arXiv subjects

Thomas C. Schmidt

Publications and source records attributed to Thomas C. Schmidt.

At least 19 recordsLinked to original sources

arXiv2026

Secrets Best Not Shared: DNS Privacy Enhancements for the Constrained IoT

Attackers often identify DNS traffic to disrupt or compromise Internet services. While prior work has focused on encrypting queries using DNS over TLS, HTTPS, or QUIC to counter such attacks, we consider IETF protocols designed for resource-constrained IoT devices and empirically analyze the potential of obfuscating DNS traffic in addition to encryption. We create a dataset of machine-to-machine-compatible data objects along with the corresponding DNS resolution processes, evaluating 296 deployment scenarios of resolving host names, including DNS over the Constrained Application Layer Protocol (CoAP) and an onion routing flavor of CoAP under varying link-layer conditions. We compare them to DNS over HTTPS. Using Random Forest and a header field analysis, we identify fields that leak most information. Our findings show that DNS over CoAP with equalized packet lengths, block-wise transfer, and header compression reduces the accuracy of identifying DNS frames to 86% and further to 77% with payload compression. Our approach outperforms DNS over HTTPS, where classifiers always identify DNS frames based on IP addresses. The dataset is publicly available.

cs.CR↗

arXiv2026

Contrastive Learning and Correlation Clustering for Sequences of Network Telescope Data

Understanding activities of Internet scanners is challenging; it often requires identifying relationships between sources, a task for which semantic annotations are scarce. This work investigates whether semantically meaningful pairwise relationships between sequences of network flow records can be estimated by contrastive learning, without pretraining and without annotations. To this end, we propose a transformer model that embeds minimally preprocessed sequences of network flow records and train it using contrastive learning. With the similarities obtained from this model, we state a correlation clustering problem and solve it locally. Experimentally, we show: Learned similarities are higher on average for sequences originating from the same source than for sequences originating from different sources, and this property generalizes to unseen sequences of unseen sources. Moreover, correlation clustering yields clusters consistent with scanner labels. The complete source code of the algorithms and for reproducing the experiments is publicly available.

cs.LG↗

arXiv2026

Ageing Monitoring for Commercial Microcontrollers Based on Timing Windows

Microcontrollers are increasingly present in embedded deployments and dependable systems, for which malfunctions due to hardware ageing can have severe impact. The lack of deployable techniques for ageing monitoring on these devices has spread the application of guard bands to prevent timing errors due to degradation. Applying this static technique can limit performance and lead to sudden failures as devices age. In this paper, we follow a software-based self-testing approach to design monitoring of hardware degradation for microcontrollers. Deployable in the field, our technique leverages timing windows of variable lengths to determine the maximum operational frequency of the devices. We empirically validate the method on real hardware and find that it consistently detects temperature-induced degradations in maximum operating frequency of up to 13.79 % across devices for 60 °C temperature increase.

cs.AR↗

arXiv2026

LZn : Robust LoRa Frame Synchronization Under Frame Collisions and Ultra-Low SNR Conditions

LoRa has become a widely adopted wireless modulation scheme in LPWANs due to its low cost, long range, and minimal transmission power. However, collisions between frames of the same spreading factor -- common in dense LoRa deployments -- prevent conventional LoRa receivers from detecting and correctly decoding frames. Recent work has introduced methods to improve recovery, yet their detection stage degrades sharply under low signal-to-noise ratio (SNR) and high collision rates. In this work, we introduce LZn, a low-complexity synchronization scheme driven by a spectral intersection operation. Our method enables robust frame synchronization even under multiple packet overlaps or extremely low SNR conditions. We evaluate LZn on simulations and three independent, real-world LoRa datasets. LZn improves detection sensitivity by up to 10dB and increases detection probability by up to 1.54x. In real-world datasets, LZn improves decoding by 3.46x in the most challenging single-user scenario and up to 1.22x in collision scenarios compared to the second best collision-tolerant scheme (TnB). These results demonstrate that LZn substantially improves the frame recovery of LoRa receivers, while remaining compatible with real-time requirements.

cs.NI↗

arXiv2025

A Leaner and Faster Web: How CBOR Can Improve Dynamic Content Encoding in JSON and DNS over HTTPS

The Internet community has taken major efforts to decrease latency on the World Wide Web with significant improvements in accelerating content transport and in compressing static content. Less attention, however, has been dedicated to compression of dynamic content. Such content is commonly provided by JSON and DNS over HTTPS. Dynamic content objects continue to grow in size, which increases latency and fosters the digital inequality. In this paper, we propose to mitigate this increase by utilizing Concise Binary Object Representation (CBOR), a standard originally designed for the constrained Internet of Things (IoT) to restrict packet sizes and enable efficient encoding of data objects. We provide protocol design and three new data sets for the evaluation of dynamic content, DNS, and the loading of websites. Our key findings are the following: (i) Switching the data representation from JSON to CBOR reduces data by up to 80%. This size reduction can decrease loading times by up to 13.8% when downloading large objects---even in local setups. (ii) Enabling CBOR for DNS over HTTPS (DoH) and DNS over CoAP (DoC) reduces packet sizes significantly. Compressing only names combined with unpacked CBOR achieves maximum gain of 52.2%, using more complex but still lightweight Packed CBOR allows minimizing packets by up to 95.5%. Our lean decoder for name compression can fit into as little as 314 bytes of build size. Our results clearly show the potential of CBOR outside of IoT scenarios. Parts of this research have already influenced work within the IETF.

cs.NI↗

arXiv2025

Negotiating strict latency limits for dynamic real-time services in vehicular time-sensitive networks

Future vehicles are expected to dynamically deploy in-vehicle applications within a Service-Oriented Architecture (SOA) while critical services continue to operate under hard real-time constraints. Time-Sensitive Networking (TSN) on the in-vehicle Ethernet layer is dedicated to ensure deterministic communication between critical services; its Credit-Based Shaper (CBS) supports dynamic resource reservations. However, the dynamic nature of service deployment challenges network resource configuration, since any new reservation may change the latency of already validated flows. Standard methods of worst-case latency analysis for CBS have been found incorrect, and current TSN stream reservation procedures lack mechanisms to signal application layer Quality-of-Service (QoS) requirements or verify deadlines. In this paper, we propose and validate a QoS negotiation scheme that interacts with the TSN network controller to reserve resources while ensuring latency bounds. For the first time, this work comparatively evaluates reservation schemes using worst-case analysis and simulations of a realistic In-Vehicle Network (IVN) and demonstrates their impact on QoS guarantees, resource utilization, and setup times. We find that only one reservation scheme utilizing per-queue delay budgets and network calculus provides valid configurations and guarantees acceptable latency bounds throughout the IVN. The proposed service negotiation mechanism efficiently establishes 450 vehicular network reservations in just 11ms.

cs.NI↗

arXiv2025

Scanning the IPv6 Internet Using Subnet-Router Anycast Probing

Identifying active IPv6 addresses is challenging. Various methods emerged to master the measurement challenge in this huge address space, including hitlists, new probing techniques, and AI-generated target lists. In this paper, we apply active Subnet-Router anycast (SRA) probing, a commonly unused method to explore the IPv6 address space. We compare our results with lists of active IPv6 nodes obtained from prior methods and with random probing. Our findings indicate that probing an SRA address reveals on average 10% more router IP addresses than random probing and is far less affected by ICMP rate limiting. Compared to targeting router addresses directly, SRA probing discovers 80% more addresses. We conclude that SRA probing is an important addition to the IPv6 measurement toolbox and may improve the stability of results significantly. We also find evidence that some active scans can cause harmful conditions in current IPv6 deployments, which we started to fix in collaboration with network operators.

cs.NI↗

arXiv2025

Waiting for QUIC: Passive Measurements to Understand QUIC Deployments

QUIC experiences a rapid adoption since its standardization in 2021, and hypergiants configure their infrastructure to optimize for QUIC performance. In this paper, we introduce a passive measurement method to study both the progressive rollout and individual hypergiant configurations during the last five years. By analyzing backscatter traffic of the UCSD network telescope, we are able to make the following observations. First, Meta, Google, and Cloudflare configure significantly different maximal retransmission numbers and timeouts. Second, we can identify different off-net deployments of hypergiants, using packet features, such as QUIC connection IDs, packet coalescence, and packet lengths. Third, we observe changing hypergiant deployment configurations during our different measurement periods. Fourth, connection IDs can allow further insights into load balancer deployments, such as the number of servers. We bolster our results using two orthogonal measurements: passive recording of QUIC flows and active probing.

cs.NI↗

arXiv2025

Forward to Hell? On the Potentials of Misusing Transparent DNS Forwarders in Reflective Amplification Attacks

The DNS infrastructure is infamous for facilitating reflective amplification attacks. Various countermeasures such as server shielding, access control, rate limiting, and protocol restrictions have been implemented. Still, the threat remains throughout the deployment of DNS servers. In this paper, we report on and evaluate the often unnoticed threat that derives from transparent DNS forwarders, a widely deployed, incompletely functional set of DNS components. Transparent DNS forwarders transfer DNS requests without rebuilding packets with correct source addresses. As such, transparent forwarders feed DNS requests into (mainly powerful and anycasted) open recursive resolvers, which thereby can be misused to participate unwillingly in distributed reflective amplification attacks. We show how transparent forwarders raise severe threats to the Internet infrastructure. They easily circumvent rate limiting and achieve an additional, scalable impact via the DNS anycast infrastructure. We empirically verify this scaling behavior up to a factor of 14. Transparent forwarders can also assist in bypassing firewall rules that protect recursive resolvers, making these shielded infrastructure entities part of the global DNS attack surface.

cs.CR↗

arXiv2025

A Detailed Measurement View on IPv6 Scanners and Their Adaption to BGP Signals

Scanners are daily visitors of public IPv4 hosts. Scanning IPv6 nodes successfully is still a challenge, which an increasing crowd of actors tries to master. In this paper, we analyze current IPv6 scanning under various network conditions. We observe scanner behavior during eleven months in four network telescopes, one of which is periodically reconfigured by changing BGP announcements. We analyze and classify the observed scanners w.r.t. their temporal behavior, their target, and network selection strategy, as well as their individual tools, fingerprints, and correlations across categories. We find that silent subnets of larger prefixes remain invisible, whereas BGP prefix announcements quickly attract attention by scanners. Based on our findings, we derive operational guidance on how to deploy network telescopes to increase visibility of IPv6 scanners.

cs.NI↗

arXiv2025

Duty-Cycling is Not Enough in Constrained IoT Networking: Revealing the Energy Savings of Dynamic Clock Scaling

Minimizing energy consumption of low-power wireless nodes is a persistent challenge from the constrained Internet of Things (IoT). In this paper, we start from the observation that constrained IoT devices have largely different hardware (im-)balances than full-scale machines. We find that the performance gap between MCU and network throughput on constrained devices enables minimal energy delay product (EDP) for IoT networking at largely reduced clock frequencies. We analyze the potentials by integrating dynamic voltage and frequency scaling (DVFS) into the RIOT IoT operating system and show that the DVFS reconfiguration overhead stays below the energy saved for a single, downscaled MAC operation. Backed by these findings, we systematically investigate how DVFS further improves energy-efficiency for common networking tasks -- in addition to duty-cycling. We measure IoT communication scenarios between real-world systems and analyze two MAC operating modes -- CSMA/CA and time slotting -- in combination with different CoAP transactions, payload sizes, as well as DTLS transport encryption. Our experiments reveal energy savings between 24% and 52% for MAC operations and up to 37% for encrypted CoAP communication. These results shall encourage research and system design work to integrate DVFS in future IoT devices for performing tasks at their optimal frequencies and thereby significantly extending battery lifetimes.

cs.NI↗

arXiv2025

Building Automotive Security on Internet Standards: An Integration of DNSSEC, DANE, and DANCE to Authenticate and Authorize In-Car Services

The automotive industry is undergoing a software-as-a-service transformation that enables software-defined functions and post-sale updates via cloud and vehicle-to-everything communication. Connectivity in cars introduces significant security challenges, as remote attacks on vehicles have become increasingly prevalent. Current automotive designs call for security solutions that address the entire lifetime of a vehicle. In this paper, we propose to authenticate and authorize in-vehicle services by integrating DNSSEC, DANE, and DANCE with automotive middleware. Our approach decouples the cryptographic authentication of the service from that of the service deployment with the help of DNSSEC and thereby largely simplifies key management. We propose to authenticate in-vehicle services by certificates that are solely generated by the service suppliers but published on deployment via DNSSEC TLSA records solely signed by the OEM. Building on well-established Internet standards ensures interoperability with various current and future protocols, scalable management of credentials for millions of connected vehicles at well-established security levels. We back our design proposal by a security analysis using the STRIDE threat model and by evaluations in a realistic in-vehicle setup that demonstrate its effectiveness.

cs.CR↗

arXiv2025

CoRa: A Collision-Resistant LoRa Symbol Detector of Low Complexity

Long range communication with LoRa has become popular as it avoids the complexity of multi-hop communication at low cost and low energy consumption. LoRa is openly accessible, but its packets are particularly vulnerable to collisions due to long time on air in a shared band. This degrades communication performance. Existing techniques for demodulating LoRa symbols under collisions face challenges such as high computational complexity, reliance on accurate symbol boundary information, or error-prone peak detection methods. In this paper, we introduce CoRa , a symbol detector for demodulating LoRa symbols under severe collisions. CoRa employs a Bayesian classifier to accurately identify the true symbol amidst interference from other LoRa transmissions, leveraging empirically derived features from raw symbol data. Evaluations using real-world and simulated packet traces demonstrate that CoRa clearly outperforms the related state-of-the-art, i.e., up to 29% better decoding performance than TnB and 178% better than CIC. Compared to the LoRa baseline demodulator, CoRa magnifies the packet reception rate by up to 11.53x. CoRa offers a significant reduction in computational complexity compared to existing solutions by only adding a constant overhead to the baseline demodulator, while also eliminating the need for peak detection and accurately identifying colliding frames.

cs.NI↗

arXiv2025

Asynchronous Traffic Shaping and Redundancy: Avoiding Unbounded Latencies in In-Car Networks

Time-Sensitive Networking enhances Ethernet-based In-Vehicle Networks (IVNs) with real-time capabilities. Different traffic shaping algorithms have been proposed for time-critical communication, of which the Asynchronous Traffic Shaper (ATS) is an upcoming candidate. However, recent research has shown that ATS can introduce unbounded latencies when shaping traffic from non-FIFO systems. This impacts the applicability of ATS in IVNs, as these networks often use redundancy mechanisms, i.e. Frame Replication and Elimination for Reliability (FRER), that can cause non-FIFO behavior. In this paper, we approach the problem of accumulated delays from ATS by analyzing the scenarios that generate latency and by devising placement and configuration methods for ATS schedulers to prevent this behavior. We evaluate our approach in a simulation environment and show how it prevents conditions of unbounded delays. In an IVN simulation case study, we demonstrate the occurrence of unbounded latencies in a realistic scenario and validate the effectiveness of our solutions in avoiding them.

cs.NI↗

arXiv2025

Combating the Effects of Cyber-Psychosis: Using Object Security to Facilitate Critical Thinking

Humanity is currently facing an existential crisis about the nature of truth and reality driven by the availability of information online which overloads and overwhelms our cognitive capabilities, which we call Cyber-Psychosis. The results of this Cyber-Psychosis include the decline of critical thinking coupled with deceptive influences on the Internet which have become so prolific that they are challenging our ability to form a shared understanding of reality in either the digital or physical world. Fundamental to mending our fractured digital universe is establishing the ability to know where a digital object (i.e. a piece of information like text, audio, or video) came from, whether it was modified, what it is derived from, where it has been circulated, and what (if any) lifetime that information should have. Furthermore, we argue that on-by-default object security for genuine objects will provide the necessary grounding to support critical thinking and rational online behavior, even with the ubiquity of deceptive content. To this end, we propose that the Internet needs an object security service layer. This proposition may not be as distant as it may first seem. Through an examination of several venerable (and new) protocols, we show how pieces of this problem have already been addressed. While interdisciplinary research will be key to properly crafting the architectural changes needed, here we propose an approach for how we can already use fallow protections to begin turning the tide of this emerging Cyber-Psychosis today!

cs.HC↗

arXiv2024

Switching Frequency as FPGA Monitor: Studying Degradation and Ageing Prognosis at Large Scale

The growing deployment of unhardened embedded devices in critical systems demands the monitoring of hardware ageing as part of predictive maintenance. In this paper, we study degradation on a large deployment of 298 naturally aged FPGAs operating in the European XFEL particle accelerator. We base our statistical analyses on 280 days of in-field measurements and find a generalized and continuous degradation of the switching frequency across all devices with a median value of 0.064%. The large scale of this study allows us to localize areas of the deployed FPGAs that are highly impacted by degradation. Moreover, by training machine learning models on the collected data, we are able to forecast future trends of frequency degradation with horizons of 60 days and relative errors as little as 0.002% over an evaluation period of 100 days.

cs.AR↗

arXiv2024

A Call to Reconsider Certification Authority Authorization (CAA)

Certification Authority Authentication (CAA) is a safeguard against illegitimate certificate issuance. We show how shortcomings in CAA concepts and operational aspects undermine its effectiveness in preventing certificate misissuance. Our discussion reveals pitfalls and highlights best practices when designing security protocols based on DNS.

cs.CR↗

arXiv2024

ReACKed QUICer: Measuring the Performance of Instant Acknowledgments in QUIC Handshakes

In this paper, we present a detailed performance analysis of QUIC instant ACK, a standard-compliant approach to reduce waiting times during the QUIC connection setup in common CDN deployments. To understand the root causes of the performance properties, we combine numerical analysis and the emulation of eight QUIC implementations using the QUIC Interop Runner. Our experiments comprehensively cover packet loss and non-loss scenarios, different round trip times, and TLS certificate sizes. To clarify instant ACK deployments in the wild, we conduct active measurements of 1M popular domain names. For almost all domain names under control of Cloudflare, Cloudflare uses instant ACK, which in fact improves performance. We also find, however, that instant ACK may lead to unnecessary retransmissions or longer waiting times under some network conditions, raising awareness of drawbacks of instant ACK in the future.

cs.NI↗