Modern embedded Linux devices, such as routers, IP cameras, and IoT gateways, rely on complex software stacks where numerous daemons interact to provide services. Testing these devices is crucial from a security perspective since vendors often use custom closed- or open-source software without documenting releases and patches. Recent coverage-guided fuzzing solutions primarily test individual processes, ignoring deep dependencies between daemons and their persistent internal state. This article presents STAFF , a firmware fuzzing framework for discovering bugs in Linux-based MIPS firmware with HTTP-managed workflowsuilt around three key ideas: (a) user-driven multi-request recording , which monitors HTTPuser interactions with emulated firmware to capture request sequences;(b) intra- and inter-process dependency detection , which uses whole-system taint analysis to track how input bytes influence user-space states, including CPU registers, memory accesses, IPC channels, and filesystem operations;(c) protocol-aware taint-guided fuzzing , which applies mutations to request sequences based on identified dependencies, exploiting multi-staged forkservers to efficiently checkpoint protocol states. When evaluating STAFF on 15 Linux-based MIPSirmware targets, it identifies 42 crashes in 9 firmware imagesnvolving multiple network requests and different firmware daemons. Through systematic crash triage, these crashes consolidate into 20 previously unknownugs submitted for disclosure9 discovered exclusively by STAFF ) and 4 previously disclosed CVEs (2 found only by STAFF ), significantlyutperforming the considered full-system multi-processaselinefirmware fuzzing solutions in both the number and reproducibility of discovered crashes

Autonomous multi-agent systems increasingly operate in environments where privacy, anonymity, and operational security are critical. In such settings, drones must often determine which events or locations have been independently confirmed by at least t participants, while revealing nothing about individual trajectories, identities, or exploration patterns. Threshold Private Set Intersection (t-PSI) naturally captures this requirement, but existing constructions rely on persistent identities, authenticated channels, or linkable communication, making them unsuitable for high-risk deployments where structural anonymity is essential. We introduce a fully anonymous t-PSI protocol tailored for distributed exploration tasks. Communication occurs in a You-Only-Speak-Once (YOSO) architecture: each participant sends exactly one anonymous, unlinkable message per round, ensuring confidentiality, integrity, and sender anonymity without authenticated channels. The protocol supports multi-agent exploration scenarios, such as drone-based reconnaissance, where drones must collaboratively identify zones explored by a minimum subset of units while preserving full operational privacy. We formally prove security against semi-honest participants and active man-in-the-middle adversaries interacting with the network. Our analysis shows that the protocol achieves threshold privacy, ciphertext unlinkability, sender anonymity, and robustness against message tampering. This work demonstrates that anonymous threshold-PSI can be realized efficiently in a YOSO framework, enabling privacy-preserving coordination in adversarial and strategically sensitive environments.

The emergence of softwarized network devices, like programmable switches and smart NICs, has brought about new and advanced network functionalities. Intelligent decision-making becomes possible at line rate by offloading network functionality from the network control-plane to the programmable data-plane. In this paper, we offload fine-grained Distributed Denial of Service (DDoS) attack detection to the data-plane. The state-of-the-art in this regard, mainly aims to embed Machine Learning (ML) models into the data-plane without compromising on inference accuracy. Besides accuracy, we must consider multiple other factors, like traffic feature availability and false positive rates. To that end, we propose O’MINE: ONE MODEL IS NOT ENOUGH, a novel collaborative detection mechanism comprising lightweight ML models. This maximises the detection accuracy while keeping the false positive rate (FPR) low. We use three state-of-the-art datasets to evaluate the O’MINE algorithm and its ML models. Our results show that O’MINE can detect DDoS attacks with high accuracy (≈98% and ≈96% with full and scarce training data, respectively) and low FPR (≈0.22% and ≈0.72% with full and scarce training data, respectively), outperforming the state-of-the-art. Lastly, O’MINE only consumes a few device resources (≈6% of LUT and ≈4% of FF) on the Xlinx Alevo U250 FPGA we have used for inference at line rate.

Internet of Underwater Things (IoUT) introduces critical security challenges, especially for protecting distributed infrastructures in resource-constrained environments. Conventional asymmetric and centralized authentication models are unsuitable due to computational and communication overhead, while symmetric approaches lack robustness without trusted storage or hardware. We propose a non-interactive, asynchronous authentication protocol based on NIZKP, combining PUFs-derived secrets with decentralized identifiers on a distributed ledger. This approach enables direct node authentication with cryptographically verifiable identity binding, minimal resource usage, offline verification, and full support for asynchronous operation in constrained environments. The protocol is formally analysed and implemented on COTS hardware without additional secure components. Evaluation shows low energy consumption (827.2 mJ), minimal communication overhead (113 B, 1.513s, 817.9 mJ), and reasonable execution times (worst case ≈ 5.310s), outperforming state-of-the-art solutions in the first four metrics.

Recent advancements in drone technology have shown that commercial off-the-shelf Micro Aerial Drones are more effective than large-sized drones for performing flight missions in narrow environments, such as swarming, indoor navigation, and inspection of hazardous locations. Due to their deployments in many civilian and military applications, safe and reliable communication of these drones throughout the mission is critical. The Crazyflie ecosystem is one of the most popular Micro Aerial Drones and has the potential to be deployed worldwide. In this paper, we empirically investigate two interference attacks against the Crazy Real Time Protocol (CRTP) implemented within the Crazyflie drones. In particular, we explore the feasibility of experimenting two attack vectors that can disrupt an ongoing flight mission: the jamming attack, and the hijacking attack. Our experimental results demonstrate the effectiveness of such attacks in both autonomous and non-autonomous flight modes on a Crazyflie 2.1 drone. Finally, we suggest potential shielding strategies that guarantee a safe and secure flight mission. To the best of our knowledge, this is the first work investigating jamming and hijacking attacks against Micro Aerial Drones, both in autonomous and non-autonomous modes.

Several critical contexts, such as healthcare, smart cities, drones, transportation, and agriculture, nowadays rely on IoT, or more in general embedded, devices that require comprehensive security analysis to ensure their integrity before deployment. Security concerns are often related to vulnerabilities that result from inadequate coding or undocumented features that may create significant privacy issues for users and companies. Current analysis methods, albeit dependent on complex tools, may lead to superficial assessments due to compatibility issues, while authoritative entities struggle with specifying feasible firmware analysis requests for manufacturers within operational contexts. This paper urges the scientific community to collaborate with stakeholders—manufacturers, vendors, security analysts, and experts—to forge a cooperative model that clarifies manufacturer contributions and aligns analysis demands with operational constraints. Aiming at a modular approach, this paper highlights the crucial need to refine security analysis, ensuring more precise requirements, balanced expectations, and stronger partnerships between vendors and analysts. To achieve this, we propose a threat model based on the feasible interactions of actors involved in the security evaluation of a device, with a particular emphasis on the responsibilities and necessities of all entities involved.

Federated Learning (FL) represents the de facto approach for distributed training of machine learning models. Nevertheless, researchers have identified several security and privacy FL issues. Among these, the lack of anonymity exposes FL to linkability attacks, representing a risk for model alteration and worker impersonation, where adversaries can explicitly select the attack target, knowing its identity. Named-Data Networking (NDN) is a novel networking paradigm that decouples the data from its location, anonymising the users. NDN embodies a suitable solution to ensure workers’ privacy in FL, thus fixing the abovementioned issues. However, several issues must be addressed to fit FL logic in NDN semantics, such as missing push-based communication in NDN and anonymous NDN naming convention. To this end, this paper contributes a novel anonymous-by-design FL framework with a customised communication protocol leveraging NDN. The proposed communication scheme encompasses an ad-hoc FL-oriented naming convention and anonymity-driven forwarding and enrollment procedures. The anonymity and privacy requirements considered during the framework definition are fully satisfied through a detailed analysis of the framework’s robustness. Moreover, we compare the proposed mechanism and state-of-the-art anonymity solutions, focusing on the communication efficiency perspective. The simulation results show latency and training time improvements up to ∼30%, especially when dealing with large models, numerous federations, and complex networks.

In the context of Information-Centric Networking, Interest Flooding Attacks (IFAs) represent a new and dangerous sort of distributed denial of service. Since existing proposals targeting IFAs mainly focus on local information, in this paper we propose GNN4IFA as the first mechanism exploiting complex non-local knowledge for IFA detection by leveraging Graph Neural Networks (GNNs) handling the overall network topology.In order to test GNN4IFA, we collect SPOTIFAI, a novel dataset filling the current lack of available IFA datasets by covering a variety of IFA setups, including ~40 heterogeneous scenarios over three network topologies. We show that GNN4IFA performs well on all tested topologies and setups, reaching over 99% detection rate along with a negligible false positive rate and small computational costs. Overall, GNN4IFA overcomes state-of-the-art detection mechanisms both in terms of raw detection and flexibility, and – unlike all previous solutions in the literature – also enables the transfer of its detection on network topologies different from the one used in its design phase.

Embedded devices are pivotal in many aspects to our everyday life, acting as key elements within our critical infrastructures, e-health sector, and the IoT ecosystem. These devices ship with custom software, dubbed firmware, whose development may not have followed strict security-by-design guidelines and for which no detailed documentation may be available. Given their critical role, testing their software before deploying them is crucial. Software fuzzing is a popular software testing technique that has shown to be quite effective in the last decade. However, the firmware may contain thousands of subcomponents with unexpected interplays. Moreover, operators may have a tight time budget to perform a security evaluation, requiring focused fuzzing on the most critical subcomponents. Also, considering the lack of accurate documentation for a device, it is quite hard for a security operator to understand what to fuzz and how to fuzz a specific device firmware. In this paper, we present Fuzzplanner, a visual analytics solution that enables security operators during the design of a fuzzing campaign over a device firmware. Fuzzplanner helps the operator identify the best candidates for fuzzing using several innovative visual aids. Our contributions include introducing Fuzzplanner, exploring diverse analytical tools to pinpoint critical binaries, and showing its efficacy with two real-world firmware image scenarios.

The Internet model has changed from its first design, rolling from host-centric to information-centric. Consequently, researchers foresee the urge for a new network paradigm that will be more suitable for the need of nowadays users. Named-Data Networking (NDN) adheres to the Information-Centric Networking (ICN) paradigms that have been proposed as possible current Internet substitutes. New proposals concerning NDN-related challenges are released regularly. However, most of these proposals are evaluated using network simulations or theoretical analysis due to lacking a full-stack NDN testbed. Although valid, research has shown that simulation environments or proposed overlay testbeds disturb the experiments and introduce performance mismatches. Motivated by the shreds of evidence mentioned above, we propose a setup of an NDN testbed composed of Raspberry Pi devices. After that, we conduct performance analysis for crucial NDN features such as name-based forwarding, in-network caching, and data packet signing. Our experiments confirm the benefits of enabling caches in intermediate nodes. Furthermore, we compare different signing algorithms based on the producer’s goodput and processing time. Indeed, SHA-256 is confirmed as the most lightweight with 103 Mpbs goodput and 130 μs processing time. Nevertheless, a security and performance trade-off must be met. On the other hand, as research has demonstrated, such features can be exploited to compromise users’ privacy and degrade the network’s performance. Additionally, the attack performance might change while implemented in a real deployment. To validate such effects, we transfer two state-of-the-art privacy attacks from a simulation domain to a physical environment, i.e., our testbed. While one of the transferred attacks preserves the preciseness on the testbed, the other demonstrates result mismatches.

Nowadays, Internet of Things (IoT) devices are widely used in several application scenarios. Due to their cheap structure, they often do not guarantee high security standard, making them prone to hacker attacks. Remote attestation is widely used to verify the configuration integrity on remote devices. Unfortunately, checking the integrity of each single device is impractical, thus several collective remote attestation protocols have been recently proposed to efficiently run attestations in wide device swarms. However, current solutions still have several limitations in terms of network topology, scalability, and efficiency.

PATTA is the first privacy attack based on network traffic analysis in Information-Centric Networking. PATTA aims to automatically identify the category of requested content by sniffing the communication towards the first hop router. PATTA applies text processing and machine learning techniques to content names in content-oriented architectures. We evaluate PATTA in a simulated network, achieving an accuracy in determining a real-time content category equal to 96%.

No abstract available.

Named Data Networking (NDN) is a novel Internet architecture which focuses on content distribution by exploiting in-network caching and name-based forwarding. Contrary to today's Internet, NDN has been designed from the ground up to be secure. From a content provider perspective (e.g., YouTube, Netflix), NDN offers appealing advantages in terms of network load and traffic reduction at producer side through in-network requests aggregation and content caching. As a side effect, content providers lose control on content dissemination when consumers' requests are aggregated or satisfied by the network. This hinders the correct application of copyright and licensing agreements: only specific regions are allowed to consume a subset of the distributed contents. In attempt to address this problem, the existing TCP/IP approaches exploit requests' source addresses (at server side) to identify the geographic origin of each request. In NDN these solutions are unfeasible for two reasons: consumers' requests do not carry any source address, and a request will never reach content providers when aggregated or satisfied in the network. We solve this problem by proposing two lightweight and distributed geo-blocking protocols (GATE and FENCE) which use packet marking to identify and validate network regions at network edges. We perform experiments both on a network simulator and by extending the NDN implementation. Through our results we prove the proposed protocols are feasible, i.e., all the regions blacklisted by content providers are blocked and their network costs, in terms of space and router processing overhead, are negligible.

Remote Attestation (RA) has been proven to be a powerful security service to check the legitimacy of the software configuration (e.g., running software and data) of devices. In recent years, advances in trusted computing, made possible to extend the use of RA also to embedded and Internet of Things (IoT) devices. The massive scale of IoT deployments poses scalability challenges to RA. Recently, researchers proposed efficient protocols for collective network attestation, i.e., efficient attestation of a whole network of interconnected embedded devices; however, most of these solutions are either costly, or simply unsuitable for highly dynamic networks.

The large spread of sensors and smart devices in urban infrastructures are motivating research in the area of the Internet of Things (IoT) to develop new services and improve citizens’ quality of life. Sensors and smart devices generate large amounts of measurement data from sensing the environment, which is used to enable services such as control of power consumption or traffic density. To deal with such a large amount of information and provide accurate measurements, service providers can adopt information fusion, which given the decentralized nature of urban deployments can be performed by means of consensus algorithms. These algorithms allow distributed agents to (iteratively) compute linear functions on the exchanged data, and take decisions based on the outcome, without the need for the support of a central entity. However, the use of consensus algorithms raises several security concerns, especially when private or security critical information is involved in the computation. In this article we propose ODIN, a novel algorithm allowing information fusion over encrypted data. ODIN is a privacy-preserving extension of the popular consensus gossip algorithm, which prevents distributed agents from having direct access to the data while they iteratively reach consensus; agents cannot access even the final consensus value but can only retrieve partial information (e.g., a binary decision). ODIN uses efficient additive obfuscation and proxy re-encryption during the update steps and garbled circuits to make final decisions on the obfuscated consensus. We discuss the security of our proposal and show its practicability and efficiency on real-world resource-constrained devices, developing a prototype implementation for Raspberry Pi devices.

We examine the interplay between learning and privacy over multiagent consensus networks. The learning objective of each individual agent consists of computing some global network statistic, and is accomplished by means of a consensus protocol. The privacy objective consists of preventing inference of the individual agents' data from the information exchanged during the consensus stages, and is accomplished by adding some artificial noise to the observations (obfuscation). An analytical characterization of the learning and privacy performance is provided, with reference to a consensus perturbing and to a consensus-preserving obfuscation strategy.

We present two secure two party computation (STPC) protocols for piecewise function approximation on private data. The protocols rely on a piecewise approximation of the to-be-computed function easing the implementation in an STPC setting. The first protocol relies entirely on garbled circuits (GCs), while the second one exploits a hybrid construction where GC and homomorphic encryption are used together. In addition to piecewise constant and linear approximation, polynomial interpolation is also considered. From a communication complexity perspective, the full-GC implementation is preferable when the input and output variables can be represented with a small number of bits, while the hybrid solution is preferable otherwise. With regard to computational complexity, the full-GC solution is generally more convenient.

Information fusion is the keystone of many surveillance systems, in which the security of the information is a crucial aspect. This paper proposes a method to fuse information exchanging only encrypted data, through a secure extension of the popular consensus gossip algorithm using secure multi-party computation methodology. Sensor entities exchange only encrypted information and never have direct access to the data while iteratively reaching consensus. The agents do not have access to the final value and can just retrieve partial information, for instance a binary decision. An innovative implementation of the consensus algorithm in the encrypted domain is proposed and analyzed.

Biometric-based access control is receiving increasing attention due to its security and ease-of-use. However, concerns are often raised regarding the protection of the privacy of enrolled users. Signal processing in the encrypted domain has been proposed as a viable solution to protect biometric templates and the privacy of the users. In particular, several solutions have been proposed to protect the privacy of the biometric probe during the authentication process. In this paper we focus on privacy-preserving iris-based authentication. The main innovations compared to the prior art include: i) an iris masking technique that simplifies the operations on the encrypted data without sacrificing the recognition rate; ii) the adoption of a matching protocol based only on garbled circuits which offers longer term security over existing solutions based on homomorphic encryption or hybrid techniques. The computational and communication complexity of the on-line phase of the proposed protocol is extremely low, thus opening the way to its exploitation in practical applications.

Privacy protection is a crucial problem in many biomedical signal processing applications. For this reason, particular attention has been given to the use of secure multiparty computation techniques for processing biomedical signals, whereby nontrusted parties are able to manipulate the signals although they are encrypted. This paper focuses on the development of a privacy preserving automatic diagnosis system whereby a remote server classifies a biomedical signal provided by the client without getting any information about the signal itself and the final result of the classification. Specifically, we present and compare two methods for the secure classification of electrocardiogram (ECG) signals: the former based on linear branching programs (a particular kind of decision tree) and the latter relying on neural networks. The paper deals with all the requirements and difficulties related to working with data that must stay encrypted during all the computation steps, including the necessity of working with fixed point arithmetic with no truncation while guaranteeing the same performance of a floating point implementation in the plain domain. A highly efficient version of the underlying cryptographic primitives is used, ensuring a good efficiency of the two proposed methods, from both a communication and computational complexity perspectives. The proposed systems prove that carrying out complex tasks like ECG classification in the encrypted domain efficiently is indeed possible in the semihonest model, paving the way to interesting future applications wherein privacy of signal owners is protected by applying high security standards.