Modern geolocation ecosystems rely on diverse technical solutions and architectures, often proprietary, making it difficult to develop a global understanding of the privacy implications of location data production. This challenge is particularly critical given the ubiquity of geolocation in modern digital infrastructures and the central role of location data in privacy concerns. Yet, existing work largely focuses on isolated case studies, resulting in a fragmented understanding of the privacy risks associated with location data production. In this work, we introduce an abstract model of geolocation ecosystems together with a systematic methodology for analyzing their privacy implications, which we apply to nine representative case studies spanning a broad range of architectures, from OS-level geolocation services to object-tracking platforms. This comparative analysis identifies structural design choices that significantly impact users' privacy and reveals common structural privacy risks across heterogeneous ecosystems, which reflect architectural design decisions rather than security vulnerabilities or poor system design. These findings, together with gaps identified in existing defense mechanisms, motivate research directions aimed at strengthening privacy in future geolocation architectures.

Tag Management Systems (TMS) were developed in order to support website Publishers in installing multiple third-party JavaScript scripts (Tags) on their websites. Google has proposed its own TMS called "Google Tag Manager" (GTM) that is currently present on 52% of the top 1 million most popular websites. However, GTM has not yet been thoroughly evaluated by the academic research community. In this work, we study, for the first time, the Tags provided within the GTM system. Our methodology consists in installing Tags in isolation to analyze the types of data that Tags collect and contrast them to the legal and technical documentation, in collaboration with a legal expert. Across three studies - in-depth analysis of 6 Tags, automated analysis of 718 Tags, and analysis of Google "Consent Mode" - we discover multiple hidden data leaks, incomplete and diverging declarations, undisclosed third- parties and cookies, personal data sharing without consent and we further identify potential legal violations within EU Data Protection law.

In MRI studies, the aggregation of imaging data from multiple acquisition sites enhances sample size but may introduce site-related variabilities that hinder consistency in subsequent analyses. Deep learning methods for image translation have emerged as a solution for harmonizing MR images across sites. In this study, we introduce IGUANe (Image Generation with Unified Adversarial Networks), an original 3D model that leverages the strengths of domain translation and straightforward application of style transfer methods for multicenter brain MR image harmonization. IGUANe extends CycleGAN by integrating an arbitrary number of domains for training through a many-to-one architecture. The framework based on domain pairs enables the implementation of sampling strategies that prevent confusion between site-related and biological variabilities. During inference, the model can be applied to any image, even from an unknown acquisition site, making it a universal generator for harmonization. Trained on a dataset comprising T1-weighted images from 11 different scanners, IGUANe was evaluated on data from unseen sites. The assessments included the transformation of MR images with traveling subjects, the preservation of pairwise distances between MR images within domains, the evolution of volumetric patterns related to age and Alzheimer's disease (AD), and the performance in age regression and patient classification tasks. Comparisons with other harmonization and normalization methods suggest that IGUANe better preserves individual information in MR images and is more suitable for maintaining and reinforcing variabilities related to age and AD. Future studies may further assess IGUANe in other multicenter contexts, either using the same model or retraining it for applications to different image modalities. Codes and the trained IGUANe model are available at https://github.com/RocaVincent/iguane_harmonization.git.

LoRaWAN is a leading IoT technology worldwide, increasingly integrated into pervasive computing environments through a growing number of sensors in various industrial and consumer applications. Although its security vulnerabilities have been extensively explored in the recent literature, its ties to human activities warrant further privacy research. Existing device identification and activity inference attacks are only effective with a stable identifier. We find that the identifiers in LoRaWAN exhibit high variability, and more than half of the devices use them for less than a week. For the first time in the literature, we explore the feasibility of device fingerprinting in LoRaWAN, allowing long-term device linkage, i.e. associating various identifiers of the same device. We introduce a novel holistic fingerprint representation utilizing multiple domains, namely content, timing, and radio information, and present a machine learning-based solution for linking identifiers. Through a large-scale experimental evaluation based on real-world datasets containing up to 41 million messages, we study multiple scenarios, including an attacker with limited resources. We reach 0.98 linkage accuracy, underscoring the need for privacy-preserving measures. We showcase countermeasures including payload padding, random delays, and radio signal modulation, and conclude by assessing their impact on our fingerprinting solution.

LoRaWAN, a widely deployed LPWAN protocol, raises privacy concerns due to metadata exposure, particularly concerning the exploitation of stable device identifiers. For the first time in literature, we propose two privacy-preserving pseudonym schemes tailored for LoRaWAN: resolvable pseudonyms and sequential pseudonyms. We extensively evaluate their performance and applicability through theoretical analysis and simulations based on a large-scale real-world dataset of 71 million messages. We conclude that sequential pseudonyms are the best solution.

Contact Tracing (CT) is an old, recognized epi-demiological tool, and since a digital variant is now within reach, a variety of smartphone-based solutions have been rapidly developed and deployed since 2020, with mixed results and amid controversies. Yet, achieving reliable and effective digital CT at large scale is still an open problem. In this work, we contribute with an open source software platform on top of which various CT solutions can be quickly developed and tested. More specifically, we design PEPPER, which jointly leverages Bluetooth Low Energy (BLE) and Ultra Wide Band (UWB) radios for contact detection, combined with the DESIRE privacy-preserving CT protocol. We show that PEPPER+DESIRE can operate on cheap physical tokens based on low-power microcontrollers, opening new use-cases with less personal, potentially disposable devices, that could be more widely used. We also evaluate the complementarity of Bluetooth and UWB in this context, via experiments mimicking various scenarios relevant for CT. Compared to BLE-only CT, we show that UWB can decrease false negatives (e.g., in presence of human body occlusion), meaning that more actual contacts will be found, a key benefit from an epidemiological viewpoint. Our results suggest that, while PEPPER+DESIRE improves precision over state-of-the-art, further research is required to harness UWB-BLE synergy for CT in practice. To this end, our open source platform (which can run on an open-access testbed) provides a useful playground for the research community.

In LoRaWAN networks, devices are identified by two identifiers: a globally unique and stable one called DevEUI, and an ephemeral and randomly assigned pseudonym called DevAddr. The association between those identifiers is only known by the network and join servers, and is not available to a passive eavesdropper.

Web technologies and services widely rely on data collection via tracking users on websites. In the EU, the collection of such data requires user consent thanks to the ePrivacy Directive (ePD), and the General Data Protection Regulation (GDPR). To comply with these regulations and integrate consent collection into their websites, website publishers often rely on third-party contractors, called Consent Management Providers (CMPs), that provide consent pop-ups as a service. Since the GDPR came in force in May 2018, the presence of CMPs continuously increased. In our work, we systematically study the installation and configuration process of consent pop-ups and their potential effects on the decision making of the website publishers. We make an in-depth analysis of the configuration process from ten services provided by five popular CMP companies and identify common unethical design choices employed. By analysing CMP services on an empty experimental website, we identify manipulation of website publishers towards subscription to the CMPs paid plans and then determine that default consent pop-ups often violate the law. We also show that configuration options may lead to non-compliance, while tracking scanners offered by CMPs manipulate publishers. Our findings demonstrate the importance of CMPs and design space offered to website publishers, and we raise concerns around the privileged position of CMPs and their strategies influencing website publishers.

Application-Level Forward Erasure Correction (AL-FEC) codes have become a key component of communication systems in order to recover from packet losses. This work analyzes the benefits of the AL-FEC codes based on a sliding encoding window (A.K.A. convolutional codes) for the reliable broadcast of real-time flows to a potentially large number of receivers over a constant bit rate channel. It first details the initialization of both sliding window codes and traditional block codes in order to keep the maximum AL-FEC decoding latency below a target latency budget. Then it presents detailed performance analyzes using official 3GPP mobility traces, representative of our use case which involves mobile receivers. This work highlights the major benefits of RLC codes, representative of sliding window codes, that outperform any block code, from Raptor codes (that are part of 3GPP MBMS standard) up to ideal MDS codes, both in terms of reduced added latency and improved robustness. It also demonstrates that our RLC codec features decoding speeds that are an order of magnitude higher than that of Raptor codes.

Recent work have shown that Reed-Müller (RM) codes achieve the erasure channel capacity. However, this performance is obtained with maximum-likelihood decoding which can be costly for practical applications. In this paper, we propose an encoding/decoding scheme for Reed-Müller codes on the packet erasure channel based on Plotkin construction. We present several improvements over the generic decoding. They allow, for a light cost, to compete with maximum-likelihood decoding performance, especially on high-rate codes, while significantly outperforming it in terms of speed.

This work introduces the "Packet Too Big"-"Packet Too Small" ICMP based attack against IPsec gateways. We explain how an attacker having eavesdropping and packet injection capabilities, from the insecure network where he only sees encrypted packets, can force a gateway to reduce the Path MTU of an IPsec tunnel to the minimum, which triggers severe issues for the hosts behind this gateway: depending on the Path MTU discovery algorithm in use, the attack either creates a Denial of Service or major performance penalties. This attack highlights two fundamental problems that we discuss, along with potential counter-measures to mitigate the attack while keeping ICMP benefits.

Several types of AL-FEC (Application-Level FEC) codes for the Packet Erasure Channel exist. Random Linear Codes (RLC), where redundancy packets consist of random linear combinations of source packets over a certain finite field, are a simple yet efficient coding technique, for instance massively used for Network Coding applications. However the price to pay is a high encoding and decoding complexity, especially when working on GF(28), which seriously limits the number of packets in the encoding window. On the opposite, structured block codes have been designed for situations where the set of source packets is known in advance, for instance with file transfer applications. Here the encoding and decoding complexity is controlled, even for huge block sizes, thanks to the sparse nature of the code and advanced decoding techniques that exploit this sparseness (e.g., Structured Gaussian Elimination). But their design also prevents their use in convolutional use-cases featuring an encoding window that slides over a continuous set of incoming packets. In this work we try to bridge the gap between these two code classes, bringing some structure to RLC codes in order to enlarge the use-cases where they can be efficiently used: in convolutional mode (as any RLC code), but also in block mode with either tiny, medium or large block sizes. We also demonstrate how to design compact signaling for these codes (for encoder/decoder synchronization), which is an essential practical aspect.

On Android, installing an application implies accepting the permissions it requests, and these permissions are then enforced at runtime. In this work, we focus on the privacy implications of the ACCESS_WIFI_STATE permission. For this purpose, we analyzed permissions of the 2700 most popular applications on Google Play and found that the ACCESS_WIFI_STATE permission is used by 41% of them. We then performed a static analysis of 998 applications requesting this permission and based on the results, chose 88 applications for dynamic analysis. Our analyses reveal that this permission is already used by some companies to collect user Personally Identifiable Information (PII). We also conducted an online survey to study users' perception of the privacy risks associated with this permission. This survey shows that users largely underestimate the privacy implications of this permission. As this permission is very common, most users are therefore potentially at risk.

In this paper we analyze the design of Generalized LDPC-staircase (GLDPC-staircase) codes, where the base code is an LDPC-Staircase code and component codes are Reed-Solomon codes. More precisely we compare two schemes: scheme A has the property that on each check node of the base code the repair symbol generated by the LDPC code is also a Reed-Solomon repair symbol. On the opposite, with scheme B for each check node the repair symbols generated by the LDPC code are Reed-Solomon source symbols. In this work we perform a behavioral analysis of the two schemes in order to determine the best one for ITerative + Reed Solomon (IT+RS) and Maximum Likelihood (ML) decoding. To that purpose we use an asymptotic analysis using Density evolution (DE) and EXtrinsic Information Transfer techniques, as well as a finite length analysis. We show that scheme A is globally the best solution since it significantly performs better than scheme B with an (IT+RS) decoding and yields similar performance with ML decoding.

Application-Level Forward Erasure Correction (AL-FEC) codes are a key element of telecommunication systems. They are used to recover from packet losses when retransmission are not feasible and to optimize the large scale distribution of contents. In this paper we introduce Reed-Solomon/LDPC-Staircase codes, two complementary AL-FEC codes that have recently been recognized as superior to Raptor codes in the context of the 3GPP-eMBMS call for technology [1]. After a brief introduction to the codes, we explain how to design high performance codecs which is a key aspect when targeting embedded systems with limited CPU/battery capacity. Finally we present the performances of these codes in terms of erasure correction capabilities and encoding/decoding speed, taking advantage of the 3GPP-eMBMS results where they have been ranked first.

ICMP is a key protocol to exchange control and error messages over the Internet. An appropriate ICMP's processing throughout a path is therefore a key requirement both for troubleshooting operations (e.g. debugging routing problems) and for several functionnalities (e.g. Path Maximum Transmission Unit Discovery, PMTUD). Unfortunately it is common to see ICMP malfunctions, thereby causing various levels of problems. The contributions of this paper are threefold. We first introduce a taxonomy of the way routers process ICMP, which is of great help to understand for instance certain traceroute outputs. Secondly we introduce IBTrack, a tool that any user can use to automatically characterize ICMP issues within the Internet, without requiring any additional in-network assistance (e.g. there is no vantage point). Finally we validate our IBTrack tool with large scale experiments and we take advantage of this opportunity to provide some statistics on how ICMP is managed by Internet routers.

This work introduces the Generalized Low Density Parity Check (GLDPC)-Staircase codes for the erasure channel, that are constructed by extending LDPC-Staircase codes through Reed Solomon (RS) codes based on “quasi” Hankel matrices. This construction has several key benefits: in addition to the LDPC-Staircase repair symbols, it adds extra-repair symbols that can be produced on demand and in large quantities, which provides small rate capabilities. Additionally, with selecting the best internal parameters of GLDPC graph and under hybrid Iterative/Reed-Solomon/Maximum Likelihood decoding, the GLDPC-Staircase codes feature a very small decoding overhead and a low error floor. These excellent erasure capabilities, close to that of ideal, MDS codes, are obtained both with large and very small objects, whereas, as a matter of comparison, LDPC codes are known to be asymptotically good. Therefore, these properties make GLDPC-Staircase codes an excellent AL-FEC solution for many situations that require erasure protection such as media streaming.

Unequal Erasure Protection (UEP) is an attractive approach to protect data flows that contain information of different priority levels. The various solutions that have been proposed can be classified into three families. The first one consists of specific, UEP-aware FEC codes, that map the information dependency within the code structure. It enables to design a specific solution, valid for a specific data flow, as in [3]. However, because this is a specific solution, its practical interest is also narrowed. In this work we focus on two additional solution families. One family implements UEP thanks to a dedicated packetization scheme, as it is the case with Priority Encoding Transmission (PET) [2], while the other family uses a dedicated signaling scheme, as is the case with the Generalized Object Encoding (GOE) [6]. These two solutions have the main benefit of being compatible with existing standardized Application Layer FEC (AL-FEC) schemes, which is a major practical benefit. Through a careful modeling of both proposals, we have demonstrated that the protection performance of both approaches are equivalent [7]. However additional key differences become apparent when considering such a practical metric as the peak memory consumption. Thanks to a modeling of the packet storage behavior at the receiver side, and by considering two major parameters, namely the channel loss probability and the permutation type, we show that the GOE scheme (without interleaver) requires a smaller memory storage than PET. This result is reversed if GOE uses a uniform interleaver.

This paper introduces a robust point-to-point transmission scheme: Tetrys, that relies on a novel on-the-fly erasure coding concept which reduces the delay for recovering lost data at the receiver side. In current erasure coding schemes, the packets that are not rebuilt at the receiver side are either lost or delayed by at least one RTT before transmission to the application. The present contribution aims at demonstrating that Tetrys coding scheme can fill the gap between real-time applications requirements and full reliability. Indeed, we show that in several cases, Tetrys can recover lost packets below one RTT over lossy and best-effort networks. We also show that Tetrys allows to enable full reliability without delay compromise and as a result: significantly improves the performance of time constrained applications. For instance, our evaluations present that video-conferencing applications obtain a PSNR gain up to 7 dB compared to classic block-based erasure codes.

In this paper, we show that over the binary erasure channel, Quasi-Cyclic LDPC codes can efficiently accommodate the hybrid iterative/ML decoding. We demonstrate that the quasi-cyclic structure of the parity-check matrix can be advantageously used in order to significantly reduce the complexity of the ML decoding. This is achieved by a simple row/column permutation that transforms a QC matrix into a pseudo-band form. Based on this approach, we propose a class of QC-LDPC codes with almost ideal error correction performance under the ML decoding, while the required number of row/symbol operations scales as k√k, where k is the number of source symbols.

Real-time streaming applications typically require minimizing packet loss and transmission delay so as to keep the best possible playback quality. From this point of view, IP datagram losses (e.g. caused by a congested router, or caused by a short term fading problem with wireless transmissions) have major negative impacts. Although Application Layer Forward Error Correction (AL-FEC) is a useful technique for protecting against packet loss, the playback quality is largely sensitive to the AL-FEC code/codec features and the way they are used. In this work, we consider three FEC schemes for the erasure channel: 2D parity check codes, Reed-Solomon over GF(28) codes, and LDPC-Staircase codes, all of them being currently standardized within IETF. We have integrated these FEC schemes in the FECFRAME framework, a framework that is also being standardized at IETF, and whose goal is to integrate AL-FEC schemes in real-time protocol stacks in a simple and flexible way. Then we modified the Digital Video Transport System (DVTS) high-performance real-time video streaming application so that it can benefit from FECFRAME in order to recover from transmission impairments. We then carried out several performance evaluations in order to identify, for a given loss rate, the optimal configuration in which DVTS performs the best.

With the expansion and the convergence of computing and communication, the dynamic provisioning of customized processing and networking infrastructures as well as resource virtualization are appealing concepts and technologies. Therefore, new models and tools are needed to allow users to create, trust and exploit such on-demand virtual infrastructures within wide area distributed environments. This paper proposes to combine network and system virtualization with cryptographic identification and SPKI/HIP principles to help the user communities to build and share their own resource reservoirs. These ideas are implemented in the HIPerNet framework enabling the creation and the management of customized confined execution environments in a large scale context. Based on the example of biomedical applications, the paper focuses on the security model of the HIPerNet system and develops the key aspects of our distributed security approach. Then the paper discusses and illustrates how HIPerNet solutions fulfill the security requirements of applications through different scenarios.

File distribution is becoming a key technology, in particular in large scale content broadcasting systems like DVB-H/SH. They largely rely on Application Level FEC codes (AL-FEC) in order to recover from transmission erasures. We believe that sooner or later, content integrity and source authentication security services will be required in these systems. In order to save the client terminal resources, which can be a handheld autonomous device, we have designed a hybrid system that merges the AL-FEC decoding and content integrity/source authentication services. More precisely our system can detect a random object corruption triggered by a deliberate attack with a probability close to 100% almost for free in terms of computation overhead. The case of intelligent corruptions is also addressed and counter measures proposed.

This paper presents new FEC codes for the erasure channel, LDPC-Band, that have been designed so as to optimize a hybrid iterative-Maximum Likelihood (ML) decoding. Indeed, these codes feature simultaneously a sparse parity check matrix, which allows an efficient use of iterative LDPC decoding, and a generator matrix with a band structure, which allows fast ML decoding on the erasure channel. The combination of these two decoding algorithms leads to erasure codes achieving a very good trade-off between complexity and erasure correction capability.

Forward Error Correction (FEC) is commonly used for content broadcasting. The performance of the FEC codes largely vary, depending in particular on the code used and on the object size, and these parameters have already been studied in detail by the community. However the FEC performances are also largely dependent on the packet scheduling used during transmission and on the loss pattern introduced by the channel. Little attention has been devoted to these aspects so far. Therefore the present paper analyzes their impacts on the three FEC codes: LDGM Staircase, LDGM Triangle, two large block codes, and Reed-Solomon. Thanks to this analysis, we define several recommendations on how to best use these codes, depending on the test case and on the channel, which turns out to be of utmost importance.

Web Services constitute a set of technologies that many believe will change the Web communication landscape within the next few years. They offer standardized and easy communications for distributed systems over the Internet. However their dynamic and distributed nature requires a well-managed system, and pending security issues prevent their widespread adoption. Meanwhile there is a big rage toward the use of Virtual Private Networks (VPNs) to secure communications in a cost-effective environment like the Internet. In this paper we explain how to merge these two technologies in a new powerful hybrid model that: (1) enables an easy management of Web services, (2) provides Web services security thanks to the use of dynamic and programmable VPNs, and (3) remains simple and fully integrated.

We study the impact of cheating nodes in application-level multicast overlay trees. We focus on selfish nodes acting independently, cheating about their distance measurements during the control phase building or maintaining the tree. More precisely, we study, through simulations, the impact of simple cheating strategies in four protocols, representatives of different application-level multicast protocol "families": HBM (a protocol based on a centralized approach), TBCP (a distributed, tree first protocol), NICE (a distributed, tree first protocol based on clustering) and NARADA (a mesh first protocol). We evaluate the impact of cheats on the performance of the overlay trees as perceived by their nodes and the underlying network.

This paper considers an application-level multicast protocol, HBM, which can be used when native multicast routing is not available. Being purely end-to-end, application-level multicast proposals in general, and HBM in particular, are intrinsically more fragile than traditional routing solutions relying on well administered and dedicated routers. Improving their robustness is therefore of high practical importance and we believe it is a key aspect for the acceptance of the technology by end users who won't tolerate that a multi-participant video-conference session be subject to frequent cuts. In this work we identify two classes of problems that lead to packet losses, and for each class we introduce and compare several schemes. Experiments show that in both cases simple yet efficient solutions exist.

In this paper we show how to build a fully secure and efficient group communication service between several sites. This service is built on top of a VPN environment where IPSec tunnels are created, on-demand, between the various sites that need to communicate. This paper is a follow-up of previous work on group communications in a VPN environment and on application-level multicast. We show that these proposal naturally fit with one-another and lead to the concept of virtual private routed network or VPRN. This concept enables us to largely improve the data distribution efficiency, and in particularly reduces the physical link stress. We are convinced that security is critical in many situations and must be the primary concern of a group communication service.

This work describes several techniques that we used to design a multicast file transfer tool on top of the asynchronous layered coding protocol proposed by the RMT IETF WG. Their goal is to improve the overall performance of that tool. More specifically we analyze several object and symbol ordering schemes that improve transmission efficiency and we see how the application level framing paradigm can help to reduce memory requirements and enable processing to be hidden behind communications.

This work introduces a novel approach for the streaming distribution of hierarchically encoded MPEG-4 presentations using IP-multicast. The main achievements of this approach are: (1) it is massively scalable in terms of number of users, (2) it ensures the reception of a minimum quality of the video to everybody, (3) bursts of packet losses do not automatically lead to a sudden change of quality unlike in most other video streaming solutions, (4) it is naturally TCP friendly, (5) it is immediately deployable and does not rely on any QoS mechanism in the network. This solution is well suited to a large scale television program distribution over the Internet. Yet it is not recommended for video-conferencing and applications with user interaction because it introduces a large playing delay.

XTP is a real time transfer protocol designed to be implemented in a dedicated hardware environment. To obtain a transputer based parallel implementation, the authors modified a standard implementation (based on UNIX BSD system) on three aspects: the structure of the implementation, interfaces with host, and system primitive references. This new implementation was modelled. Performance was analyzed. This paper tries, in two sections to distinguish what in the performance is linked to the protocol specification and what is the consequence of the implementation. For this purpose, the KRM is compared to a high performance implementation of OSI TP4 the authors had previously modelled. XTP high performance conditions of implementation (including software techniques and multi-processor host architectures) are discussed.>