Pervasive applications evolve around the user's context, making it a full-fledged communication party. However, no equivalent approach to End-to-End communication exists that allows a sender to bind data, through encryption, to a target context. Existing solutions require central infrastructures or only apply to the immediate context, restricting pervasive applications. We propose Encryption to Trusted Contexts (ETC), a communication security building block that enforces context bindings while preserving the data handling and forwarding mechanisms of the original application. Our approach leverages a Broadcast Encryption scheme to protect data in transit and binds decryption to the verification of an expressive, flexible context specification based on trusted, unforgeable sensing. Data can then be encrypted from and to any context, securely exchanged among devices, and made accessible only within the specified context. We demonstrate the feasibility of ETC in a prototypical implementation for ARM TrustZone devices, realizing communication security for context-driven, pervasive applications.

Mobile offloading overcomes the resource limitations of offloader devices by splitting resource-intensive tasks and allocating subtasks to nearby offloadee devices. In processing its subtask, each offloadee effectively executes foreign and untrusted code which might both harm the device and exhaust its resources. Given the personal nature and constrained resources of offloadee devices, such as smartphones, precise control at the offloadee over the execution environment of offloaded tasks as well as the provided and consumed resources then is a natural requirement for the success of offloading approaches. We thus contribute a mechanism for fine-grained resource control of local task execution, benefitting allocation approaches by precisely assessing, advertising, and guaranteeing offloadee processing resources. Our design protects local device integrity and usability by isolating the execution of each task in a dedicated Linux container with precisely defined resource constraints. We highlight the performance and immediate applicability of our design through a prototypical implementation using LXC containers on COTS Android smartphones that achieves controllable task execution at minimal costs: Each container starts up in only 2 ms, imposes less than 5 % computation overhead, and consumes only 10MB of memory.

While users can ubiquitously access the Internet via their Wi-Fi network or their mobile carrier network, access to foreign private Wi-Fi networks is mostly prohibited. This is because private APs have no means of authenticating foreign mobile users prior to granting access to their network, entailing severe security and liability risks. However, such Wi-Fi roaming would make the vast network resources of private users available on a collaborative basis. We propose Collaborative On-demand Wi-Fi Sharing (COWS), offering 802.1×-equivalent authentication of foreign users at private APs without the need for elaborate, hierarchical authentication infrastructures. COWS embeds authentication credentials into 802.11 association requests, enabling APs to establish 802.11 AP networks exclusively on-demand and after an authentication of the mobile user at her home network provider. Our evaluation using Android smartphones and various authentication provider instances shows the real-life applicability of COWS, enabling lightweight, collaborative Wi-Fi roaming at the APs of private users.

Within the Internet of Things (IoT), Smart Things (STs) promise to permeate all contexts of daily life, offering digital access to their physical functionality. Mobile users then would be able to ubiquitously and spontaneously interact with things they encounter, enabling a wealth of diverse usage scenarios and applications. Currently, however, ST interaction requires a pre-controlled Internet or network connection as well as the prior installation of the ST-specific interaction interface, i.e., smartphone app. Users can thus only interact with known things, in contrast to the vision of spontaneous, ubiquitous discovery and interaction. We thus propose STIF (Smart Things Interaction Framework), enabling local wireless discovery of STs spontaneously via Wi-Fi, Bluetooth Low Energy, Visible Light Communication, or Acoustic Communication. STIF allows STs to transmit their interaction interface directly to users and supports interaction based on user input via touch and AR GUIs as well as motion and speech recognition. We implement STIF for Android phones as well as Arduino and Raspberry Pi things and demonstrate the real-life applicability of the supported communication and interaction techniques.

A plethora of mobile wireless networking approaches, from multi-hop infrastructure-less networking to mobile offloading and crowd sourcing, relies on establishing communication directly between devices. However, the 802.11 ad-hoc mode, as the designated technological means to realize device-to-device communication, suffers from missing support by vendors and operating system and lacks 802.11 functionality support. If at all, mobile wireless networking approaches reach a very low number of compatible devices and have to tolerate low network performance, deprecated WEP network security, and a lack of energy saving mechanisms. Eventually, this lack of a technological basis prevents the timely and beneficial real-world adoption of mobile networking. We thus propose such a basis in MA-Fi, multi-hop mobile networking using the 802.11 infrastructure mode. Building on comprehensive vendor and device support, MA-Fi realizes 802.11n performance, WPA2 security, and efficient energy saving mechanisms in ubiquitously compatible, mobile 802.11 infrastructure mode networks. Specifically, MA-Fi uses network virtualization to establish a two-tiered network topology that seamlessly incorporates legacy Wi-Fi devices. In comparison to the ad-hoc mode, MA-Fi achieves throughput of up to 340% while reducing the network-wide energy consumption by up to 75%.

Mobile users are continuously surrounded by heterogeneous (mobile) devices that provide a basis for direct multimedia interaction within the immediate physical context. However, current multimedia approaches are restricted to sense the availability of devices and their respective multimedia application content through Internet services that manage the locality of devices and content. Each service thereby manages only the narrow context of each device according to the respective application, preventing devices and approaches from sensing the diversity, spontaneity, and dynamics of mobile contexts and the physical interaction scope.

No abstract available.

Computer Vision (CV) approaches, e.g., as the basis for mobile Augmented Reality (AR), depend on continuous Internet access for image uploads and large-scale Internet databases to perform image recognition against comparison images. This dependency impedes the ubiquity of applying CV in spontaneous, real-world mobile scenarios as users may not have continuous Internet access. Furthermore, the underlying databases are inherently volatile and may only afford sporadic coverage.

Current communication approaches assume network associations as a prerequisite to both content discovery and access. This network-centric paradigm incurs substantial communication and time overhead, as devices build knowledge of content availability only after blindly associating to a network. In pervasive mobile networking, this prerequisite and associated overhead prevents devices to efficiently identify desired communication partners, i.e., devices running an application or providing content of interest, within the broad mass of devices in communication range as found in everyday scenarios. SO-Fi, instead, realizes content-centric wireless networking by enabling pervasive content discovery before establishing a network infrastructure. SO-Fi builds on the IEEE 802.11 wireless broadcast medium to instantly achieve a discovery scope covering all devices in communication range. Realizing content discovery outside of secure network associations, SO-Fi supports use-case-specific communication security, i.e., confidentiality, WPA2 network security, DoS robustness, and user authentication. We show SO-Fi's feasibility and performance through real-world experimentation. Indeed, SO-Fi makes instant, content-centric wireless networking readily accessible to application designers.

The proliferation, flexibility, and mobility of wireless communication devices provides a readily available basis for ubiquitous mobile communication. However, the network-centric design of 802.11 does not support the spontaneity, continuity, and ubiquitous scope of mobile communication for two reasons: i) The time and maintenance overhead of 802.11 networks prevents spontaneous device interaction, and ii) 802.11 restricts the communication scope to devices in a common network. We thus enable ubiquitous wireless communication, independent from 802.11 network structures in CA-Fi, a continuous, low-overhead communication channel concurrent to 802.11 associations. CA-Fi augments 802.11 with an association-less broadcast mechanism of up to 30 kB/s, preserving up to 70 % of simultaneous 802.11 throughput and enabling unrestricted and instant networking in the wireless medium. Directly addressing applications in 802.11 frames using Bloom filters enables message aggregation for space efficiency and saves communication overhead by unifying peer and application discovery. CA-Fi inherently supports duty cycling and saves up to 44 % of the energy consumption of the 802.11 ad-hoc mode.

Recent standardization efforts focus on a number of lightweight IP security protocol variants for end-to-end security in the Internet of Things (IoT), most notably DTLS, HIP DEX, and minimal IKEv2. These protocol variants commonly consider public-key-based cryptographic primitives in their protocol design for peer authentication and key agreement. In this paper, we identify several performance and security issues that originate from these public-key-based operations on resource-constrained IoT devices. To illustrate their impact, we additionally quantify these protocol limitations for HIP DEX. Most importantly, we find that public-key-based operations significantly hamper a peer's availability and response time during the protocol handshake. Hence, IP security protocols in the IoT must be tailored to reduce the need for expensive cryptographic operations, to protect resource-constrained peers against DoS attacks targeting these cryptographic operations, and to account for high message processing times. To this end, we present three complementary, lightweight protocol extensions for HIP DEX: i) a comprehensive session resumption mechanism, ii) a collaborative puzzle-based DoS protection mechanism, and iii) a refined retransmission mechanism. Our focus on common protocol functionality allows to generalize our proposed extensions to the wider scope of DTLS and IKE. Finally, our evaluation confirms the considerable achieved improvements at modest trade-offs.

The advent of the Internet of Things (IoT) paradigm in increasing deployments promises a pervasive proliferation of smart things, capable of sensing, actuating, and processing information. In typical designs, however, application of each thing is restricted to a dedicated use case in a single network of connected devices, resulting in a closed loop of information flow. We argue that, given the envisioned diversity, capabilities, and sheer number of smart things, this obstructs the possibility of creating diverse and exciting applications that benefit of the generated information in public, global usage scenarios. In this paper, we thus aim to initiate the discussion of creating a true Internet of Things, i.e., interconnected IoT networks, based on provision and requests of generated information in a public infrastructure. We highlight the challenges in designing this infrastructure for feasible integration in the current Internet and IoT designs, comprehensive provision and retrieval of information, and versatile derivation of higher information contexts from single information sources. Assessing advantages and shortcomings of existing approaches, we propose a suitable approach and discuss both a centralized and distributed implementation of the proposed infrastructure.

6LoWPAN is an IPv6 adaptation layer that defines mechanisms to make IP connectivity viable for tightly resource-constrained devices that communicate over low power, lossy links such as IEEE 802.15.4. It is expected to be used in a variety of scenarios ranging from home automation to industrial control systems. To support the transmission of IPv6 packets exceeding the maximum frame size of the link layer, 6LoWPAN defines a packet fragmentation mechanism. However, the best effort semantics for fragment transmissions, the lack of authentication at the 6LoWPAN layer, and the scarce memory resources of the networked devices render the design of the fragmentation mechanism vulnerable.

Distributed Hash Tables (DHTs) offer an elegant and fully distributed solution for reliably storing and retrieving data. Wireless Mesh Networks (WMNs) envision a fully decentralized fashion, and as such require efficient decentralized mechanisms for service discovery, mobility support and data storage and retrieval. Hence, DHTs and WMNs seem to complement each other nicely and even share common traits and challenges, such as multi-path routing and dynamic membership of unreliable nodes. Existing Internet-based DHT approaches are designed to emphasize performance and stability in Internet scenarios and do not consider the special conditions in WMNs. In particular, they do not focus on the impact of the physical neighbor relations of DHT nodes and assume efficient global connectivity. In contrast, in a WMN, locality of communication is essential to avoid unnecessary multi-hop data transmissions and congestion on the wireless link. We present Mesh-DHT, an approach for building a scalable DHT in WMNs that puts special emphasis on the locality of nodes and links. We construct a stable, location-aware overlay network that enables fully distributed organization of information. By design, our DHT geometry is closely aligned to the network topology of the WMN to emphasize local communication. We show that our approach preserves locality in the overlay construction, is robust against node failure, and makes efficient use of local information. These properties make our approach scalable even in the presence of hundreds of mesh nodes.

We propose an efficient approach to probabilistic 3D indoor path-matching and localization based on Wi-Fi-signal measurements using Hidden Markov Model-based (HMM) algorithms. Given a 3D model of the building, we derive high-resolution emission probabilities and transition probabilities from raytracing-generated Wi-Fi signal propagations. Therefore we use both the generated signal-strength values and the geometric information of the 3D model. Based on the emission and transition probabilities and a sequence of Wi-Fi signal measurements provided by the client, the HMM-based algorithm computes the most probable path through the building.

Wireless mesh networks (WMNs) provide high-bandwidth wireless network access to mobile clients in extensible, robust multi-hop networks. WMNs support distributed service provision and data storage, catering to the advanced capabilities of current mobile devices. Services and data discovery using undirected broadcast or multicast messages, as in traditional discovery protocols, significantly harms network performance due to interference and collisions. In contrast, distributed hash tables (DHTs) offer consistent mapping of service and data identifiers to the providing devices and therefore allow a directed unicast discovery and access. However, traditional DHTs place identifiers at arbitrary distant devices in the network, resulting in frequent use of long multi-hop routing paths. Such multi-hop transmissions suffer from performance loss at each hop and also degrade the overall network performance. We propose DLSD, a DHT-based localized index structure that establishes a hierarchy of locally bounded address spaces ranging from a few nearby devices to the whole network. Iterating through this hierarchy bottom-up allows devices to find the most local provider of the requested item, thereby minimizing multi-hop transmissions while ensuring global reachability. Through this reduction of routing hops, we maintain high transmission performance and minimize interference in the network. We evaluate the feasibility of our approach and show that it significantly reduces routing overhead and outperforms traditional service discovery and DHT approaches.

Typical scenarios in the city or on campus, show a high proliferation of wireless communication devices such as smartphones, laptops or netbooks. Wireless 802.11 networks between these devices allow for a spontaneous exchange of content or provision of services without the need for infrastructure-based services. However, the above mentioned proliferation of devices and therefore large number of networks hinders users in identifying and selecting the network that serves a specific request. We propose an approach to client-driven content-centric wireless networking in which the user specifically signals his request for a user, content item or service via 802.11 management frames. Upon reception of these frames, wireless devices that serve this request establish a dedicated wireless network on-demand. Our approach seamlessly integrates into the 802.11 association process and therefore provides support for unmodified wireless devices. Furthermore, by leveraging the wireless broadcast medium, we achieve pervasive service and peer discovery without the overhead of iterating through existing networks or running a traditional service discovery protocol.

On-path network elements, such as NATs and firewalls, are an accepted commonality in today's networks. They are essential when extending network functionality and providing additional security. However, these so called middleboxes are not explicitly considered in the original TCP/IP-based network architecture. As a result, the protocols of the TCP/IP suite provide middleboxes with the same information about data flows as packet-forwarding routers. Yet, middleboxes typically perform complex functions within the network that require additional knowledge. Inferring this knowledge from observing the sparse information available in network packets requires these devices to base their decisions on ambiguous or forgeable data. In this paper, we first discuss problems arising from insufficient information and identify the resulting informational requirements of middleboxes. We then propose SEAMS, a signaling layer that provides middleboxes with descriptive and verifiable data flow contexts in addition to the IP address and port information that many middleboxes use today. Specifically, SEAMS enables middleboxes to request and use detailed information about the host, application, and user that is accessible at the communicating end hosts. This information can then be used to provide more secure and richer middlebox functions in home and enterprise network scenarios. Our evaluation shows that SEAMS is a feasible addition to TCP/IP-based networks and that it scales well in the presence of multiple on-path middleboxes.

Rapidly changing link conditions make it difficult to accurately estimate the quality of wireless links and predict the fate of future transmissions. In particular bursty links pose a major challenge to online link estimation due to strong fluctuations in their transmission success rates at short time scales. Therefore, the prevalent approach in routing algorithms is to employ a long term link estimator that selects only consistently stable links - PRR >; 90% - for packet transmissions. The use of bursty links is thus disregarded although these links provide considerable additional resources for the routing process. Based on significant empirical evidence of over 100,000 transmissions over each link in widely used 802.15.4 and 802.11 testbeds, we propose two metrics, Expected Future Transmissions (EFT) and MAC3, for runtime estimation of bursty wireless links. We introduce the Bursty Link Estimator (BLE) that, based on these two metrics, accurately estimates bursty links in the network rendering them available for packet transmissions.

NA

We present TinyWifi, a nesC code base extending TinyOS to support Linux powered network nodes. It enables developers to build arbitrary TinyOS applications and protocols and execute them directly on Linux by compiling for the new TinyWifi platform. Using TinyWifi as a TinyOS platform, we expand the applicability and means of evaluation of wireless protocols originally designed for sensornets towards inherently similar Linux driven ad hoc and mesh networks.