In the next generation of road-based transportation systems, where vehicles exchange information and coordinate their actions, a major challenge will be to ensure that the interaction rules are safe and lead to progress. In this paper we address the problem of automatically verifying the correctness of such distributed vehicular coordination protocols. We propose a novel modeling approach for communicating mobile entities based on the concept of satisfiability modulo theories (SMT). We apply this method to an intersection collision avoidance protocol and show how the method can be used to investigate the settings under which such a protocol achieves safety and progress.

Coordinated vehicles for intelligent traffic management are instances of cyber-physical systems with strict correctness requirements. A key building block for these systems is the ability to establish a group membership view that accurately captures the locations of all vehicles in a particular area of interest. In this article, we formally define view correctness in terms of soundness and completeness and establish theoretical bounds for the ability to verify view correctness. Moreover, we present an architecture for an online view detection and verification process that uses the information available locally to a vehicle. This architecture uses an SMT solver to automatically prove view correctness (if possible). We evaluate this architecture using both synthetic and trace-based scenarios and demonstrate that the ability to verify view correctness is on par with the ability to detect view violations.

This thesis is concerned with exploring methods for making computing systems more resilient to problems in the network communication, both in the setting of existing infrastructure but also in the case where no infrastructure is available. Specifically, we target a situation called network partitions which means that a computer or device network is split in two or more parts that cannot communicate with each other.

The first of the two tracks in the thesis is concerned with upholding system availability during a network partition even when there are integrity constraints on data. This means that the system will optimistically accept requests since it is impossible to coordinate nodes that have no means of communicating during finite intervals; thus requiring a reconciliation process to take place once the network is healed.

We provide several different algorithms for reconciling divergent states of the nodes, one of which is able to allow the system to continue accepting operations during the reconciliation phase as opposed to having to stop all invocations.  The algorithms are evaluated analytically, proving correctness and the conditions for termination.  The performance of the algorithms has been analysed using simulations and as a middleware plugin in an emulated setting.

The second track considers more extreme conditions where the network is partitioned by its nature. The nodes move around in an area and opportunistically exchange messages with nodes that they meet. This as a model of the situation in a disaster area where the telecommunication networks are disabled. This scenario poses a number of challenges where protocols need to be both partition-tolerant and energy-efficient to handle node mobility, while still providing good delivery and latency properties.

We analyse worst-case latency for message dissemination in such intermittently connected networks. Since the analysis is highly dependent on the mobility of the nodes, we provide a model for characterising connectivity of dynamic networks. This model captures in an abstract way how fast a protocol can spread a message in such a setting. We show how this model can be derived analytically as well as from actual trace files.

Finally, we introduce a manycast protocol suited for disaster area networks. This protocol has been evaluated using simulations which shows that it provides very good performance under the circumstances, and it has been implemented as a proof-of-concept on real hardware.

Cooperative vehicular systems have the potentialto significantly increase traffic efficiency and safety. However,they also raise the question of to what extent information thatis received from other vehicles can be trusted. In this paperwe present a novel approach for increasing the trustworthinessof cooperative driving through a model-based approach forverifying membership views in vehicular platoons. We define aformal model for platoon membership, cooperative awarenessclaims, and membership verification mechanisms. With the helpof a satisfiability solver, we are able to quantitatively analysethe impact of different system parameters on the verifiability ofreceived information. Our results demonstrate the importance ofcross validating received messages, as well as the surprising diffi-culty in establishing correct membership views despite powerfulverification mechanisms.

Vehicular platoons have the potential to bring considerable fuel-savings and increase traffic efficiency. A key component for the next generation platoon systems is a secure membership component which can accommodate membership changes in a dynamic and potentially hostile environment. In this poster paper we analyse the conditions for creating a secure membership protocol which is resilient to attacks and faults in the communication protocols.

The software industry is facing a great challenge. While systems get more complex and distributed across the world, users are becoming more dependent on their availability. As systems increase in size and complexity so does the risk that some part will fail. Unfortunately, it has proven hard to tackle faults in distributed systems without a rigorous approach. Therefore, it is crucial that the scientific community can provide answers to how distributed computer systems can continue functioning despite faults.

Our contribution in this thesis is regarding a special class of faults which occurs whennetwork links fail in such a way that parts of the network become isolated, such faults are termed network partitions. We consider the problem of how systems that have integrity constraints on data can continue operating in presence of a network partition. Such a system must act optimistically while the network is split and then perform a some kind of reconciliation to restore consistency afterwards.

We have formally described four reconciliation algorithms and proven them correct. The novelty of these algorithms lies in the fact that they can restore consistency after network partitions in a system with integrity constraints and that one of the protocols allows the system to provide service during the reconciliation. We have implemented and evaluated the algorithms using simulation and as part of a partition-tolerant CORBA middleware. The results indicate that it pays off to act optimistically and that it is worthwhile to provide service during reconciliation.

In search and rescue scenarios local information on victims and other finds needs to be disseminated rapidly toother rescue workers and team leaders. However, post disaster scenarios may imply the collapse of informationinfrastructure including cellular communication and Internet connectivity. Even if we consider wireless ad hoccommunication as a means of information dissemination we should count on frequent loss of connectivity in thenetwork due to unpredictable mobility and sparse network topologies. In this paper we present the realization ofan existing manycast protocol (random walk gossip) on commodity handheld devices running the Androidplatform. This communication mode is used to demonstrate the potential for distributed informationdissemination on victims and finds. The application layer is an adaptation of an existing surveying informationtool (POSIT) which is now fully decentralized and relies on text communication to achieve energy efficiency.

The possibility of in-store payments would further increase the potential usefulness of cryptocurrencies. However, this would require much faster transaction verification than current solutions provide (one hour for Bitcoin) since customers are likely not prepared to wait a very long time for their purchase to be accepted by a store. We propose a solution for enabling in-store payments with waiting times in the order of a few seconds, which is still compatible with the current Bitcoin protocol. The idea is based on a payment card in combination with a protocol for ensuring that losing a card does not mean losing the money on it. We analyse the required transaction verification delay and also the potentially added risks that the solution brings compared to current systems.

New advanced traffic management solutions with fully or semi-autonomous vehicles that communicate over a wireless interface to coordinate their driving decisions create new challenges in distributed computing. In this paper we address the problem of dynamic group membership in three stages. First, we propose three criteria to specify correctness and performance of the group views created by such algorithms in terms of soundness, completeness and freshness. Second, we develop a group membership protocol tailored for vehicular coordination. Finally, we show through simulation and model-based verification that the protocol does indeed meet the criteria and provide at least 95% perfect group membership views under as adverse conditions as 70% packet loss or very high churn rate.

Increasing demands on safety and energy efficiency will require higher levels of automation in transportation systems. This involves dealing with safety-critical distributed coordination. In this paper we demonstrate how a Satisfiability Modulo Theories (SMT) solver can be used to prove correctness of a vehicular coordination problem. We formalise a recent distributed coordination protocol and validate our approach using an intersection collision avoidance (ICA) case study. The system model captures continuous time and space, and an unbounded number of vehicles and messages. The safety of the case study is automatically verified using the Z3 theorem prover.

Information dissemination in disaster scenarios requires timely and energy-efficient communication in intermittently connected networks. When the existing infrastructure is damaged or overloaded, we suggest the use of a manycast algorithm that runs over a wireless mobile ad hoc network, and overcomes partitions using a store-and-forward mechanism. This paper presents a random walk gossip protocol that uses an efficient data structure to keep track of already informed nodes with minimal signalling. Avoiding unnecessary transmissions also makes it less prone to overloads. Experimental evaluation shows higher delivery ratio, lower latency, and lower overhead compared to a recently published algorithm.

This book constitutes the refereed proceedings of the 11th International Conference on Ad-hoc, Mobile, and Wireless Networks, ADHOC-NOW 2012 held in Belgrade, Serbia, July 9-11, 2012. The 36 revised full papers presented were carefully reviewed and selected from 76 submissions. The accepted papers cover a wide spectrum of traditional networking topics ranging from routing to the application layer, to localization in various networking environments such as wireless sensor and ad-hoc networks, and give insights in a variety of application areas.

A quiet revolution that impacts several sectors, ranging over transport, home automation, energy, industrial control, and health services is undergoing with addition of new networked devices leading to enhanced services. In this paper, we aim to identify information security requirements that are common over several (vertical) sectors, and in particular, ones that impact critical societal services, namely, the energy, water, and health management systems. We present the results of an interview-based study where actors in these sectors were asked about their perceptions and attitudes on the security of Internet of Things (IoT). We set these perceptions and attitudes in context through a literature review of IoT security, and relate to current challenges in this area. This paper demonstrates that despite an overall optimistic view on IoT in critical societal services, there is a lack of consensus on risks related to IoT security.

This book brings together 19 papers focusing on the application of rigorous design techniques to the development of fault-tolerant, software-based systems. It is an outcome of the REFT 2005 Workshop on Rigorous Engineering of Fault-Tolerant Systems held in conjunction with the Formal Methods 2005 conference at Newcastle upon Tyne, UK, in July 2005.

This paper addresses design exploration for protocols that are employed in systems with availability-consistency trade-offs. Distributed data is modelled as states of objects replicated across a network, and whose updates require satisfaction of integrity constraints over multiple objects. Upon detection of a partition, such a network will continue to provide delivery of services in parallel partitions; but only for updates with non-critical integrity constraints. Once the degraded mode ends, the parallel network partitions are reconciled to arrive at one partition. Using a formal treatment of the reconciliation process, three algorithms are proposed and studied in terms of their influence on service outage duration. The longer the reconciliation time, the lower is system availability; since the interval in which no services are provided is longer. However, the reconciliation time in turn is affected by the time to construct the post-partition system state. The shorter the construction time the higher is the number of updates that took place in the degraded mode but that will not be taken up in the reconciled partition. This will lead to a longer interval for rejecting/redoing these operations and thereby increase reconciliation time.

Today many new applications are emerging that take advantage of wireless communication in handheld and embedded devices. Some of these emerging applications, such as information sharing in vehicular systems, have strong requirements for timely message dissemination, even if the network is not always 100% connected. In this chapter we discuss message differentiation mechanisms that can be used in intermittently connected networks to improve delivery and latency properties when messages have a limited time to live in the network. We present a simulation-based study on a large-scale vehicular scenario comparing different prioritisation mechanisms for a partition-tolerant manycast protocol. We show that negative effects of overloads can be significantly reduced by using information within the message about how far it has spread and how much time is remaining.

Worst-case latency is an important characteristic of information dissemination protocols. However, in sparse mobile ad hoc networks where end-to-end connectivity cannot be achieved and store-carry-forward algorithms are needed, such worst-case analyses have not been possible to perform on real mobility traces due to lack of suitable models. We propose a new metric called delay expansion that reflects connectivity and reachability properties of intermittently connected networks. Using the delay expansion, we show how bounds on worst-case latency can be derived for a general class of broadcast protocols and a wide range of real mobility patterns. The paper includes theoretical results that show how worst-case latency can be related with delay expansion for a given mobility scenario, as well as simulations to validate the theoretical model.

Replicated systems that run over partitionable environments, can exhibit increased availability if isolated partitions are allowed to optimistically continue their execution independently. This availability gain is traded against consistency, since several replicas of the same objects could be updated separately. Once partitioning terminates, divergences in the replicated state needs to be reconciled. One way to reconcile the state consists of letting the application manually solve inconsistencies. However, there are several situations where automatic reconciliation of the replicated state is meaningful. We have implemented replication and automatic reconciliation protocols that can be used as building blocks in a partition-tolerant middleware. The novelty of the protocols is the continuous service of the application even during the reconciliation process. A prototype system is experimentally evaluated to illustrate the increased availability despite network partitions.

  In this paper we describe how to include high level semantic information, such as aesthetics and emotions; into Content Based Image Retrieval. We present a, color-based emotion-related image descriptor that can be used for describing the emotional content of images. The color emotion metric used is derived from psychophysical experiments rind based oil three variables: activity, weight and teat. It was originally designed for single-colors, bill, recent research has shown that the salve emotion estimates call be applied in the retrieval of multi-colored images. Here we describe a new approach, based oil the assumption that perceived color emotions in images are mainly affected by homogenous regions, defined by the emotion metric; and transitions between regions. RGB coordinates are converted to emotion coordinates, mid for each emotion channel, statistical measurements of gradient magnitudes within a. stack of low-pass filtered images are used for finding interest; points corresponding to homogeneous regions and transitions between regions. Emotion characteristics are derived for patches surrounding cacti interest, point, and saved in a, bag-of-emotions; that for instance, can be used for retrieving images based oil emotional content.

Replicated distributed object systems are deployed to provide timely and reliable services to actors at distributed locations. This paper treats applications in which data updates are dependent on satisfaction of integrity constraints over multiple objects. Network partitions, caused by occasional link failures, overload or attacks create problems in keeping both consistency and availability in such networks. We propose a means of achieving higher availability by providing partition-awareness in middleware. The general approach has been illustrated by implementing a number of CORBA extensions that trade consistency for availability during network partitions. This paper contains a thorough experimental evaluation that presents the gains and costs of our approach. The experiments clearly illustrate the benefit of our protocols in terms of significantly higher availability and the number of performed operations.

Energy economy in mobile devices is becoming an increasinglyimportant factor as the devices become more advancedand rich in features. A large part of the energy footprint of amobile device comes from the wireless communication module,and even more so as the amount of trac increases.In this paper we study the energy footprint of a mobilebroadband hardware module, and how it is aected by software,by performing systematic power consumption measurements.We show that there are several cases where thesoftware does not properly take into account the eect thatdata communication has on the power consumption. Thisopens up for potential energy savings by creating better applicationsthat are aware of the energy characteristics of thecommunication layer.

Blockchains are increasingly studied in the context of new applications. Permissioned blockchains promise to deal with the issue of complete removal of trust, a notion that is currently the hallmark of the developed society. Before the idea is adopted in contexts where resource efficiency and fast operation is a requirement, one could legitimately ask the question: can permissioned blockchains match the performance of traditional large‐scale databases? This paper compares two popular frameworks, Hyperledger Fabric and Apache Cassandra, as representatives of permissioned blockchains and distributed databases, respectively. We compare their latency for varying workloads and network sizes. The results show that, for small systems, blockchains can start to compete with traditional databases, but also that the difference in consistency models and differences in setup can have a large impact on the resulting performance.

This work studies the energy and quality of service (QoS) trade-off in the context of mobile devices with two communication interfaces (a high energy and a low energy interface). We propose an optimisation scheme during underload scenarios where proxy groups are dynamically formed exploiting both interfaces. The scheme integrates a reward mechanism that compensates a proxy while carrying other group members’ traffic, and deals with churn (joining and leaving of nodes) in a cell area. For traffic flows that approximate knowledge about current services we show that the scheme can achieve energy savings of 60% for all mobile nodes as whole. We also demonstrate the impact on disruption-sensitive flows as a function of the traffic mix, and that the use of rewards for selection of proxies is a fair mechanism in the long term.

Vehicular networks will enable a range of novel applications to enhance road traffic efficiency, safety, and reduce fuel consumption. As for other cyber-physical systems, security is essential to the deployment of these applications and standardisation efforts are ongoing. In this paper, we perform a systematic security evaluation of a vehicular platooning protocol through a thorough analysis of the protocol and security standards. We tackle the complexity of the resulting model with a proof strategy based on a relation on keys. The key relation forms a partial order, which encapsulates both secrecy and authenticity dependencies. We show that our order-aware approach makes the verification feasible and proves authenticity properties along with secrecy of all keys used throughout the protocol.

Future cooperative transportation systems will be highly dependent on correct situation awareness that can be established with the help of inter-vehicular communication. Location information from surrounding vehicles will most likely be used in such systems to make automated driving decisions, making it essential to guarantee location assurance. In this paper we propose Vouch+, which provides a scheme to improve trustworthiness of shared location information. The proposed scheme uses cryptographic primitives and mobility awareness to enable location proofs that work also in high-speed scenarios. Vouch+ takes a decentralized approach to establish trust in location information, but can also be used with future 5G infrastructure. The evaluation of Vouch+ using a synthetic dataset from the city of Cologne shows that using a decentralized approach is viable for cases where traffic is dense enough. In addition, simulation-based experiments show that Vouch+ is able to handle the high-mobility environment of vehicular networks and can counteract studied position-based attacks using reaction strategies.

The expansion of mobile network capabilities throughout the decades has increased peoples exposure to the digital world, and the next generations of communication networks are expected to achieve ubiquitous connectivity and immersive use cases. Security and privacy concerns have arisen and are continuously taken into account in the design of mobile networks. However, a relevant limitation currently lies in the use of shared secrets for providing security and privacy to users. Ideally, we believe that users identities should be immune to impersonation as long as their own devices remain secure, notwithstanding the network operators and other entities potentially being compromised. In this paper, we develop this idea with the objective of providing the non-repudiation property, which represents a mitigation to its dual, impersonation.

Mobile networks have grown in size and relevance, with novel applications in areas including transportation, finance, and health. The wide use of mobile networks generates rich data about users, raising interest in using such data for law enforcement and antiterrorism through Lawful Interception (LI). Countries worldwide have established legal frameworks to conduct LI, and technical standards have been created for its implementation and deployment, but without sufficient (and rigorous) security controls. While LI originated for benign purposes, we show in this paper that malicious entities could exploit it to frame users into suspicion of criminal activity. Further, we propose a solution for non-frameability, which we formally prove uphold desired properties even in scenarios where attackers completely infiltrate the operator networks. To perform the formal verification, we extend prior work with a more complete model of the fifth generation (5G) of mobile networks in the Tamarin prover.

As connected vehicles are envisioned to provide novel intelligent transportation systems, cyberattacks and security schemes are becoming an increasing concern. Several studies have shown that algorithms that make use of location information from other vehicles, such as vehicular platoon controllers, are vulnerable to message falsification attacks. Moreover, the ability for an attacking vehicle to appear as several vehicles through a so-called Sybil attack can significantly increase the severity of the attack. In this paper, we investigate how these attacks can be detected using Vouch location proof scheme (by identifying false location messages) and propose several reaction strategies to mitigate them. We also show through simulation that it is possible to prevent collisions by reacting appropriately to the false beacons in time while not reacting to false positives coming from the detector.

This paper studies the impact of vulnerabilities associated with the Sybil attack (through falsification of multiple identities) and message falsification in vehicular platooning. Platooning employs Inter-Vehicular Communication (IVC) to control a group of vehicles. It uses broadcast information such as acceleration, position, and velocity to operate a longitudinal control law. Cooperation among vehicles allows platoons to reduce fuel consumption and risks associated with driver mistakes. In spite of these benefits, the use of network communication to control vehicles exposes a relevant attack surface that can be exploited by malicious actors. To carry out this study, we evaluate five scenarios to quantify the potential impact of such attacks, identifying how platoons behave under varying Sybil attack conditions and what are the associated safety risks. This research also presents the use of location hijacking attack. In this attack, innocent vehicles that are not part of a platoon are used as a way to create trust bond between the false identities and the physical vehicles. We demonstrate that the ability to create false identities increases the effectiveness of message falsification attacks by making them easier to deploy and harder to detect in time.

Platooning employs a set of technologies to manage how a group of vehicles operates, including radar, GPS and Inter-Vehicular Communication (IVC). It uses broadcasted information such as acceleration, position and velocity to operate vehicle members of the platoon. Cooperation among vehicles allows platoons to reduce fuel consumption and risks associated with driver mistakes. In spite of these benefits, the use of IVC to control vehicles exposes a relevant attack surface that can be exploited by malicious actors. In this paper we study the impact of vulnerabilities associated with the Sybil attack (through falsification of multiple identities) and message falsification in vehicular platooning. Simulation results show that this attack may impact the longitudinal control and compromise the entire platoon control.

In the event of a disaster, telecommunication infrastructures can be severely damaged or overloaded. Hastily formed networks can provide communication services in an ad hoc manner. These networks are challenging due to the chaotic context where intermittent connection is the norm and the identity and number of participants cannot be assumed. In such environments malicious actors may try to disrupt the communications to create more chaos for their own benefit. This paper proposes a general security framework for monitoring and reacting to disruptive attacks. It includes a collection of functions to detect anomalies, diagnose them, and perform mitigation. The measures are deployed in each node in a fully distributed fashion, but their collective impact is a significant resilience to attacks, so the actors can disseminate information under adverse conditions. The approach is evaluated in the context of a simulated disaster area network with a many-cast dissemination protocol, Random Walk Gossip, with a store-and-forward mechanism. A challenging threat model where adversaries may 1) try to drain the resources both at node level (battery life) and network level (bandwidth), or 2) reduce message dissemination in their vicinity, without spending much of their own energy, is adopted. The results demonstrate that the approach diminishes the impact of the attacks considerably.

One of the most challenging applications of wireless networking are in disaster area networks where lack of infrastructure, limited energy resources, need for common operational picture and thereby reliable dissemination are prevalent.In this paper we address anomaly detection in intermittently connected mobile ad hoc networks in which there is little or no knowledge about the actors on the scene, and opportunistic contacts together with a store-and-forward mechanism are used to overcome temporary partitions. The approach uses a statistical method for detecting anomalies when running a manycast protocol for dissemination of important messages to k receivers. Simulation of the random walk gossip (RWG) protocol combined with detection and mitigation mechanisms is used to illustrate that resilience can be built into a network in a fully distributed and attack-agnostic manner, at a modest cost in terms of drop in delivery ratio and additional transmissions. The approach is evaluated with attacks by adversaries that behave in a similar manner to fair nodes when invoking protocol actions.

Purpose: The information technology (IT) sector has been seen as central to society's transformation to a more just and sustainable society, which underlines teachers’ responsibility to foster engineers who can contribute specifically to such ends. This study aims to report an effort to significantly update an existing engineering programme in IT with this ambition and to analyse the effects and challenges associated with the transformation.

Design/methodology/approach: This study is based on a combination of action-oriented research based on implementing key changes to the curriculum; empirical investigations including surveys and interviews with students and teachers, and analysis of these; and a science and technology studies-inspired analysis.

Findings: Respondents were generally positive towards adding topics relating to sustainability. However, in the unmaking of traditional engineering subjects, changes created a conflict between core versus soft subjects in which the core subjects tended to gain the upper hand. This conflict can be turned into productive discussions by focusing on what kinds of engineers the authors’ educate and how students can be introduced to societal problems as an integrated part of their education.

Practical implications: This study can be helpful for educators in the engineering domain to support them in their efforts to transition from a (narrow) focus on traditional disciplines to one where the bettering of society is at the core.

Originality/value: This study provides a novel approach to the transformation of engineering education through a theoretical analysis seldom used in studies of higher education on a novel case study.

Emerging surveillance applications of UAV teams rely on secure communication to exchange information, coordinate their movements, and fulfill mission objectives. Protecting the network by identifying malicious nodes that are trying to disturb the system is an important task, particularly in the military domain. This paper presents the design and evaluation of UAVouch, an identity and location validation scheme that combines a public-key based authentication mechanism with a movement plausibility check for groups of UAVs. The key idea of UAVouch is to supplement the authentication mechanism by periodically checking the plausibility of the locations of neighboring UAVs, allowing the detection of intruders that are unable to follow expected trajectories. The proposed solution was evaluated in a simulated military surveillance scenario in which it detected malicious nodes position falsification attacks with an average accuracy of above 85%.

Microarchitectural attacks such as Meltdown and Spectre have attracted much attention recently. In this paper we study how effective these attacks are on the Genode microkernel framework using three different kernels, Okl4, Nova, and Linux. We try to answer the question whether the strict process separation provided by Genode combined with security-oriented kernels such as Okl4 and Nova can mitigate microarchitectural attacks. We evaluate the attack effectiveness by measuring the throughput of data transfer that violates the security properties of the system. Our results show that the underlying side-channel attack Flush+Reload used in both Meltdown and Spectre, is effective on all investigated platforms. We were also able to achieve high throughput using the Spectre attack, but we were not able to show any effective Meltdown attack on Okl4 or Nova.

Microservice architectures decompose applications into individual components for enhanced maintainability and horizontal scaling, but also comes with an increased cost for orchestrating the services. Software-Defined Networks (SDNs) enables the dynamic configuration of network switches using controllers. In this paper we propose a microservice architecture that leverages SDN to orchestrate the microservices with the goal of reducing the orchestration latency cost. We perform a set of experiments using Mininet in which we implement a tailor-made microservice application that uses SDN for orchestration in combination with a set of different controllers and load balancers. Our results show that our proposed architecture performs in the same order of magnitude as a corresponding monolithic system.

With the increasing dependency of ubiquitous connectivity for applications ranging from multimedia entertainment to intelligent transportation systems, having good signal coverage becomes vital. Therefore, route planners and navigation systems should take into account not only the physical distance, but also the characteristics and availability of the cellular network on the potential routes. In this paper we present a route planning tool that finds the connectivity-aware shortest paths based on crowdsourced data from OpenStreetMap and OpenSignal. The tool calculates optimal paths and allows physical distance tobe traded against signal quality. The evaluation shows that a 15% increase of the physical path length can achieve an 8.7dBm improvement of worst-case signal strength.

Trusted execution environments like Intel SGX allow developers to protect sensitive code in so-called enclaves. These enclaves protect their code and data even in the cases of a compromised OS. However, such enclaves have also been shown to be vulnerable to numerous side-channel attacks. In this paper we propose an idea of self-monitoring enclaves and investigate the viability of using performance counters to detect a side-channel attacks against Intel SGX, specifically the Load Value Injection (LVI) class of attacks. We characterize the footprint of three LVI attack variants and design a prototype detection mechanism. The results show that certain attack variants could be reliably detected using this approach without false positives for a range of benign applications. The results also demonstrate reasonable levels of speed and overhead for the detection mechanism. Finally, we list four requirements for making self-monitoring based on such a detection mechanism feasible and point out that three of them are not satisfied in Intel SGX.

Supervisory Control and Data Acquisition (SCADA) systems that operate our critical infrastructures are subject to increased cyber attacks. Due to the use of request-response communication in polling, SCADA traffic exhibits stable and predictable communication patterns. This paper provides a timing-based anomaly detection system that uses the statistical attributes of the communication patterns. This system is validated with three datasets, one generated from real devices and two from emulated networks, and is shown to have a False Positive Rate (FPR) under 1.4%. The tests are performed in the context of three different attack scenarios, which involve valid messages so they cannot be detected by whitelisting mechanisms. The detection accuracy and timing performance are adequate for all the attack scenarios in request-response communications. With other interaction patterns (i.e. spontaneous communications), we found instead that 2 out of 3 attacks are detected.

This paper describes five problem areas of communication that occur during crisis response. These areas arecommunication infrastructure, situation awareness, individual and organizational common ground, form andcontent of messages, and communication paths through organizations. Five focus groups with Swedish fieldpersonnel from national and international crises were performed. The main contribution of this article is ahypothesis, based on the outcomes of the focus groups, about the relation between communication problems andhow they interact with crisis response work.

Today's vehicles are equipped with a large number of Electronic Control Units (ECUs), which control everything from heating to steering and braking. Due to the increasing complexity and inter-dependency of these units, it has become essential for an ECU to be able to ensure the integrity of the firmware running on other ECU's to guarantee its own correct operation. Existing solutions for firmware attestation uses a centralized approach which means a single point of failure. In this article, we propose and investigate a decentralized firmware attestation scheme for the automotive domain. The basic idea of this scheme is that each ECU can attest the state of those ECU's on which it depends. Two flavors of ECU attestation i.e. parallel and serial solution were designed, implemented and evaluated. The two variants were compared in terms of both detection performance (i.e., the ability to identify unauthorized firmware modifications) and timing performance. Our results show that the proposed scheme is feasible to implement and that the parallel solution showed a significant improvement in timing performance over the serial solution.

The Internet-of-Things (IoT) is a large and complex domain. These systems are often constructed using a very diverse set of hardware, software and protocols. This, combined with the ever increasing number of IoT solutions/services that are rushed to market means that most such systems are rife with security holes. Recent incidents (e.g., the Mirai botnet) further highlight such security issues. With emerging technologies such as blockchain and software-defined networks (SDNs), new security solutions are possible in the IoT domain. In this paper we will explore future trends in IoT security: (a) the use of blockchains in IoT security, (b) data provenance for sensor information, (c) reliable and secure transport mechanisms using SDNs (d) scalable authentication and remote attestation mechanisms for IoT devices and (e) threat modeling and risk/maturity assessment frameworks for the domain.

The increase of electric vehicles has exacerbated the need for adequate security measures in the electric vehicle charging ecosystem (EVCE). Integrating IT services into the electric vehicle charging infrastructure exposes it to several new attack vectors. In this paper, we apply a vulnerability analysis method to assess the current security posture of the internet-connected EVCE components. Our method is based on penetration testing principles using open-source cybersecurity search engines. Using this method, we gathered security-related information apparently associated with eight charging station vendors and three management systems, and we found 13 vulnerable technologies containing 81 vulnerabilities. Based on the information provided by vulnerability databases, we classified the threats according to the STRIDE model and analyzed the potential consequences of the vulnerabilities in terms of the security properties that can be violated.

Todays vehicles are examples of Cyber-Physical Systems (CPS) controlled by a large number of electronic control units (ECUs), which manage everything from heating to steering and braking. Due to the increasing complexity and inter-dependency of these units, it has become essential for an ECU to be able to ensure the integrity of the firmware running on other ECUs to guarantee its own correct operation. Existing solutions for firmware attestation use a centralized approach, which means a single point of failure. In this article, we propose and investigate a decentralized firmware attestation scheme for the automotive domain. The basic idea of this scheme is that each ECU can attest to the state of those ECUs on which it depends. Two flavors of ECU attestation, i.e., parallel and serial solution, were designed, implemented, and evaluated. The two variants were compared in terms of both detection performance (i.e., the ability to identify unauthorized firmware modifications) and timing performance. Our results show that the proposed scheme is feasible to implement and that the parallel solution showed a significant improvement in timing performance over the serial solution.

This paper investigates common misconceptions held by students regarding concurrency in order to better understand how concurrency education can be improved in the future. As a part of the exam in two courses on concurrency and operating systems, students were asked to identify and eliminate any concurrency issues in a piece of code as a part of their final exam. Different types of mistakes were identified and the 216 answers were sorted into categories accordingly. The results presented in this paper show that while most students were able to identify the cause of an issue given its symptoms, only approximately half manage to successfully eliminate the concurrency issues. Many of the incorrect solutions fail to associate shared data with a synchronization primitive, e.g. using one lock to protect multiple instances of a data structure, or multiple locks to protect the same instance in different situations. This suggests that students may not only have trouble dealing with concepts related to concurrency, but also more fundamental concepts related to the underlying computational model. Finally, this paper proposes possible explanations for the students' mistakes in terms of improper mental models, and suggests types of problems that highlight the issues with these mental models to improve students' understanding of the subject.

One of the major areas of interest for deployment of blockchains is in the supply chain sector where decentralisation combined with immutability is expected to enhance the transparency and robustness of transaction processing drastically. In this work we contribute to a feasibility study for permissioned blockchains in the context of a major international retail company. First, we characterise the types, relationships, and volumes of events that are created in the life cycle of a product from creation to ownership transfer. We use the created event model and the data from the company operations to identify the load that such an event processing system would have to manage. Then we create a prototype based on Quorum that deals with a significant subset of the events and expose the blockchain-based prototype to variations in load to identify the maximum throughput and average transaction processing time. This system can then form the basis of understanding the bottlenecks, configuration settings and platform choices needed in future potential deployment.

Supervisory control and data acquisition (SCADA) systemsthat run our critical infrastructure are increasingly run withInternet-based protocols and devices for remote monitoring.The embedded nature of the components involved, and thelegacy aspects makes adding new security mechanisms in anefficient manner far from trivial. In this paper we studyan anomaly detection based approach that enables detect-ing zero-day malicious threats and benign malconfigurationsand mishaps. The approach builds on an existing platform(Bro) that lends itself to modular addition of new proto-col parsers and event handling mechanisms. As an examplewe have shown an application of the technique to the IEC-60870-5-104 protocol and tested the anomaly detector withmixed results. The detection accuracy and false positiverate, as well as real-time response was adequate for 3 ofour 4 created attacks. We also discovered some additionalwork that needs to be done to an existing protocol parser toextend its reach.

This paper presents RASUES, a remote-attestation-based scheme designed to incorporate software updates in embedded systems. Our approach has two primary aims: to extend remote attestation specifications to account for software updates, and to leverage Remote Attestation (RA) to validate the integrity of the update process itself. We extend the RATS RFC 9334 specification with an update procedure that accounts for the expected state before and after the update. We demonstrate the feasibility of our design by implementing the main functionality of RASUES on a TPM-based hardware platform. We evaluate the latency of our prototype and analyze its security properties, showing that the approach has acceptable overhead and can provide added security under the stated assumptions.