In this paper, we propose a cross body signal pairing (CBSPCR) protocol to enable key generation between wearable devices with cardiac and respiratory sensors. Most previous pairing protocols require both wearable devices to access the same biometric signal for pairing. The restriction can greatly limit communication between wearable devices and the development of new applications on the devices. We implemented CBSPCR for pairing wearable devices based on respiratory and cardiac signals. Two pairing modes are proposed for the pairing: (1) The model-based pairing is based on mathematical models between respiratory and cardiac signals. (2) The extraction-based pairing is based on the extraction of respiratory signals from cardiac signals. The pairing performance of these two modes varies with exercise intensity. To take full advantage of both pairing modes, we developed a mode switching based on the respiration rate, a reliable indicator of exercise intensity level. CBSPCR uses Lloyd-Max quantization and a BCH-based mismatch correction method to digitize the signals and correct mismatches between bit-strings. Our extensive experiments with 30 participants show that CBSPCR can generate about 0.0125 keys per second with high resistance to impersonation attacks and negligible battery consumption.

Due to its potential improvement on network throughput, network coding has attracted considerable research interests. Random Linear Network Coding (RLNC), a branch of network coding, is considered as a cipher to protect the confidentiality of Internet packets due to its features such as packet mixing in a decentralized approach. In this paper, we propose attacks to compromise RLNC as a cipher for confidentiality protection. The attacks are based on the blind source separation (BSS) technique, a statistical signal processing technique designed to recover original signals based on mixtures of original signals. The attacks include the scaling step to filter out artifacts generated by BSS algorithms and the cross-checking step to increase confidence on packets recovered by the proposed attacks. Our extensive experiments on packets collected from the Internet and a campus network show that the attacks can successfully recover about 1% of original packets.

In this paper, we draw attention to the problem of account association attacks designed to determine whether a target mobile phone number is associated with a particular online account. In the case of 4G/LTE, the adversary launches an account association attack by sending SMS messages to the target phone number and analyzing patterns in traffic related to the online account. We evaluate the proposed attacks in both a local 4G/LTE testbed and a major commercial 4G/LTE network. Our extensive experiments show that the proposed attacks can successfully identify account association with near-perfect accuracy. Our experiments also illustrate that the proposed attacks can be launched in a way that the victim receives no indication of being under attack.

In this paper, we propose to generalize the Direct Sequence Spread Spectrum (DSSS) communication scheme with a Dual Hidden Markov Model-based Spread Spectrum (DHSS) communication scheme. The generalization aims to defeat existing autocorrelation-based attacks, which are proven effective on DSSS. DHSS is highly resistant to the autocorrelation-based attacks because chip sequences in DHSS are generated randomly for each information bit with Hidden Markov Models. As a spread spectrum communication technique, DHSS still takes advantage of benefits brought by processing gain. The cost of resistance to the autocorrelation-based attacks for DHSS is slight degradation in BER performance, about 2dB inferior to DSSS.

We propose Breathe-to-Pair (B2P), a protocol for pairing and shared-key generation for wearable devices that leverages the wearer's respiration activity to ensure that the devices are part of the same body-area network. We assume that the devices exploit different types of sensors to extract and process the respiration signal. We illustrate B2P for the case of two devices that use respiratory inductance plethysmography (RIP) and accelerometer sensors, respectively. Allowing for different types of sensors in pairing allows us to include wearable devices that use a variety of different sensors. In practice, this form of sensor variety creates a number of challenges that limit the ability of the shared-key establishment algorithm to generate matching keys. The two main obstacles are the lack of synchronization across the devices and the need for correct noise-induced mismatches between the generated key bit-strings.

In this paper, we draw attention to the problem of cross-service attacks, that is, attacks that exploit information collected about users from one service to launch an attack on the same users on another service. With the increased deployment and use of what fundamentally are integrated-services networks, such as 4G/LTE networks and now 5G, we expect that cross-service attacks will become easier to stage and therefore more prevalent. As running example to illustrate the effectiveness and the potential impact of cross-service attacks we will use the problem of account association in 4G/LTE networks. Account association attacks aim at determining whether a target mobile phone number is associated with a particular online account. The the case of 4G/LTE, the adversary launches the account association attacks by sending SMS messages to the target phone number and analyzing patterns in traffic related to the online account. We evaluate the proposed attacks in both a local 4G/LTE testbed and a major commercial 4G/LTE network. Our extensive experiments show that the proposed attacks can successfully identify account association with close-to-zero false negative and false positive rates. Our experiments also illustrate that the proposed attacks can be launched in a way that the victim receives no indication of being under attack.

In this paper, we propose to extend the Direct Sequence Spread Spectrum (DSSS) communication scheme with a Hidden Markov Model-based Spread Spectrum (HSS) communication scheme. The main goal of HSS is to defeat existing autocorrelation-based attacks, which are proven effective on DSSS. HSS defeats the attacks by generating chip sequences randomly for each information bit with Hidden Markov Models. HSS, as a spread spectrum communication technique, still takes advantage of benefits brought by processing gain. The cost of resistance to the autocorrelation-based attacks for HSS is its lower BER performance in comparison with DSSS.

Smartphone reconnaissance, the first step to launch security attacks to a target smartphone, enables an adversary to tailor attacks by exploiting the known vulnerabilities of the target system. In this paper we investigate smartphone OS identification with encrypted traffic. We propose four algorithms to do that, which are based on the spectral analysis of the encrypted traffic. The algorithms are designed for high identification accuracy by removing noise frequency components and for high efficiency in terms of computation complexity. We evaluate the identification algorithms with smartphone traffic collected over three months. The experiment results show that the algorithms can identify the smartphone OS accurately. The identification accuracy can reach 100% with only 30 seconds of smartphone traffic.

Despite increasing popularity of anonymous communications, current anonymity networks are still vulnerable to traffic analysis attacks. We propose Homomorphic EnCrypTion enabled Onion Routing (HECTor) to defeat existing traffic analysis attacks. Instead of mixing traffic at the packet level as current anonymity networks, HECTor mixes traffic at the bit level with network coding techniques. In HECTor, homomorphic encryption enables onion-like layered encryption which has been proven successful in existing anonymity networks. We theoretically analyze the performance of HECTor. Our extensive experiments on HECTor show that HECTor can effectively mitigate existing traffic analysis attacks with high throughput.

Smartphone reconnaissance, the first step to launch security attacks to a target smartphone, enables an adversary to tailor attacks by exploiting known vulnerabilities of the target system. We investigate OS identification against smartphones that use encrypted traffic. A traffic content agnostic identification algorithm is proposed that is based on the spectral analysis of the encrypted traffic. The identification algorithm is designed for high identification accuracy by removing noise frequency components and for high efficiency in terms of computation complexity. We evaluate the identification algorithm against collected smartphone traffic. The experiment results show that the algorithm can identify the smartphone OS accurately. The identification accuracy can reach 100% with only 30 seconds of smartphone traffic.

In this paper, we propose a new method called Ambiguous Multi-Symmetric Cryptography (AMSC) that conceals multiple plain-texts in a cipher-text using the same number of keys. The goal of this method is to overcome the problem of symmetric cryptography failure when the shared key is exposed. The proposed method AMSC is a cryptographic primitive that preserves plausible deniability after a cryptographic key is discovered. We evaluate AMSC in terms of security and complexity. The security analysis shows that our scheme withstands all security attack models with different knowledge of the adversary. In terms of time complexity, AMSC produces the cipher-text in polynomial time with respect to the number and size of the plaintexts and keys. AMSC has two main applications: a) It sends multiple messages for multiple receivers through one cipher-text. b) It sends one real message and multiple decoys to defeat attacks by providing security beyond conventional brute-force bounds. For both applications, AMSC can be used to deny encryption.

Vehicular Ad Hoc Network (VANET) is a promising technology in which vehicle-to-vehicle and vehicle-to-roadside infrastructure wireless communications can be achieved. This is important to obtain road safety for vehicles and drivers and collision avoidance. A falsified position by malicious users is one of the important issues in VANETs. Vehicle position identification is one of the important aspects in establishing authentication and security between inter vehicular communication exchange. Deepa et al presented two approaches for verifying sender's position in a multi-hop network. Their first proposed algorithm relies on signal propagation time for verifying the position. Their second proposed algorithm verifies the position information with the help of base stations located in the coverage area of the vehicular network The main contribution of our work is validating their approach by running an ns2 simulation with dynamic number of nodes in various mobility scenarios such as urban, rural, Manhattan. We have also generated different scenarios with variable velocity ranges and simulated the VANET. We have also considered the effect of delay, jitter in our simulation and observed that the proposed approach is robust and a feasible solution to the problem of Active Position detection.

Wireless networks which would connect vehicles via the Internet to a location based service, LBS, also would expose vehicles to online surveillance. In circumstances when spatial cloaking is not effective, such as when continuous precise location is required, LBSs may be designed so that users relay dummy queries through other vehicles to camouflage true locations. This paper introduces PARROTS, Position Altered Requests Relayed Over Time and Space, a privacy protocol which protects LBS users' location information from LBS administrators even (1) when the LBS requires continuous precise location data in a vehicular ad hoc network, (2) when LBS administrators collude with administrators of vehicular wireless access points (a.k.a. roadside units, or RSUs), and (3) when precise location data might be deanonymized using map databases linking vehicle positions with vehicle owners' home/work addresses and geographic coordinates. Defense against deanonymization requires concealment of endpoints, the effectiveness of which depends on the density of LBS users and the endpoint protection zone size. Simulations using realistic vehicle traffic mobility models varying endpoint protection zone sizes measure improvements in privacy protection.

In this paper, we study topologies of sensor networks deployed for tracking multiple targets. Tracking multiple moving targets is a challenging problem. Most of the previously proposed tracking algorithms simplify the problem by assuming access to the signal from an individual target for tracking. Recently, tracking algorithms based on blind source separation (BSS), a statistical signal-processing technique widely used to recover individual signals from mixtures of signals, have been proposed. BSS-based tracking algorithms are proven to be effective in tracking multiple indistinguishable targets. The topology of a wireless sensor network deployed for tracking with BSS-based algorithms is critical to tracking performance because the topology affects separation performance, and the topology determines accuracy and precision of estimation on the paths taken by targets. We propose cluster topologies for BSS-based tracking algorithms. Guidelines on parameter selection for proposed topologies are given in this paper. We evaluate the proposed cluster topologies with extensive experiments. Our experiments show that the proposed topologies can significantly improve both the accuracy and the precision of BSS-based tracking algorithms.

In this paper, we propose an approach to track multiple non-cooperative targets with wireless sensor networks. Most existing tracking algorithms can not be directly applied to non-cooperative target tracking because they assume the access to signals from individual targets for tracking by assuming that: 1) there is only one target in a field; 2) signals from different co-operative targets can be differentiated; or 3) interference caused by signals from other targets is negligible because of attenuation. We propose a general approach for tracking non-cooperative targets. The tracking algorithm first separates the aggregate signals from multiple indistinguishable targets via the blind source separation (BSS) algorithms. Through the analysis on both the temporal and spatial correlation of the separated individual signals, the tracking algorithm determines the location of a target and its moving track. A voting scheme based on the spatial information is designed to better estimate the moving track. Furthermore, we analyze and discuss the influence of signal attenuation and the tracking resolution of the proposed tracking approach. Our experiments show that the proposed approach can both accurately and precisely track multiple indistinguishable moving targets.

In this paper, we propose a generic approach to tracking multiple indistinguishable moving targets with wireless sensor networks. The tracking algorithm first separates the aggregate signals from multiple indistinguishable targets via the Blind Source Separation (BSS) method. Through the analysis on both the temporal and the spatial correlation of the separated individual signals, the tracking algorithm determines the real-time location of a target and its moving track. A voting scheme based on the spatial information is designed to better estimate the moving track. Furthermore, we analyze and discuss the influence of signal attenuation and the tracking resolution of the proposed tracking approach. Both empirical experiments and simulations show that the proposed approach can both accurately and precisely track multiple indistinguishable moving targets.

Silence suppression, an essential feature of speech communications over the Internet, saves bandwidth by disabling voice packet transmissions when silence is detected. However, silence suppression enables an adversary to recover talk patterns from packet timing. In this paper, we investigate privacy leakage through the silence suppression feature. More specifically, we propose a new class of traffic analysis attacks to encrypted speech communications with the goal of detecting speakers of encrypted speech communications. These attacks are based on packet timing information only and the attacks can detect speakers of speech communications made with different codecs. We evaluate the proposed attacks with extensive experiments over different type of networks including commercial anonymity networks and campus networks. The experiments show that the proposed traffic analysis attacks can detect speakers of encrypted speech communications with high accuracy based on traces of 15 minutes long on average.

Communication messages in Vehicular Ad-hoc Networks (VANETs) can be used to track movement of vehicles. In this paper, we address the problem of movement tracking and enhance location privacy without affecting security and safety of vehicles. By considering unique characteristics of VANETs, we firstly propose a synchronized pseudonym changing protocol based on the concept of forming groups among neighboring vehicles. Secondly, we analytically evaluate the anonymity and unlinkability of the proposed protocol. Finally, we do a series of simulations to evaluate the performance of our protocol in real VANET environments such as Manhattan and Urban. Simulation results show that our protocol is feasible and produces excellent performances. The main advantages of our protocol compared with the existing approaches include: 1) it makes larger anonymity set and higher entropy; 2) it reduces the tracking probability; 3) it can be used in both safety and non-safety communications; and 4) Vehicles need not suspend regular communication for changing pseudonyms.

Traditional research on preserving privacy in data mining focuses on time-invariant privacy issues. With the emergence of time series data mining, traditional snapshot-based privacy issues need to be extended to be multi-dimensional with the addition

In this paper, we address attacks that exploit the timing behavior of TCP and other protocols and applications in low-latency anonymity networks. Mixes have been used in many anonymous communication systems and are supposed to provide countermeasures to defeat traffic analysis attacks. In this paper, we focus on a particular class of traffic analysis attacks, flow-correlation attacks, by which an adversary attempts to analyze the network traffic and correlate the traffic of a flow over an input link with that over an output link. Two classes of correlation methods are considered, namely time-domain methods and frequency-domain methods. Based on our threat model and known strategies in existing mix networks, we perform extensive experiments to analyze the performance of mixes. We find that all but a few batching strategies fail against flow-correlation attacks, allowing the adversary to either identify ingress and egress points of a flow or to reconstruct the path used by the flow. Counterintuitively, some batching strategies are actually detrimental against attacks. The empirical results provided in this paper give an indication to designers of Mix networks about appropriate configurations and mechanisms to be used to counter flow-correlation attacks.

Inter-vehicle communication is an emerging field of research which focuses on different ways of increasing safety and efficiency in future intelligent highways. However, the security in these inter vehicular communication is a major issue. Since the vehicular network does not have a fixed infrastructure, developing a security scheme in a highly dynamically changing environment is a major challenge. In this paper we are proposing two algorithms for verifying the position information claimed by other vehicles in a multi-hop vehicular network.

Controller area network (CAN) is the leading serial bus system for embedded control. More than two billion CAN nodes have been sold since the protocol's development in the early 1980s. CAN is a mainstream network and was internationally standardized (ISO 11898-1) in 1993. This paper describes an approach to implementing security services on top of a higher level controller area network (CAN) protocol, in particular, CANopen. Since the CAN network is an open, unsecured network, every node has access to all data on the bus. A system which produces and consumes sensitive data is not well suited for this environment. Therefore, a general-purpose security solution is needed which will allow secure nodes access to the basic security services such as authentication, integrity, and confidentiality.

Skype is one of the most popular voice-over-IP (VoIP) service providers. One of the main reasons for the popularity of Skype VoIP services is its unique set of features to protect privacy of VoIP calls such as strong encryption, proprietary protocol, unknown codec, dynamic path selection, and constant packet rate. In this paper, we propose a class of passive traffic analysis attacks to compromise privacy of Skype VoIP calls. The proposed attacks are based on application-level features extracted from VoIP call traces. The proposed attacks are evaluated by extensive experiments over different types of networks including commercialized anonymity networks and our campus network. The experiments show that the proposed traffic analysis attacks can detect speaker and speech of Skype calls with 0.33 and 0.44 detection rate, about 30-fold and 15-fold improvement over random guess respectively.

We propose a class of anonymity attacks to both wired and wireless anonymity networks. These attacks are based on the blind source separation algorithms widely used to recover individual signals from mixtures of signals in statistical signal processing. Since the philosophy behind the design of current anonymity networks is to mix traffic or to hide in crowds, the proposed anonymity attacks are very effective. The flow separation attack proposed for wired anonymity networks can separate the traffic in a mix network. Our experiments show that this attack is effective and scalable. By combining the flow separation method with frequency spectrum matching, a passive attacker can derive the traffic map of the mix network. We use a nontrivial network to show that the combined attack works. The proposed anonymity attacks for wireless networks can identify nodes in fully anonymized wireless networks using collections of very simple sensors. Based on a time series of counts of anonymous packets provided by the sensors, we estimate the number of nodes with the use of principal component analysis. We then proceed to separate the collected packet data into traffic flows that, with help of the spatial diversity in the available sensors, can be used to estimate the location of the wireless nodes. Our simulation experiments indicate that the estimators show high accuracy and high confidence for anonymized TCP traffic. Additional experiments indicate that the estimators perform very well in anonymous wireless networks that use traffic padding.

Measures for anonymity in systems must be on one hand simple and concise, and on the other hand reflect the realities of real systems. Such systems are heterogeneous, as are the ways they are used, the deployed anonymity measures, and finally the possible attack methods. Implementation quality and topologies of the anonymity measures must be considered as well. We therefore propose a new measure for the anonymity degree, that takes into account these various. We model the effectiveness of single mixes or of mix networks in terms of information leakage, and we measure it in terms of covert channel capacity. The relationship between the anonymity degree and information leakage is described, and an example is shown.

We propose a methodology to identify nodes in fully anonymized wireless networks using collections of very simple sensors. Based on time series of counts of anonymous packets provided by the sensors, we estimate the number of nodes using principal component analysis. We then proceed to separate the collected packet data into traffic flows that, with help of the spatial diversity in the available sensors, can be used to estimate the location of the wireless nodes. Our simulation experiments indicate that the estimators show high accuracy and high confidence for anonymized TCP traffic. Additional experiments indicate that the estimators perform very well in anonymous wireless networks that use traffic padding.

Mix networks are designed to provide anonymity for users in a variety of applications, including anonymous Web browsing and numerous E-commerce systems. Such networks have been shown to be susceptible to flow correlation attacks empirically. In this paper, we model the effectiveness of flow correlation attacks. Our results illustrate the quantitative relationship among system parameters such as sample size, noise level, payload flow rate, and detection rate. Our analysis quantitatively predicts how existing flow-based anonymous systems would fail under flow-correlation attacks, thus providing useful guidelines for the design of future anonymous systems.

This paper studies the degradation of anonymity in a flow-based wireless mix network under flow marking attacks, in which an adversary embeds a recognizable pattern of marks into wireless traffic flows by electromagnetic interference. We find that traditional mix technologies are not effective in defeating flow marking attacks, and it may take an adversary only a few seconds to recognize the communication relationship between hosts by tracking such artificial marks. Flow marking attacks utilize frequency domain analytical techniques and convert time domain marks into invariant feature frequencies. To counter flow marking attacks, we propose a new countermeasure based on digital filtering technology, and show that this filter-based counter-measure can effectively defend a wireless mix network from flow marking attacks.

Measures for anonymity in systems must be on one hand simple and concise, and on the other hand reflect the realities of real systems. Such systems are heterogeneous, as are the ways they are used, the deployed anonymity measures, and finally the possible attack methods. Implementation quality and topologies of the anonymity measures must be considered as well. We therefore propose a new measure for the anonymity degree, which takes into account possible heterogeneity. We model the effectiveness of single mixes or of mix networks in terms of information leakage and measure it in terms of covert channel capacity. The relationship between the anonymity degree and information leakage is described, and an example is shown.

In flow-based mix networks, so-called flow correlation attacks have been proposed earlier and have been shown empirically to seriously degrade mix-based anonymous communication systems. In this paper, we theoretically analyze the effectiveness of a mix network under flow correlation attacks. Our formulae clearly show how a mix network will ultimately fail when an adversary has access to sufficiently long flow samples, independently of the type of flows (TCP or UDP). We illustrate the analysis methodology by modeling a continuous-time mix, which randomly delays each incoming packet. Our queuing-model-based analysis captures the essence of flow correlation attacks and can provide useful guidelines for designers who develop and deploy anonymity systems