arXiv subjects

Lixia Zhang

Publications and source records attributed to Lixia Zhang.

At least 37 records · Page 2Linked to original sources

arXiv2021

Spectral Integrals of Bernoulli Generalized Functionals

Let $\mathcal{S}\subset \mathcal{L}^2 \subset \mathcal{S}^*$ be the Gel'fand triple over the Bernoulli space, where elements of $\mathcal{S}^*$ are called Bernoulli generalized functionals. In this paper, we define integrals of Bernoulli generalized functionals with respect to a spectral measure (projection operator-valued measure) in the framework of $\mathcal{S}\subset \mathcal{L}^2 \subset \mathcal{S}^*$, and examine their fundamental properties. New notions are introduced, several results are obtained and examples are also shown.

math.FA↗

arXiv2021

Supporting Multiparty Signing over Named Data Networking

Modern digitally controlled systems require multiparty authentication and authorization to meet the desired security requirement. This paper describes the design and development of NDN-MPS, an automated solution to support multiparty signature signing and verification for NDN-enabled applications. NDN-MPS suggests several changes and extensions to the existing NDN security solutions. First, it introduces a new type of trust schema to support signing and verification for multiple signers under complex policies such as threshold schemes. Second, it extends the NDN signature format to accommodate multisignature schemes such as BLS signature. Third, it introduces a signature collection protocol to solicit signatures securely from multiple signers. We further evaluate NDN-MPS by assessing its security properties and measuring its performance.

cs.CR↗

arXiv2021

Expect More from the Networking: DDoS Mitigation by FITT in Named Data Networking

Distributed Denial of Service (DDoS) attacks have plagued the Internet for decades, but the basic defense approaches have not fundamentally changed. Rather, the size and rate of growth in attacks have actually outpaced carriers' and DDoS mitigation services' growth, calling for new solutions that can be, partially or fully, deployed imminently and exhibit effectiveness. In this paper, we examine the basic functions in Named Data Networking (NDN), a newly proposed Internet architecture, that can address the principle weaknesses in today's IP networks. We demonstrate by a new DDoS mitigation solution over NDN, Fine-grained Interest Traffic Throttling FITT, that NDN's architectural changes, even when incrementally deployed, can make DDoS attacks fundamentally more difficult to launch and less effective. FITT leverages the NDN design to enable the network to detect DDoS from victim's feedback, throttles DDoS traffic by reverse its exact paths through the network, and enforces control over the misbehaving entities at their sources. Our extensive simulation results show that FITT can throttle attack traffic with one-way time delay from the victim to the NDN gateway; upon activation, FITT effectively stop attack traffic from impacting benign flows, resulting in over 99\% of packets reaching victims being legitimate ones. We further demonstrate that service providers may implement NDN/FITT on existing CDN nodes as an incrementally deployable solution to effectuate the application level remediation at the sources, which remains unattainable in today's DDoS mitigation approaches.

cs.CR↗

arXiv2020

On Certificate Management in Named Data Networking

Named Data Networking (NDN) secures network communications by requiring all data packets to be signed when produced. This requirement necessitates efficient and usable mechanisms to handle NDN certificate issuance and revocation, making these supporting mechanisms essential for NDN operations. In this paper, we first investigate and clarify core concepts related to NDN certificates and security design in general, and then present the model of NDN certificate management and its desired properties. We proceed with the design of a specific realization of NDN's certificate management, NDNCERT, evaluate it using a formal security analysis, and discuss the challenges in designing, implementing, and deploying the system, to share our experiences with other NDN security protocol development efforts.

cs.CR↗

arXiv2020

Comparison between $Fermi$ Detected and non-$Fermi$ Detected Superluminal Sources

Active galactic nuclei (AGNs) have been attracting research attention due to their special observable properties. Specifically, a majority of AGNs are detected by Fermi-LAT missions, but not by Fermi-LAT, which raises the question of whether any differences exist between the two. To answer this issue, we compile a sample of 291 superluminal AGNs (189 FDSs and 102 non-FDSs) from available multi-wavelength radio, optical, and X-ray (or even $γ$-ray) data and Doppler factors and proper motion ($μ$) (or apparent velocity ($β_{\rm{app}}$)); calculated the apparent velocity from their proper motion, Lorentz factor ($Γ$), viewing angle ($ϕ$) and co-moving viewing angle ($ϕ_{co}$) for the sources with available Doppler factor ($δ$); and performed some statistical analyses for both types. Our study indicated that1. In terms of average values, FDSs have higher proper motions ($μ$), apparent velocities ($β_{\rm app}$), Doppler factor ($δ$), Lorentz factor ($Γ$), and smaller viewing angle ($ϕ$). Nevertheless, there is no clear difference in co-moving viewing angles ($ϕ_{\rm co}$).

astro-ph.HE↗

arXiv2020

EL PASSO: Privacy-preserving, Asynchronous Single Sign-On

We introduce EL PASSO, a privacy-preserving, asynchronous Single Sign-On (SSO) system. It enables personal authentication while protecting users' privacy against both identity providers and relying parties, and allows selective attribute disclosure. EL PASSO is based on anonymous credentials, yet it supports users' accountability. Selected authorities may recover the identity of allegedly misbehaving users, and users can prove properties about their identity without revealing it in the clear. EL PASSO does not require specific secure hardware or a third party (other than existing participants in SSO). The generation and use of authentication credentials are asynchronous, allowing users to sign on when identity providers are temporarily unavailable. We evaluate EL PASSO in a distributed environment and prove its low computational cost, yielding faster sign-on operations than OIDC from a regular laptop, one-second user-perceived latency from a low-power device, and scaling to more than 50 sign-on operations per second at a relying party using a single 4-core server in the cloud.

cs.CR↗

arXiv2020

DAPES: Named Data for Off-the-Grid File Sharing with Peer-to-Peer Interactions

This paper introduces DAta-centric Peer-to-peer filE Sharing (DAPES), a data sharing protocol for scenarios with intermittent connectivity and user mobility. DAPES provides a set of semantically meaningful hierarchical naming abstractions that facilitate the exchange of file collections via local connectivity. This enables peers to "make the most" out of the limited connection time with other peers by maximizing the utility of individual transmissions to provide data missing by most connected peers. DAPES runs on top of Named-Data Networking (NDN) and extends NDN's data-centric network layer abstractions to achieve communication over multiple wireless hops through an adaptive hop-by-hop forwarding/suppression mechanism. We have evaluated DAPES through real-world experiments in an outdoor campus setting and extensive simulations. Our results demonstrate that DAPES achieves 50-71% lower overheads and 15-33% lower file sharing delays compared to file sharing solutions that rely on IP-based mobile ad-hoc routing.

cs.NI↗

arXiv2020

The Paradox of Information Access: Growing Isolation in the Age of Sharing

Modern online media, such as Twitter, Instagram, and YouTube, enable anyone to become an information producer and to offer online content for potentially global consumption. By increasing the amount of globally accessible real-time information, today's ubiquitous producers contribute to a world, where an individual consumes vanishingly smaller fractions of all produced content. In general, consumers preferentially select information that closely matches their individual views and values. The bias inherent in such selection is further magnified by today's information curation services that maximize user engagement (and thus service revenue) by filtering new content in accordance with observed consumer preferences. Consequently, individuals get exposed to increasingly narrower bands of the ideology spectrum. Societies get fragmented into increasingly ideologically isolated enclaves. These enclaves (or echo-chambers) then become vulnerable to misinformation spread, which in turn further magnifies polarization and bias. We call this dynamic the paradox of information access; a growing ideological fragmentation in the age of sharing. This article describes the technical, economic, and socio-cognitive contributors to this paradox, and explores research directions towards its mitigation.

cs.CY↗

arXiv2020

AuditShare: Sensitive Data Sharing with Reliable Leaker Identification

As Personally Identifiable Information (PII) data sharing among multiple parties becomes increasingly common, so does the potential for data leakage. As required by new data protection regulations and laws, when PII leakage occurs, one must be able to reliably identify the leaking sources. Existing solutions utilize watermark technologies or data object allocation strategies to differentiate the data shared with different parties to identify potential leakers. However, these solutions lose their effectiveness under several attack scenarios, e.g., a data sender may leak the data and a receiver may deny the reception of certain shared data. Worse yet, multiple receivers might collude and apply a set of operations such as intersection, complement, and union to their received datasets before leaking them, making the task of leaker identification even more difficult. In this paper, we propose AuditShare, a PII dataset sharing system with reliable leaking source identification. Firstly, taking advantage of the intrinsic properties of PII data, AuditShare allocates data objects to individual sharing parties by PII attributes. Secondly, AuditShare obliviously transfers data between the sender and each receiver and uses a Merkle Tree as an immutable record of the sharing. Thirdly, a knowledge-based identification algorithm is proposed to identify a guilty sender or colluding/non-colluding receivers. Through our evaluation, we show that: (i) With a modest amount of leaked data, AuditShare can accurately (accuracy>99.99%) and undeniably identify all the guilty parties in different cases; (ii) It only takes 0.5 second to share 100,000 data objects in AuditShare, which is practical in real-world deployment.

cs.CR↗

arXiv2019

DLedger: An IoT-Friendly Private Distributed Ledger System Based on DAG

With the ever growing Internet of Things (IoT) market, ledger systems are facing new challenges to efficiently store and secure enormous customer records collected by the IoT devices. The authenticity, availability, and integrity of these records are critically important for both business providers and customers. In this paper, we describe DLedger, a lightweight and resilient distributed ledger system. Instead of a single chain of blocks, DLedger builds the ledger over a directed acyclic graph (DAG), so that its operations can tolerate network partition and intermittent connectivity. Instead of compute-intensive Proof-of-Work (PoW), DLedger utilizes Proof-of-Authentication (PoA), whose light-weight operations are IoT-friendly, to achieve consensus. Furthermore, DLedger is built upon a data-centric network called Named Data Networking (NDN), which facilitates the peer-to-peer data dissemination in heterogeneous IoT networks.

cs.CR↗

arXiv2019

20 Years of DDoS: a Call to Action

Botnet Distributed Denial of Service (DDoS) attacks are now 20 years old; what has changed in that time? Their disruptive presence, their volume, distribution across the globe, and the relative ease of launching them have all been trending in favor of attackers. Our increases in network capacity and our architectural design principles are making our online world richer, but are favoring attackers at least as much as Internet services. The DDoS mitigation techniques have been evolving but they are losing ground to the increasing sophistication and diversification of the attacks that have moved from the network to the application level, and we are operationally falling behind attackers. It is time to ask fundamental questions: are there core design issues in our network architecture that fundamentally enable DDoS attacks? How can our network infrastructure be enhanced to address the principles that enable the DDoS problem? How can we incentivize the development and deployment of the necessary changes? In this article, we want to sound an alarm and issue a call to action to the research community. We propose that basic research and principled analyses are badly needed, because the status quo does not paint a pretty picture for the future.

cs.NI↗

arXiv2019

Correlation Analysis for Gamma-ray (radio) and Broad Line Emissions of Fermi Blazars

In this work, we compiled a sample of 202 Fermi/LAT blazars with available broad line emissions. Out of the 202 sources, 66 have known Doppler factors. The correlation between ($γ$-ray) and broad-line emission, and that between radio and broad-line emission are investigated by removing the effects of redshift and beaming boosting for the whole sample and the subclasses, flat spectrum radio quasars (FSRQs) and BL Lacertae objects (BL Lacs) respectively. We obtained a strong positive correlation between ($γ$-ray) and broad-line emission and between radio and broad-line emission for the 202 blazars; It is worth noting that the correlation still exists after removing redshift effect. For the 66 sources with Doppler factors, there is also a positive correlation between ($γ$-ray) and broad-line emission after removing the Doppler factors, as well as that between radio and broad-line emission. Our analysis suggest that 1. There are strong correlations between the ($γ$-ray) and the broad line emission for the whole blazar sample and their subclasses. The correlations exist when the redshift effect is removed for the whole sample and their subclasses, confirming the results by Ghisellini et al. (2014) and Chen (2018). 2. For the 66 blazars with available Doppler factors, a strong correlation between the broad line emission and the Doppler factor is found. The correlation between the ($γ$-ray) and the broad line emission exists after the Doppler factor effect is removed. Similar results for 1 and 2 also obtained between radio and broad-line emission. 3. Our analysis suggests a robust connection between the accretion process and the jet.

astro-ph.GA↗

arXiv2019

NAC: Automating Access Control via Named Data

In this paper we present the design of Name-based Access Control (NAC) scheme, which supports data confidentiality and access control in Named Data Networking (NDN) architecture by encrypting content at the time of production, and by automating the distribution of encryption and decryption keys. NAC achieves the above design goals by leveraging specially crafted NDN naming conventions to define and enforce access control policies, and to automate the cryptographic key management. The paper also explains how NDN's hierarchically structured namespace allows NAC to support fine-grained access control policies, and how NDN's Interest-Data exchange can help NAC to function in case of intermittent connectivity. Moreover, we show that NAC design can be further extended to support Attribute-based Encryption (ABE), which supports access control with additional levels of flexibility and scalability.

cs.NI↗

arXiv2018

Experimentation With Fuzzy Interest Forwarding in Named Data Networking

In the current Named Data Networking implementation, forwarding a data request requires finding an exact match between the prefix of the name carried in the request and a forwarding table entry. However, consumers may not always know the exact naming, or an exact prefix, of their desired data. The current approach to this problem-establishing naming conventions and performing name lookup-can be infeasible in highly ad hoc, heterogeneous, and dynamic environments: the same data can be named using different terms or even languages, naming conventions may be minimal if they exist at all, and name lookups can be costly. In this paper, we present a fuzzy Interest forwarding approach that exploits semantic similarities between the names carried in Interest packets and the names of potentially matching data in CS and entries in FIB. We describe the fuzzy Interest forwarding approach, outline the semantic understanding function that determines the name matching, and present our simulation study along with extended evaluation results.

cs.NI↗

arXiv2016

An Experimental Investigation of Hyperbolic Routing with a Smart Forwarding Plane in NDN

Routing in NDN networks must scale in terms of forwarding table size and routing protocol overhead. Hyperbolic routing (HR) presents a potential solution to address the routing scalability problem, because it does not use traditional forwarding tables or exchange routing updates upon changes in network topologies. Although HR has the drawbacks of producing sub-optimal routes or local minima for some destinations, these issues can be mitigated by NDN's intelligent data forwarding plane. However, HR's viability still depends on both the quality of the routes HR provides and the overhead incurred at the forwarding plane due to HR's sub-optimal behavior. We designed a new forwarding strategy called Adaptive Smoothed RTT-based Forwarding (ASF) to mitigate HR's sub-optimal path selection. This paper describes our experimental investigation into the packet delivery delay and overhead under HR as compared with Named-Data Link State Routing (NLSR), which calculates shortest paths. We run emulation experiments using various topologies with different failure scenarios, probing intervals, and maximum number of next hops for a name prefix. Our results show that HR's delay stretch has a median close to 1 and a 95th-percentile around or below 2, which does not grow with the network size. HR's message overhead in dynamic topologies is nearly independent of the network size, while NLSR's overhead grows polynomially at least. These results suggest that HR offers a more scalable routing solution with little impact on the optimality of routing paths.

cs.NI↗

arXiv2015

Navigo: Interest Forwarding by Geolocations in Vehicular Named Data Networking

This paper proposes Navigo, a location based packet forwarding mechanism for vehicular Named Data Networking (NDN). Navigo takes a radically new approach to address the challenges of frequent connectivity disruptions and sudden network changes in a vehicle network. Instead of forwarding packets to a specific moving car, Navigo aims to fetch specific pieces of data from multiple potential carriers of the data. The design provides (1) a mechanism to bind NDN data names to the producers' geographic area(s); (2) an algorithm to guide Interests towards data producers using a specialized shortest path over the road topology; and (3) an adaptive discovery and selection mechanism that can identify the best data source across multiple geographic areas, as well as quickly react to changes in the V2X network.

cs.NI↗

arXiv2013

Vehicular Inter-Networking via Named Data

In this paper we apply the Named Data Networking, a newly proposed Internet architecture, to networking vehicles on the run. Our initial design, dubbed V-NDN, illustrates NDN's promising potential in providing a unifying architecture that enables networking among all computing devices independent from whether they are connected through wired infrastructure, ad hoc, or intermittent DTN. This paper describes the prototype implementation of V-NDN and its preliminary performance assessment.

cs.NI↗

arXiv2012

DoS and DDoS in Named-Data Networking

With the growing realization that current Internet protocols are reaching the limits of their senescence, a number of on-going research efforts aim to design potential next-generation Internet architectures. Although they vary in maturity and scope, in order to avoid past pitfalls, these efforts seek to treat security and privacy as fundamental requirements. Resilience to Denial-of-Service (DoS) attacks that plague today's Internet is a major issue for any new architecture and deserves full attention. In this paper, we focus on DoS in a specific candidate next-generation Internet architecture called Named-Data Networking (NDN) -- an instantiation of Information-Centric Networking approach. By stressing content dissemination, NDN appears to be attractive and viable approach to many types of current and emerging communication models. It also incorporates some basic security features that mitigate certain attacks. However, NDN's resilience to DoS attacks has not been analyzed to-date. This paper represents the first step towards assessment and possible mitigation of DoS in NDN. After identifying and analyzing several new types of attacks, it investigates their variations, effects and counter-measures. This paper also sheds some light on the long-standing debate about relative virtues of self-certifying, as opposed to human-readable, names.

cs.NI↗