Search

GSMA is developing and standardizing specifications for embedded SIM cards with remote provisioning, called eUICCs, which are expected to revolutionize the cellular network subscription model. We study GSMA’s “Remote Provisioning Architecture for Embedded UICC” specification, which focuses on M2M devices, and we analyze the security of remote provisioning. Our analysis reveals weaknesses in the specification that would result in eUICCs being vulnerable to attacks: we demonstrate how a network adversary can exhaust an eUICC’s memory, and we identify three classes of attacks by malicious insiders that prevent service. We disclosed our findings to GSMA; GSMA confirmed the validity of these attacks and acknowledged their potential to disrupt the cellular industry. We propose fixes, which GSMA is incorporating into its specification. Thus, we improve security of next generation telecommunication networks.

This paper reports on the longitudinal dynamics of TCP flows at an international backbone link over the period from 2001 to 2010. The dataset was a collection of traffic traces called MAWI data consisting of daily 15min pcap traffic trace measured at a trans-pacific link between Japan and the US. The environment of the measurement link has changed in several aspects (i.e., congestion, link upgrade, application). The main findings of the paper are as follows. (1) A comparison of the AS-level delays between 2001 and 2010 shows that the mean delay decreased in 55% of ASes, but the median value increased. Moreover, largely inefficient paths disappeared. (2) The deployment of TCP SACK increased from 10% to 90% over the course of 10 years. On the other hand, the window scale and timestamp options remained under-deployed (less than 50%).

In this paper we consider 1-round almost perfectly secure message transmission protocols with optimal transmission rate, and give constructions for two levels of connectivity, n=2t+k and $n = (2+c)t, c > \frac{1}{t}$ . Here n and t are the total number of wires and the number of corrupted wires, respectively, and k and c are constants. The first protocol has a modular construction that with appropriate instantiations of each module results in optimal protocols for n=2t+k. The second protocol is the first construction for optimal protocol when n=(2+c)t.

Cooperation between participants is essential to P2P applications' viability. Due to obscure possibility to match peers' needs and supplies in pairs, the widely used pair-wise exchange-based incentive schemes perform poorly. The N-way exchange-based incentive scheme enlarges the matching possibility by introducing n person exchanges. But some old problems remain and some new ones emerge with the N-way design. In this paper we present an enhanced n-way exchange-based incentive scheme for P2P file sharing systems. By distributing extra tasks to all the peers involved in an n-way exchange, the proposed scheme eliminates prohibitive computation and communication cost on the cooperators, resulting in greater efficiency, effectiveness, and security.

IPv6 is being deployed but many Internet Service Providers have not implemented its support yet. Most of the end users have IPv6 ready computers but their network doesn’t support native IPv6 connection so they are forced to use transition mechanisms to transport IPv6 packets through IPv4 network. We do not know, what kind of traffic is inside of these tunnels, which services are used and if the traffic does not bypass security policy. This paper proposes an approach, how to monitor IPv6 tunnels even on high-speed networks. The proposed approach allows to monitor traffic on 10, Gbps links, because it supports hardware-accelerated packet distribution on multi-core processors. A system based on the proposed approach is deployed at the CESNET2 network, which is the largest academic network in the Czech Republic. This paper also presents several statistics about tunneled traffic on the CESNET2 backbone links.

To access automated voice services, Voice over IP (VoIP) users sometimes are required to provide their Personal Identification Numbers (PIN) for authentication. Therefore when they enter PINs, their user-agents generate packets for each key pressed and send them immediately over the networks. This paper shows that a malicious intermediary can recover the inter-keystroke time delay for each PIN input even if the standard encryption mechanism has been applied. The inter-keystroke delay can leak information of what has been typed: Our experiments show that the average search space of a brute force attack on PIN can be reduced by around 80%.

Spectrum sensing is a distinct feature of cognitive ad-hoc nodes that have the ability to opportunistically use vacant spectrum bands for its own communication purposes. Possible cooperation among the nodes may prove vital for increasing network performance. It yields the cognitive ad-hoc nodes to exchange relevant environmental and context information in order to enhance its own networking experience. This paper overviews the approaches, techniques and strategies for cooperative spectrum sensing and gives a practical example of a realized testbed implementation in an ad-hoc environment.

Due to bandwidth constraint and highly dynamic topology in ad hoc network systems, one of the major challenges is the deployment of end-to-end quality-of service support mechanisms. Time-sensitive communications like video applications may be seriously disrupted if these QoS support mechanisms don’t exist. In this paper we propose a QoS routing protocol based on AODV (AQA-AODV), which creates routes according to application QoS requirements. We have introduced link and path available bandwidth estimation mechanisms and an adaptive scheme that can provide feedback to the source node about the current network state, to allow the application to appropriately adjust the transmission rate. The simulation results reveal the performance improvements in terms of packet loss and delay while the end-to-end throughput is not affected compared with the throughput achieved by other protocols like AODV.

The aim of timestamping systems is to provide a proof-of-existence of a digital document at a given time. Such systems are important to ensure integrity and non-repudiation of digital data over time. Most of the existing timestamping schemes use the notions of round (a period of time) and round token (a single value aggregating the timestamping requests received during one round). Such schemes have the following drawbacks: (i) Clients who have submitted a timestamping request must wait for the end of the round before receiving their timestamping certificate (ii) TimeStamping Authorities (TSA) based on such schemes are discrete-time systems and provide relative temporal authentication only, i.e. all the documents submitted during the same round are timestamped with the same date and time. (iii) the TSA can tamper timestamps before the round token is published in a widely distributed media. In this paper, we define a new timestamping scheme which overcomes these drawbacks.

One of the simplest protocols for clock synchronization in wireless ad hoc and sensor networks is the converge-to-max protocol, which has the simple logic of adjusting each node's clock to be at least as large as any neighbor's. This paper examines the converge-to-max protocol, showing it to be stabilizing even when node clocks have skew, bounded domains, and dynamic communication links.

Implementing IP security in broadband router without sacrificing the performance is main work we focused on. To meet the need of protecting wire speed forwarding data passing through fast path of the router, security module implemented with encryption chip was adopted; to protect non real time data passing through slow path of the router, the scheme of implementing IP security inside kernel of Master control module with software was introduced. Security architecture and several testing architectures were finely designed and depicted in the paper. Testing of security architecture was undergone in SR1880s router, which was developed by National Digital Switching System Engineering & Technological R&D Center of China (NDSC). Testing results show that the two schemes work well together.

Tracing nefarious HTTP activity to its source is sometimes extremely difficult when HTTP (and/or SOCKS) proxies are used for origin obfuscation. This paper describes a technique for tracing HTTP traffic through one or more non-cooperating HTTP (and/or SOCKS) proxies. The technique uses only passive observations of TCP/IP headers. Furthermore, the technique need only observe a single direction of the underlying TCP flows, i.e. the technique is asymmetric-route-robust. The technique represents a set of HTTP transactions as an activity profile. These profiles may be either distilled from passive network observations, or logged by a cooperating web server. Using statistical correlation techniques, we can trace both end-to-end SSL-encrypted HTTP, and unencrypted HTTP despite the source obfuscation methods employed by many contemporary proxies. The technique may be used to narrow the search space before applying other more resource intensive traceback techniques.

Recently there is an emergence of many Internet applications such as distributed interactive simulations (DIS), and high-performance scientific computations such Grid computing. These applications require huge amount of bandwidth and a viable communication paradigm to coordinate with multiple sources and destinations. In this work we propose variation of multicasting called quorumcasting or manycasting. In manycasting destinations are to be determined rather than given unlike in the case of multicasting. We first present a need to support manycasting over OBS networks. Quality of Service (QoS) policies implemented in IP does apply does not apply for optical burst switched (OBS) networks, as the optical counterpart for store-and forward model does not exist. Hence there is a need to support QoS for manycasting over OBS networks. In this work we focus on QoS parameters such as contention, optical signal quality, reliability, and propagation delay. Burst loss in OBS network can occur due to contention or bit-error rate (BER). We propose algorithms to decrease the overall burst loss. We show that IP based manycasting has poor performance compared to our proposed algorithms. Our simulation results are verified with the help of analytical model. This work is further extended as to multi-constrained manycast problem (MCMP). In this problem, we address the burst scheduling for multiple QoS constraints. We propose algorithms to minimize burst loss based on given service requirements. The goal of this work is to develop service-oriented optical networks (SOON) for many emerging Internet applications.

In this paper, an improvement to TCP-Peach+, called TCP-Peach++, is proposed to improve the throughput performance for satellite IP networks with asymmetrical bandwidth and persistent fades. The delayed SACK scheme is adopted to address the problems due to bandwidth asymmetrical satellite links. A new protocol procedure, Hold State, is developed to address the link outages due to persistent fades. The simulation results show that TCP-Peach++ improves the throughput performance during rain fades and addresses the bandwidth asymmetry problems in Satellite IP Networks.

Given the fact that more than half of the world lacks a wired network infrastructure, satellite networks are seen as an important alternative to achieve global coverage. Since most of the world population lives around the equator or in middle-latitude regions, satellite constellations have to deal with different communication requirements from different regions. The traffic requirements become further unbalanced as the population density varies among urban and rural areas. This results in the congestion of some satellites while others remain underused. The issue of traffic engineering over satellite networks can be resolved by distributing the traffic in a balanced way over underutilized links. This paper proposes an Explicit Load Balancing (ELB) routing protocol which is based on information of traffic load at the next hop on the remainder of the path to the destination. A satellite with high traffic load sends signals to its neighboring satellites requesting them to decrease their sending rates before it gets congested and packets are ultimately dropped. Neighboring satellites should accordingly respond and search for other alternate paths that do not include the satellite in question. The performance of the proposed scheme is evaluated through simulations. From the simulation results, the proposed scheme achieves a more balanced distribution of traffic load, and reduces the number of packet drops and queuing delays. The resulting satellite constellation is a better-utilized and traffic-balanced network.

Today's mobile data applications aspire to deliver services to a user anywhere – anytime while fulfilling his Quality of Service (QoS) requirements However, the success of the service delivery heavily relies on the QoS offered by the underlying networks As the services operate in a heterogeneous networking environment, we argue that the generic information about the networks' offered-QoS may enable an anyhow mobile service delivery based on an intelligent (proactive) selection of ‘any' network available in the user's context (location and time). Towards this direction, we develop a QoS-predictions service provider, which includes functionality for the acquisition of generic offered-QoS information and which, via a multidimensional processing and history-based reasoning, will provide predictions of the expected offered-QoS in a reliable and timely manner. We acquire the generic QoS-information from distributed mobile services' components quantitatively (actively and passively) measuring the applicationlevel QoS, while the reasoning is based on statistical data mining and pattern recognition techniques.

In the lack of system and network support for guaranteed services, application-level QoS control mechanisms become indispensible. This paper presents several adaptive QoS control techniques for video conferencing under run-time resource constraints. Due to the importance of multimedia security to QoS, this paper also presents a fast MPEG video encryption alrogithm that bounds computation time for any video frame size and is robust to both plaintext and ciphertext attack. Our implementation shows that the algorithm adds only small overhead to video compression process, therefore minimizing its QoS impact on video streams while offering security to digital video applications.

Overlay networks use computational powers available at the edges of the Internet to provide large-scale computing and networking environments. In this paper, we consider market-oriented overlay networks in which peers trade resources and services through a common currency. From the perspective of market economics, the dynamics and convergence of resource prices in such networks is investigated by simulation and mathematical modeling, and the results are briefly reported in this short paper.

In this paper we consider a cognitive radio overlay model applied to single channel, single radio wireless mesh network and investigate the performance and fairness. Specifically we challenge the nominal mesh capacity of $O(\frac{1}{n})$ and provide proof that under certain constraints total mesh capacity can approach $O(\frac{1}{2})$ with an average per node throughput of $O(\frac{1}{n_a})$ where n a is the number of data generating active nodes. We provide an analysis of overlay communication using dirty paper coding on the sequential transmissions in wireless mesh networks.

Molecular communication provides a direct method for interfacing living cells via transmission of chemical signals. Here we report our recent result of developing a novel molecular communication method based on the cellular event called autophagy. The method currently under investigation uses micrometer-sized objects coated with bio-reactive molecules as information carrying molecules, which are selectively incorporated into and decoded within biological cells. This short paper briefly describes the method, experimental results, and theoretical model for the molecular communication method based on autophagy.

"Lapin" is a new RFID authentication protocol proposed at FSE 2012. "Ring-LPN" (Ring-Learning-Parity-with-Noise) is a new computational problem proposed in the same paper; there is a proof relating the security of Lapin to the difficulty of Ring-LPN. This paper presents an attack against Ring-LPN-512 and Lapin-512. The attack is not practical but nevertheless violates specific security claims in the FSE 2012 paper.

Bitcoin (BTC) pseudonyms (layer 1) can effectively be deanonymized using heuristic clustering techniques. However, while performing transactions off-chain (layer 2) in the Lightning Network (LN) seems to enhance privacy, a systematic analysis of the anonymity and privacy leakages due to the interaction between the two layers is missing. We present (Please, find the full version of this paper with appendix at https://arxiv.org/abs/2007.00764.) clustering heuristics that group BTC addresses, based on their interaction with the LN, as well as LN nodes, based on shared naming and hosting information. We also present linking heuristics that link \(45.97\)% of all LN nodes to \(29.61\)% BTC addresses interacting with the LN. These links allow us to attribute information (e.g., aliases, IP addresses) to \(21.19\)% of the BTC addresses contributing to their deanonymization. Further, these deanonymization results suggest that the security and privacy of LN payments are weaker than commonly believed, with LN users being at the mercy of as few as five actors that control 36 nodes and over \(33\%\) of the total capacity. Overall, this is the first paper to present a method for linking LN nodes with BTC addresses across layers and to discuss privacy and security implications.

In this paper, the performance of the NEC LinkBird-MX communications gateways and three safety applications are tested. These communications modules allow developers to design and deploy cooperative vehicular applications over Vehicular Ad-hoc Networks. In this work, it is analyzed how the reliability of these applications depends mainly on the goodness of the V2V or I2V radio links. The results of the analysis of these three cooperative applications (intersection crossing warning, emergency vehicle warning and roadwork warning) are shown in this paper.

A profiling adversary is an adversary which aims to classify messages into pre-defined profiles and thus gain useful information regarding the sender or receiver of such messages. User profiling has gained lot of importance today, this activity supports the big business of online advertising at the cost of user privacy. Usual chosen-plaintext secure encryption schemes are capable of securing information from profilers, but these schemes provide more security than required for this purpose. In this paper we study the requirements for an encryption algorithm to be secure only against profilers and finally give a precise notion of security for such schemes. We also present a full protocol for secure (against profiling adversaries) communication, which neither requires a key exchange nor a public key infrastructure. Our protocol guarantees security against non-human profilers and is constructed using CAPTCHAs and secret sharing schemes. The security notions developed in this paper are also further used to analyze an existing scheme meant for providing security against profilers.

In our former work we have given a high-level formal model of a cloud service architecture in terms of a novel formal method approach which combines the advantages of the mathematically well-founded software engineering method called abstract state machines and of the calculus of mobile agents called ambient calculus. This paper presents an extension for this cloud model which enables client-to-client interaction in an almost direct way, so that the involvement of cloud services is transparent to the users. The discussed solution for transparent use of services is a kind of switching service, where registered cloud users communicate with each other, and the only role the cloud plays is to switch resources from one client to another. We also show in an example at the end of this paper how our novel client-to-client interaction mechanism can be utilized for the development of the anonymously accessible cloud services.

This paper studies an approach to enhance the trust in the widespread use of Body Sensor Networks (BSN) in Healthcare. To address the wide variety in medical indications and differences between patients, we assume that such BSNs are programmable and highly flexible in their functionality. Yet this opens a vulnerability to malicious attacks and intrusion of the patient’s privacy. We study the work flow in a typical medical scenario, we map the (implied or evidence-based) trust relations and we use this to propose a scheme for verifying the authenticity and trustworthiness without prohibitively interfering with common practices. Our proposed framework is currently being refined in the VITRUVIUS project, for instance to test the feasibility of its implementation.

The performance of Wireless Sensor Networks (WSNs) during the tracking of dynamic targets is addressed in this paper. The strategy outlined in this paper uses a Distributed implementation of a Kalman Filter to track dynamic targets. In contrast to the results reported in the literature, the approach in this paper has the Kalman Filter running on only one network node at any given time. The knowledge learned by this node, i.e. the system state and the covariance matrix, is passed on to the subsequent node running the filter. Since a finite subset of the sensor nodes is active at any given time, target tracking can be accomplished using lower power compared to centralized implementations of the Kalman Filter. The tracking problem in WSNs is formulated mathematically and the stability and tracking error of the proposed strategy is rigorously analyzed. Numerical simulations are then used to demonstrate the utility of the proposed technique. The results in this paper show that the proposed technique for target tracking will result in significant savings in power consumption and will extend the useful life of the WSN.

Spoofed ARP packets are used by malicious users to redirect network’s traffic to their hosts. The potential damage to a network from an attack of this nature can be very important. This paper discusses first how malicious users redirect network traffic using spoofed ARP packets. Then, the paper proposes a practical and efficient mechanism for detecting malicious hosts that are performing traffic redirection attack against other hosts in switched LAN networks. The proposed mechanism consists of sending first spoofed packets to the network’s hosts. Then, by collecting and analyzing the responses packets, it is shown how hosts performing traffic redirection attack can be identified efficiently and accurately. The affect of the proposed mechanism on the performance of the network is discussed and shown to be minimal. The limits of current IDSs regarding their ability to detect malicious traffic redirection attack, based on spoofed ARP packets, in switched LAN networks are discussed. Our work is concerned with the detection of malicious network traffic redirection attack, at the Data Link layer. Other works proposed protection mechanisms against this attack, but at the Application layer, using cryptographic techniques and protocols.

This paper presents a novel method of user terminal positioning in cellular networks. A pattern matching technology based on received-signal-strength (RSS) from the pilot channels of cell towers has been the most popular network-based positioning method. In response to a position request, a terminal measures RSSs of pilot channels from surrounding cell towers and then the terminal’s RSS pattern is compared with a pattern database to find the most correlated one which indicates the position of the terminal. Although the pattern matching method can provide accurate positioning, its database construction and maintenance require a high overhead of periodic labor-intensive pattern collection. In this paper, we propose to exploit the call data records (CDRs) that are uploaded by Assisted Global Positioning System (AGPS) terminals as inputs to the pattern database, which removes or reduces the pattern collection overhead. In AGPS systems, terminals measure satellite signals and cellular network parameters (such as RSS) and relay them to the cellular infrastructure, which in turn calculates the terminal position using both that satellite and cellular network data. The proposed AGPS CDR based pattern matching method takes advantage of the increasing number of AGPS terminals in service: non-AGPS terminals can obtain more precise positioning results in areas where more AGPS calls are generated (e.g. hotspots). To do so, we analyze the characteristics of RSS patterns and AGPS CDRs. Based on the analysis, a pattern-distance metric and an AGPS CDR based pattern matching system are proposed and their performances are evaluated by examining field data of several urban downtown areas of Seoul, Korea. We obtain promising results: the position of the user terminal can be estimated with the accuracy (or, positioning error) at the level of 96.5m and 149.8m for the 67% and the 95% confidence interval, respectively.

Many intrusion behaviors can be characterized as the execution of a sequence of crucial commands that results in an unauthorized access. Lots of attack sequences can be derived by either exchanging properly orders of crucial commands or replacing crucial commands with the functionally similar commands, which have the same performance. Therefore, it is very difficult to detect such attacks. In this paper, we propose a cooperative intrusion detection model based on state transition analysis, in which the topological order and isomorphic transformation are adopted. For a given sequence of crucial commands of an intrusion, all the possible derived sequences as an intrusion scenario can be generated by means of the model. We may also use the model to detect the attacks from different cooperating attackers and the attacks from one attacker in different login sessions. Furthermore, a derived intrusion can be seen as an unknown intrusion, in this sense that the technique presented in this paper can detect some unknown intrusions.

The Session Initiation Protocol (SIP) provides powerful and flexible signaling capabilities for building video conferencing services. Traditionally, for SIP-based centralized video conference systems, the conferencing scale is mainly limited by both the capability of conference server and the availability of bandwidth. In this paper, our design focuses on how to provide dynamic scalability for the SIP-based video conferencing system when the number of conference users increases continually. Based on the study of the SIP protocol and the existing video conferencing models, we propose a dynamic scalable service model that can support to dynamically increase the number of conference servers without negative influence on the stability of system. This enables the extra service requests to be transferred and served in the cooperated conference servers. The paper also addresses the SIP-enabled conferencing flows based on the model in detail. We developed a prototype of video conference system based on the proposed model. Experimental results demonstrate the validity of this service model.

Web protocols are critical factor in successful implementation of web based industrial applications. Nevertheless, the main issue that significantly affects the real-time performance of such application is Web latency. Traditional web communication technologies, such as HTTP1.1, provide a uni-directional link and a request/ response message exchange model. This solution is not feasible in web based applications involving large number of different interconnected devices, such as Industrial Internet of things. In this paper, we focus on bi-directional web protocols WebSocket, WebRTC and HTTP/2.0. We compare the performance parameters like latency, reliability, and security of these three protocols. At the end of this paper, we will present some suggestions how to optimize the usage of web protocols in industrial process automation applications.

In this paper an investigation of the State of the Art of Industrial Wireless Sensor Networks (IWSNs) is performed. Therefore the given industrial requirements, different wireless communication protocols, the defined basic architecture and open research questions will be analysed. Furthermore, current challenges from the research domain will be discussed and a real use case of IWSNs from a research project in cooperation with a local industrial partner will be evaluated. To conclude this paper an outlook of further developments and possible future applications of IWSNs will be sketched.

The implementation of the new designed model used to integrating security and Quality of Service (QoS) as one parameter in mobile ad-hoc network (MANET) is introduced and studied in this paper. Security and QoS represent a highly important field of research in MANET and they are still being considered separately with no mechanisms used to establish cooperation between them. This new model provides alternative to cooperation between QoS and Security via Cross Layer Design (CLD) and modified Security Service Vector (SSV). Main motivation of this paper is indicating how could be security integrated as a QoS parameter to the MANET via this model. The performance analysis of the new designed model in the well-know simulator OPNET Modeler is also provides.

TCP suffers from high packet loss rate and tends to overreact to the ever-changing network dynamism of wireless network that experiences considerable delay variation. And also, it undergoes backoff state repeatedly and enters into a slow starting mode, which in turn leading to the low throughput and excessive end-to-end latency. On the other hand, UDP does not consider recovery of lost packets and the problem of out-of-order delivery resulting in much more data loss. For these reasons, RUDP was proposed at the IETF Internet Draft[1]. In this paper, we focused on the minimization of data packet delay time and aimed to reduce packet loss and deliver the data in order with the proposed protocol. Hence, using OPNET Modeler 14.5 PL8 program under the identical environment, we conducted the comparative analysis simulations between TCP, UDP and RUDP considering "Retransmission function" and sequence acknowledge numbers that are used to monitor packet loss and the order of the received packets, and various timers as major testing factors. The purposes of the simulations conducted for RUDP in this paper are to supplement "unreliable" characteristics of UDP, which is considered as a major problem, and thereby produce reliable data like TCP produces by making use of better characteristic of UDP not just imitating TCP’s characteristics.

In this paper, first, we present our simulation studies that help to outline key factors for a proper available-bandwidth-based flow admission control in ad-hoc Wireless Sensor Networks (WSNs). In most cases, WSNs use the IEEE 802.15.4 standard, therefore our simulation studies are based on the same standard. The identified key factors are: (i) the overheads (back-off, retransmission, contention window, ACK packet, and ACK waiting time) associated with the unslotted IEEE 802.15.4 Carrier Sense Multiple Access Collision Avoidance (CSMA-CA) MAC layer protocol reduce the amount of available bandwidth, (ii) the impact of the MAC layer overheads on a node’s available bandwidth is a function of the number of active transmitters and data traffic load within the interference range of the node, (iii) contention count on a node that is not on a flow’s data forwarding path is a function of the number of active transmitters (along the flow’s data forwarding path) within the interference range of the node, and (iv) a flow’s intra-flow contention count on a node (along the flow’s data forwarding path) depends on the hop-count distance of the node from the source and the destination nodes, and the node’s interference range. Second, we present a survey of state-of-the-art flow admission control algorithms for ad-hoc wireless networks. The survey demonstrates that the state-of-the-art flow admission control algorithms do not completely consider the key identified factors or make incorrect assumptions about them. Third, we propose techniques that an available-bandwidth-based flow admission control algorithm can use to incorporate the key identified factors. Hence, the work presented in this paper can serve as a basis of a more effective available-bandwidth-based flow admission control algorithm for ad-hoc wireless networks.

The motivation of the paper is to position and track moving targets in real time by means of wireless video sensor networks (WVSNs), and with the aid of selecting and associating information from multi-view videos to obtain the trajectory of targets in the world coordinates system(WCS). The whole process includes camera calibration, target localization, tracking trajectory in WCS, time synchronization calibration of multi-view videos and data fusion. The innovation point of the paper is that aimed at time synchronization phenomenon of multi-view videos while associating data, we propose a new scheme of information selection and recognition. For validating the effectiveness of the scheme, the comparison of the real trajectory and the estimated one is conducted through MATLAB simulation, and the proposed scheme has a satisfactory performance.

This paper presents an application of security protocol based-on mu-tual authentication procedure between involved entities that providing data and network security in wireless sensor environment communication. Through WSN, a user can access base station of wireless sensor networks and gets the data. This paper proposes a secure authentication protocol where involved enti-ties are mutual strongly verified before accessing the data. The proposal pro-vides secure features standards such as data integrity, mutual authentication and session key establishment. Furthermore, an extensive analysis shows that the proposed scheme possesses many advantages against popular attacks, achieves better efficiency and can be safeguard to real wireless sensor network applications.

This paper proposes two algorithms for navigating users to their destinations using near-field communication between their mobile terminals and digital signage units in an underground area where GPS is not usable. One algorithm focuses on the angle to the destination while the other looks at the distance to the destination. The paper also proposes an algorithm for avoiding traffic congestion by limiting the number of mobile terminals that communicate with a signage unit simultaneously. We have built an underground mall model on a simulator, and evaluated the algorithms in terms of the rate of successful arrival at the destination and the time it takes to reach the destination.

The DECT Standard Cipher (DSC) is a 64-bit key stream cipher used in the Digital Enhanced Cordless Telecommunications (DECT) standard to protect the confidentiality of the communications. In this paper we present an improved cryptanalysis approach which is more effective than the Nohl-Tews-Weinmann (NTW) attack and requires four times less plaintext material. Under the best conditions, our known plaintext attack requires only 3 min of communication compared to 10 min for the NTW attack. Our approach is able to quickly recover the secret key with a success rate of more than 50 % by analysing \(2^{13}\) keystreams and performing an exhaustive search over \(2^{31}\) keys. Additionally, the attack was successfully conducted against real intercepted DECT traffic where the plaintext was only 90 % accurate. To the best of our knowledge, the approach we present in this paper is the most effective cryptanalysis published so far against the DSC cipher.

Most of existed strategies for defending OFA (Objective Function Attack)are centralized, only suitable for small-scale networks and stressed on the computation complexity and traffic load are usually neglected. In this paper, we pay more attentions on the OFA problem in large-scale cognitive networks, where the big data generated from the network must be considered and the traditional methods could be of helplessness. In this paper, we first analyze the interactive processes between attacker and defender in detail, and then a defense strategy for OFA based on differential game is proposed, abbreviated as DSDG. Secondly, the game saddle point and optimal defense strategy have proved to be existed simultaneously. Simulation results show that the proposed DSDG has a less influence on network performance and a lower rate of packet loss.More importantly, it can cope with the large range OFA effectively.

Currently, most of the existing social networks on Internet are distributed, decentralized systems, and they are particularly vulnerable to Sybil attack in which a single malicious user introduces multiple bogus identities and pretends to be multiple and real users in the network. With these controlled identities, the malicious user can create a Byzantine failure in collaborative tasks by ‘out vote’ the real identities. This paper conducts a survey on the network security of social networks to provide the overview of the current online security of the social networks and the corresponding defend methods. Based on the survey, this paper proposes Sybil-Resist, a Random Walk-based Sybil attack defense protocol devoting to identifying the Sybil nodes and the Sybil region efficiently. The simulation results obtained by a more realistic simulation topology show that the proposed scheme outperforms existing solutions in terms of detection accuracy and running time.

The analysis of large amount of traffic data is the daily routine of Autonomous Systems and ISP operators. The detection of anomalies like denial-of-service (DoS) or distributed denial-of-service (DDoS) is also one of the main issues for critical services and infrastructures. The suitability of metrics coming from the information theory for detecting DoS and DDoS episodes has been widely analyzed in the past. Unfortunately, their effectiveness are often evaluated on synthetic data set, or, in other cases, on old and unrepresentative data set, e.g. the DARPA network dump. This paper presents the evaluation by means of main metrics proposed in the literature of a real and large network flow dataset, collected from an Italian transit tier II Autonomous System (AS) located in Rome. We show how we effectively detected and analyzed several attacks against Italian critical IT services, some of them also publicly announced. We further report the study of others legitimate and malicious activities we found by ex-post analysis.

Device-to-Device (D2D) content delivery is a new approach to directly exchange content between mobile devices, which allows to offload traffic from infrastructure-based networks and thus reduces the risk of congestion. While centralized D2D approaches rely on the mobile operator to discover nearby devices and initiate a content transfer, in decentralized D2D the devices autonomously and opportunistically organize themselves to deliver content to each other. The latter approach is more flexible as it does not depend on a single operator, however, it typically requires more energy for scanning other devices. Another issue is privacy, since the decentralized approach reveals a user’s interest for content to all devices in proximity. Therefore, this paper sketches an new approach towards decentralized energy- and privacy-aware D2D content delivery. The proposed approach addresses the energy loss that occurs when constantly and spontaneously scanning multiple unknown devices for content. Furthermore, the paper identifies privacy requirements and proposes first steps towards a privacy-aware D2D solution.

The evaluation of the Quality of Experience (QoE) for data services over wireless technologies is currently a hot topic. In this paper we present service performance evaluation method that is able to estimate both the Quality of Service (QoS) and QoE for different data services over cellular networks. This method is based on specific performance indicators that are evaluated at each layer of the terminal’s protocol stack following a bottom-up process from the physical layer up to the application layer. Then, specific utility functions for each data service are used to map QoS into QoE in terms of Mean Opinion Score (MOS). Three different data services (web, YouTube and voice over IP) have been evaluated over a typical LTE network scenario. Performance results show that the MOS is largely affected by the radio level performance (error rate, throughput and delay), so proper protocols’ configuration critical to achieve a desired service quality.

Best Paper Award; International audience; The IETF designed the Routing Protocol for Low power and Lossy Networks (RPL) as a candidate for use in constrained networks. Keeping in mind the different requirements of such networks, the protocol was designed to support multiple routing topologies, called DODAGs, constructed using different objective functions, so as to optimize routing based on divergent metrics. A DODAG versioning system is incorporated into RPL in order to ensure that the topology does not become stale and that loops are not formed over time. However, an attacker can exploit this versioning system to gain an advantage in the topology and also acquire children that would be forced to route packets via this node. In this paper we present a study of possible attacks that exploit the DODAG version system. The impact on overhead, delivery ratio, end-to-end delay, rank inconsistencies and loops is studied.

In this paper, we focus on AR selection problem of mobile host (MH). A mobile host (MH) may have several available networks when entering a new area. The user of MH decides to use one of access router (AR) at AR list. However, the decision only with the subsystem identification (SSID) and signal strength could not provide appropriate connection to the MH. To provide appropriate connection, more information of AR is needed. In this paper, we extend prefix information option on router advertisement message to obtain AR’s status information. Then, we proposed decision engine (DE) on the MH that analyzes ARs and decides the appropriate AR automatically by AR’s status information. In experimental analysis, proposed AR discovery process has several advantages. For the MH, wireless connection period is increased, the power consumption is decreased, and the signaling overhead is reduced. For AR and router, the load balancing is provided and the network topology can also be more efficient.

Access control systems can be categorized in two classes: stateless or stateful. While stateless access control systems consider only current state of the system for access decision, stateful access control integrates past and current state of the system. The state of the system can change depending on the way how resources were used. We also observe that stateful access control systems strongly rely on centralised state monitoring infrastructure. In the context of distributed systems, state monitoring is very difficult to achieve, both for security and technical reasons. In this paper, we propose to use obligation execution proof to evaluate current distributed system state. Data usage conditions are defined as obligations expressing the actions that must be executed before or after granted access. In this paper, we aim at fostering distributed access control enforcement relying on certified obligations.

This paper considers a device-to-device (D2D) underlaying cellular network where an uplink cellular user communicates with the base station while multiple direct D2D links share the uplink spectrum. This paper proposes a random network model based on stochastic geometry and develops centralized power control algorithm. The goal of the proposed power control algorithm is two-fold: ensure the cellular users have sufficient coverage probability by limiting the interference created by underlaid D2D users, while also attempting to support as many D2D links as possible. This paper adopts the two level control strategy: Cellular link SINR(signal-to-interference-plus noise ratio) and sum rate maximization, to ensure the cellular communication and improve the coverage probability of D2D and cellular links. Numerical results show the gains of the proposed power control algorithm and accuracy of the analysis.

This paper concentrates in the privacy protection in Internet of things. It firstly focuses on the security issues and attack risks of Internet of things from four aspects, which are perception layer, transport layer, application layer and the integrated networking system. And it puts forward some proposals on wireless sensor network and RFID (Radio Frequency Identification) security system structure. The researches are theoretical basis in security defense of Internet of things. Furthermore, in order to reduce the security risks in Internet of things communication process, this paper puts forward key-changed mutual authentication protocol. The protocol integrates random number generator in the tag and reader, and adopts the one-way Hash function, key refresh in real time, key backup and other mechanisms. The analysis shows that this protocol is able to be well applied to low cost Internet of things system and effectively prevent the network from replay, replication, denial of service, spoofing and tag tracking attacks.