoder offers three modes: (1) a block from the same position in the last frame can be taken; (2) the block can be represented with a vector from the codebook; or (3) a new vector, that sufficiently represents a block, can be inserted into the codebook. For mode 2 a mean-removed VQ scheme is used. The decision on how blocks are encoded and how the codebook is updated is done in an rate-distortion (R-D) optimized fashion. The codebook of shape blocks is updated once per frame. First results for an implementation of such a scheme have been reported previously. Here we extend the method to incorporate a wavelet image transform before coding in order to enhance the compression performance. In addition the rate-distortion optimization is comprehensively discussed. Our R-D optimization is based on an efficient convex-hull computation. This method is compared to common R-D optimizations that use a Lagrangian multiplier approach. In the discussion of our R-D method we show the similarities and differences between our scheme and the generalized threshold replenishment (GTR) method of Fowler et al. (1997). Furthermore, we demonstrate that the translation of our R-D optimized AVQ into the wavelet domain leads to an improved coding performance. We present coding results that show that one can achieve the same encoding quality as with comparable standard transform coding (H.263). In addition we offer an empirical analysis of the short- and long-term behavior of the adaptive codebook. This analysis indicates that the AVQ method uses the vectors in its codebook for some kind of long-term prediction.

Summary form only given. We discuss several variations to the original algorithm proposed by Ke and Marcellin (see Proc. IEEE ICIP, Washington DC, 1995). We have extended the trellis quantization (TQ) scheme by performing two-row joint optmizations instead of optimizing row by row. Unfortunately, while increasing the computation time quite a bit, this has lead only to marginal coding gains. A progressive probability update scheme has lead to much better convergence and to a 0.3 bpp gain over the original fixed scheme. When using lossy plus near-lossless coding the lossy version can be used for better context modelling without increasing the computational complexity of the near-lossless residual coding. Improvements of 0.1-0.2 bpp were observed. Since it is computationally infeasible to include more pixels to be determined by the TQ process, one has the choice of either using better prediction/context-modelling or doing TQ. Our tests indicate that the preference should be given to sophisticated prediction/modelling.

In fractal compression a signal is encoded by the parameters of a contractive transformation whose fixed point (attractor) is an approximation of the original data. Thus fractal coding can be viewed as the optimization problem of finding in a set of admissible contractive transformations the transformation whose attractor is closest to a given signal. The standard fractal coding scheme based on the collage theorem produces only a suboptimal solution. We demonstrate by a reduction from MAXCUT that the problem of determining the optimal fractal code is NP-hard. To our knowledge, this is the first analysis of the intrinsic complexity of fractal coding. Additionally, we show that standard fractal coding is not an approximating algorithm for this problem.

This paper is concerned with the efficient storage of the luminance parameters in a fractal code by means of vector quantization (VQ). For a given image block (range) the collage error as a function of the luminance parameters is a quadratic function with ellipsoid contour lines. We demonstrate how these functions should be used in an optimal codebook design algorithm leading to a non-standard VQ-scheme. In addition we present results and an evaluation of this approach. The analysis of the quadratic error functions also provides guidance for optimal scalar quantization.

In fractal image compression a partitioning of the image into ranges is required. Saupe and Ruhl (1996) proposed to find good partitionings by means of a split-and-merge process guided by evolutionary computing. In this approach ranges are connected sets of small square image blocks. Far better rate-distortion curves can be obtained as compared to traditional quadtree partitionings, however, at the expense of an increase of computing time. In this paper we show how conventional acceleration techniques and a deterministic version of the evolution reduce the time-complexity of the method without degrading the encoding quality. Furthermore, we report on techniques to improve the rate-distortion performance and evaluate the results visually.

In fractal image compression the encoding step is computationally expensive. We present a new technique for reducing the computational complexity. It is lossless, i.e., it does not sacrifice any image quality for the sake of the speedup. It is based on a codebook coherence characteristic to fractal image compression and leads to a novel application of the fast Fourier transform-based convolution. The method provides a new conceptual view of fractal image compression. This paper focuses on the implementation issues and presents the first empirical experiments analyzing the performance benefits of the convolution approach to fractal image compression depending on image size, range size, and codebook size. The results show acceleration factors for large ranges up to 23 (larger factors possible), outperforming all other currently known lossless acceleration methods for such range sizes.