Cloud computing has been shown promising in enabling various analyses over large-scale genomic data integrated across multiple data sources. However, outsourcing data to remote cloud servers raises data-privacy concerns, therefore demands secure computing measures over the data analyzing process on the untrusted cloud servers. Due to the scale of genomic dataset and the length of each genomic sequence, it is challenging to evaluate data-analysis functions on outsourced genomic data securely and efficiently. In this work, we study the secure similar-sequence-query (SSQ) problem over outsourced genomic data. To address the challenges of security and efficiency, we propose a set of two-party computing protocols inmixed form, which combine secure secret sharing, garbled circuit, and partial homomorphic encryptions together and use them to jointly fulfill the secure SSQ function. Moreover, our scheme supports the fusion of genomic data from multiple data owners to generate a deduplicated-joint genomic dataset, therefore reduces the redundancy in the dataset. The performance improvements of our scheme are validated through extensive experiments on a commercial cloud platform over a real-world genomic dataset.

In this article, we propose a scheme, named QuickN, which can efficiently and securely enable nearest neighbor search over encrypted data on untrusted clouds. Specifically, we modify the search algorithm of nearest neighbors in tree structures (e.g., R-trees), such that the modified algorithm adapts to lightweight cryptographic primitives (e.g., Order-Preserving Encryption) without affecting the original faster-than-linear search complexity. Moreover, we propose an optimized algorithm on top of our modified search algorithm, where it can significantly save communication overheads of a client without introducing any additional information leakage. We devise an approximate algorithm to$k$-nearest neighbor search to improve search efficiency by taking a tradeoff in the completeness of search results. In addition, we also demonstrate our design only leaks minimal privacy against advanced inference attacks. Our experimental results on Amazon EC2 show that our algorithms are extremely practical over massive datasets.

Physical layer message integrity protection and authentication by countering signal-cancellation has been shown as a promising alternative to traditional pure cryptographic message authentication protocols, due to the non-necessity of neither pre-shared secrets nor secure channels. However, the security of such an approach remained an open problem due to the lack of systematic security modeling and quantitative analysis. In this paper, we first establish a novel signal cancellation attack framework to study the optimal signal-cancellation attacker's behavior and utility using game-theory, which precisely captures the attacker's knowledge using its correlated channel estimates in various channel environments as well as the online nature of the attack. Based on theoretical results, we propose a practical channel randomization approach to defend against signal cancellation attack, which exploits state diversity and swift reconfigurability of reconfigurable antenna to increase randomness and meanwhile reduce correlation of channel state information. We show that by proactively mimicking the attacker and placing restrictions on the attacker's location, we can bound the attacker's knowledge of channel state information, thereby achieve a guaranteed level of message integrity protection in practice. Besides, we conduct extensive experiments and simulations to show the security and performance of the proposed approach. We believe our novel threat modeling and quantitative security analysis methodology can benefit a wide range of physical layer security problems.

This work is to enhance existing fine-grained access control to support a more expressive access policy over arithmetic operation results. We aim to enable data owners to flexibly bind a user's identity with his/her authorized access target according to a given access control policy, which indicates how a piece of data obfuscated by different noises. To this end, we design a cryptographic primitive that decouples the noisy data to two components, one associated with user identity, and the other one shared and dynamically changes, with the composite of these two components evaluated and revealed at user sides. The security of our scheme is formally proven using game based approach. We implement our system on a commercial cloud platform and use extensive experiments to validate its functionality and performance.

An increasing number of companies are using data analytics to improve their products, services, and business processes. However, learning knowledge effectively from massive data sets always involves nontrivial computational resources. Most businesses thus choose to migrate their hardware needs to a remote cluster computing service (e.g., AWS) or to an in-house cluster facility which is often run at its resource capacity. In such scenarios, where jobs compete for available resources utilizing resources effectively to achieve high-performance data analytics becomes desirable. Although cluster resource management is a fruitful research area having made many advances (e.g., YARN, Kubernetes), few projects have investigated how further optimizations can be made specifically for training multiple machine learning (ML) / deep learning (DL) models. In this work, we introduce FlowCon, a system which is able to monitor loss functions of ML/DL jobs at runtime, and thus to make decisions on resource configuration elastically. We present a detailed design and implementation of FlowCon, and conduct intensive experiments over various DL models. Our experimental results show that FlowCon can strongly improve DL job completion time and resource utilization efficiency, compared to existing approaches. Specifically, FlowCon can reduce the completion time by up to 42.06% for a specific job without sacrificing the overall makespan, in the presence of various DL job workloads.

This work is a cross-domain study by utilizing the most recent cloud and edge computing techniques in the human re-identification, which is a popular computer-vision application motivated by the demand of connecting and monitoring our world in the era of Internet of Things (IoT). We systematically study the real-time re-identification problem within a large-scale video surveillance network. Motivated by the system heterogeneity in terms of real-time workload and hardware configurations, we develop a workload-aware distributed system, which optimally allocates tasks across edge servers and cloud, for pursuing a user-controlled trade-off between system responsiveness & utility. We use an experiment-oriented approach to measure and model the edge heterogeneity. A two-phase task-placement algorithm is proposed which runs with the model built in the off-line phase, and driven by the dynamic real-time workload in runtime. We implement our entire system on a commercial cloud platform and use extensive simulations and experiments to validate its efficacy and responsiveness in practice.

The growing availability of genomic data is unlocking research potentials on genomic-data analysis. It is of great importance to outsource the genomic-analysis tasks onto clouds to leverage their powerful computational resources over the large-scale genomic sequences. However, the remote placement of the data raises personal-privacy concerns, and it is challenging to evaluate data-analysis functions on outsourced genomic data securely and efficiently. In this work, we study the secure similar-sequence-query (SSQ) problem over outsourced genomic data, which has not been fully investigated. To address the challenges of security and efficiency, we propose two protocols in the mixed form, which combine two-party secure secret sharing, garbled circuit, and partial homomorphic encryptions together and use them to jointly fulfill the secure SSQ function. In addition, our protocols support multi-user queries over a joint genomic data set collected from multiple data owners, making our solution scalable. We formally prove the security of protocols under the semi-honest adversary model, and theoretically analyze the performance. We use extensive experiments over real-world dataset on a commercial cloud platform to validate the efficacy of our proposed solution, and demonstrate the performance improvements compared with state-of-the-art works.

Reconfigurable antenna (RA) has emerged as a disruptive antenna technology with the potential of significantly improving the capacity of wireless links, by agilely reconfiguring its antenna states. Through jointly optimizing antenna state selection, routing and scheduling, it offers another dimension of opportunity to enhance end- to-end (E2E) throughput in multi-hop wireless networks (MWNs). However, the throughput limit of MWNs with RAs has not been well understood, due to challenges in theoretical modeling and computational intractability caused by a large number of states. In this work, we endeavor to systematically study this problem. We first propose a general antenna state-link conflict graph model to capture the intricate state-link association and corresponding interference relationship in the network. Based on this model, we formulate a max-flow based optimization framework to derive the throughput bound of a given MWN. As this problem is NP-hard, we explore column generation to solve it more efficiently, and propose a heuristic algorithm which can also accelerate the optimal solution. Simulation results show that our proposed algorithms can efficiently approach or compute the optimal throughput, and validate the advantage of antenna reconfigurability in MWNs.

Offloading resource-intensive jobs to the cloud and nearby users is a promising approach to enhance mobile devices. This paper investigates a hybrid offloading system that takes both infrastructure-based networks and Ad-hoc networks into the scope. Specifically, we propose EDOS, an edge assisted offloading system that consists of two major components, an Edge Assistant (EA) and Offload Agent (OA). EA runs on the routers/towers to manage registered remote cloud servers and local service providers and OA operates on the users' devices to discover the services in proximity. We present the system with a suite of protocols to collect the potential service providers and algorithms to allocate tasks according to user-specified constraints. To evaluate EDOS, we prototype it on commercial mobile devices and evaluate it with both experiments on a small-scale testbed and simulations. The results show that EDOS is effective and efficient for offloading jobs.

Wireless body area networks (BANs) demand high-quality service. However, as BANs will be widely deployed in densely populated areas, they inevitably face RF cross-technology interference (CTI) from non-protocol-compliant wireless devices operating in the same spectrum range. The main challenges to defending against such a strong CTI come from the scarcity of spectrum resources, the uncertainty of the CTI sources and BAN channel status, and the stringent hardware constraints. In this paper, we first experimentally characterize the adverse effect on BAN reliability caused by the non-protocol-compliant CTI. Then, we formulate a joint routing and power control (JRPC) problem, which aims at minimizing energy consumption under strong CTI while satisfying node reachability and delay constraints. We reformulate our problem into a mixed integer linear programing problem and then derive the optimal results through IBM's CPLEX. A practical protocol, including a heuristic JRPC algorithm, is then proposed, in which we address the challenge of fast link-quality measurement by proposing a passive link-quality estimation and prediction method. Through experiments and simulations, we show that our protocol can assure the robustness of BAN even when the CTI sources are in very close vicinity, using a small amount of energy on commercial-off-the-shelf sensor devices.

Nearest neighbor search (or k-nearest neighbor search in general) is one of the most fundamental queries on massive datasets, and it has extensive applications such as pattern recognition, statistical classification, graph algorithms, Location-Based Services and online recommendations. With the raising trend of outsourcing massive sensitive datasets to public clouds, it is urgent for companies and organizations to demand fast and secure nearest neighbor search solutions over their outsourced data, but without revealing privacy to untrusted clouds. However, existing solutions for secure nearest neighbor search still face significant limitations, which make them far from practice. In this paper, we propose a new searchable encryption scheme, which can efficiently and securely enable nearest neighbor search over encrypted data on untrusted clouds. Specifically, we modify the search algorithm of nearest neighbors with tree structures (e.g., R-trees), where the modified algorithm adapts to lightweight cryptographic primitives (e.g., Order-Preserving Encryption) without affecting the original faster-than-linear search complexity. As a result, we address all the limitations in the previous works while still maintaining correctness and security. Moreover, our design is general, which can be used for secure k-nearest neighbor search, and it is compatible with other similar tree structures. Our experimental results on Amazon EC2 show that our scheme is extremely practical over massive datasets.

This paper studies the coexistence of heterogeneous multi-hop networks, which use different physical-layer technologies. We propose a new paradigm, called cooperative interference mitigation (CIM), which exploits recent advancement in interference cancellation (IC), such as technology-independent multiple output. CIM makes it possible for disparate networks to cooperatively mitigate the interference to/from each other to enhance everyone's performance. We first show the feasibility of CIM among heterogeneous multi-hop networks by exploiting only channel-ratio information. Then, we establish two tractable models to characterize the CIM behaviors of both networks by using full IC and receiver-side IC only. We propose two bi-criteria optimization problems aiming at maximizing both networks' throughput, while cooperatively canceling the interference between them based on our two models. Several simulations are carried out to compare the Pareto-optimal throughput curves by using our CIM paradigms and traditional interference-avoidance (IAV) paradigm. By comparing the results from CIM and IAV, we show that CIM could remarkably improve the coexisting networks' throughput in different network settings.

Physical layer message integrity protection and authentication by countering signal-cancellation has been shown as a promising alternative to traditional pure cryptographic message authentication protocols, due to the non-necessity of neither pre-shared secrets nor secure channels. However, the security of such an approach remained an open problem due to the lack of systematic security modeling and quantitative analysis. In this paper, we first establish a novel correlated jamming framework to study the optimal signal-cancellation attacker's behavior and utility using game-theory, which precisely captures the attacker's knowledge using its correlated channel estimates in various channel environments. Besides, we design a practical physical layer message integrity protection protocol based on ON/OFF keying and Manchester coding, which provides quantitative security guarantees in the real-world. Such a guarantee is achieved by bounding the attacker's knowledge about the future channel via proactively measuring channel statistics (mimic the attacker), so as to derive a lower-bound to the defender's signal-detection probability under optimal correlated jamming attacks. We conduct extensive experiments and simulations to show the security and performance of the proposed scheme. We believe our novel threat modeling and quantitative security analysis methodology can benefit a wide range of physical layer security problems.

Cloud computing promises users massive scale outsourced data storage services with much lower costs than traditional methods. However, privacy concerns compel sensitive data to be stored on the cloud server in an encrypted form. This posts a great challenge for effectively utilizing cloud data, such as executing common SQL queries. A variety of searchable encryption techniques have been proposed to solve this issue; yet efficiency and scalability are still the two main obstacles for their adoptions in real-world datasets, which are multi-dimensional in general. In this paper, we propose a tree-based public-key Multi-Dimensional Range Searchable Encryption (MDRSE) to overcome the above limitations. Specifically, we first formally define the leakage function and security of a tree-based MDRSE. Then, by leveraging an existing predicate encryption in a novel way, our tree-based MDRSE efficiently indexes and searches over encrypted cloud data with multi-dimensional tree structures (i.e., R-trees). Moreover, our scheme is able to protect single-dimensional privacy while previous efficient solutions fail to achieve. Our scheme is selectively secure, and through extensive experimental evaluation on a large-scale real-world dataset, we show the efficiency and scalability of our scheme.

This paper explores a new paradigm for the coexistence among heterogeneous multi-hop networks in unplanned deployment settings, called cooperative interference mitigation (CIM). CIM exploits recent advancements in physical layer technologies such as technology-independent multiple output (TIMO), making it possible for disparate networks to cooperatively mitigate the interference to each other to enhance everyone's performance, even if they possess different wireless technologies. This paper offers a thorough study of the CIM paradigm for unplanned multi-hop networks. We first show the feasibility of CIM among heterogeneous multi-hop networks by exploiting only channel ratio information, and then establish a tractable model to accurately characterize the CIM behaviors of both networks. We also develop a bi-criteria optimization formulation to maximize both networks' throughput, and propose a new methodology to compute the Pareto-optimal throughput curve as performance bound. Simulation results show that CIM provides significant performance gains to both networks compared with the traditional interference-avoidance paradigm.

Wireless Body Area Networks (BANs) demand for highly robust communication due to the criticality and time-sensitivity of the medical monitoring data. However, as BANs will be widely deployed in densely populated areas, they inevitably face the RF cross-technology interference (CTI) from non-protocol-compliant wireless devices operating in the same spectrum range, which are persistent, high power, and broadband in nature. The main challenges to defend such strong CTI come from the scarcity of spectrum resources, the uncertainty of the CTI sources and BAN channel status, and the stringent hardware constraints. Existing methods fail because of their need for extra spectrum resources or advanced hardware. In this paper, we first experimentally characterize the adverse effect on BAN reliability caused by the non-protocol-compliant CTI. Then we propose a CTI-aware joint routing and power control (JRPC) approach to ensure desired reliability goals using minimum energy resources even under strong co-channel CTI. To cope with channel uncertainty, we propose a passive link quality estimation method which exploits prediction. Through extensive experiments and simulations, we show that our proposed protocol can assure the robustness of BAN even when the CTI sources are in very close vicinity, using little overall energy and spectrum resources, and can be easily implemented on commercial-off-the-shelf (COTS) devices.

Secure initial trust establishment for multiple resource constrained devices is a fundamental issue underlying wireless networks. A number of protocols have been proposed for secure key deployment among nodes without prior shared secrets (ad hoc), however so far most of them rely on secure out-of-band (OOB) channels (e.g., audio, visual) which either only work with a small number of devices or require auxiliary hardware. In this paper, for the first time, we design a solution that enables secure initialization of a group of wireless devices, which works merely within the wireless band. Our proposed solution is based on a novel physical-layer primitive for authenticated string comparison over the insecure wireless channel, called Chorus, which simultaneously compares the equality of fixed-length authentication strings held by multiple wireless devices within constant time. The Chorus achieves a key authentication property, which prevents an adversary from tricking each device to believe that all strings are equal when they are not, which is enabled by exploiting the infeasibility of signal cancellation and unidirectional error detection codes. Chorus can be employed as a foundation to provide in-band group message authentication (GMA) and group authenticated key agreement (GAKA), that does not require any prior shared secret. Specifically, we design two GAKA protocols based on Chorus and formally prove their security. The most appealing features of our proposed protocols include: minimal hardware requirement (a common radio interface and a button), minimal user effort (pressing a button on each device on average), nearly constant running time, thus they are scalable to a large group of constrained wireless devices. Through extensive analysis and experimental evaluation, we show the security and robustness of Chorus under a realistic attack model, and demonstrate the high scalability of our GAKA protocols.