arXiv subjects

Yih-Chun Hu

Publications and source records attributed to Yih-Chun Hu.

16 recordsLinked to original sources

arXiv2023

Caching-based Multicast Message Authentication in Time-critical Industrial Control Systems

Attacks against industrial control systems (ICSs) often exploit the insufficiency of authentication mechanisms. Verifying whether the received messages are intact and issued by legitimate sources can prevent malicious data/command injection by illegitimate or compromised devices. However, the key challenge is to introduce message authentication for various ICS communication models, including multicast or broadcast, with a messaging rate that can be as high as thousands of messages per second, within very stringent latency constraints. For example, certain commands for protection in smart grids must be delivered within 2 milliseconds, ruling out public-key cryptography. This paper proposes two lightweight message authentication schemes, named CMA and its multicast variant CMMA, that perform precomputation and caching to authenticate future messages. With minimal precomputation and communication overhead, C(M)MA eliminates all cryptographic operations for the source after the message is given, and all expensive cryptographic operations for the destinations after the message is received. C(M)MA considers the urgency profile (or likelihood) of a set of future messages for even faster verification of the most time-critical (or likely) messages. We demonstrate the feasibility of C(M)MA in an ICS setting based on a substation automation system in smart grids.

cs.CR↗

arXiv2022

Secure and Ultra-Reliable Provenance Recovery in Sparse Networks: Strategies and Performance Bounds

Provenance embedding algorithms are well known for tracking the footprints of information flow in wireless networks. Recently, low-latency provenance embedding algorithms have received traction in vehicular networks owing to strict deadlines on the delivery of packets. While existing low-latency provenance embedding methods focus on reducing the packet delay, they assume a complete graph on the underlying topology due to the mobility of the participating nodes. We identify that the complete graph assumption leads to sub-optimal performance in provenance recovery, especially when the vehicular network is sparse, which is usually observed outside peak-hour traffic conditions. As a result, we propose a two-part approach to design provenance embedding algorithms for sparse vehicular networks. In the first part, we propose secure and practical topology-learning strategies, whereas in the second part, we design provenance embedding algorithms that guarantee ultra-reliability by incorporating the topology knowledge at the destination during the provenance recovery process. Besides the novel idea of using topology knowledge for provenance recovery, a distinguishing feature for achieving ultra-reliability is the use of hash-chains in the packet, which trade communication-overhead of the packet with the complexity-overhead at the destination. We derive tight upper bounds on the performance of our strategies, and show that the derived bounds, when optimized with appropriate constraints, deliver design parameters that outperform existing methods. Finally, we also implement our ideas on OMNeT++ based simulation environment to show that their latency benefits indeed make them suitable for vehicular network applications.

cs.IT↗

arXiv2021

HASA-net: A non-intrusive hearing-aid speech assessment network

Without the need of a clean reference, non-intrusive speech assessment methods have caught great attention for objective evaluations. Recently, deep neural network (DNN) models have been applied to build non-intrusive speech assessment approaches and confirmed to provide promising performance. However, most DNN-based approaches are designed for normal-hearing listeners without considering hearing-loss factors. In this study, we propose a DNN-based hearing aid speech assessment network (HASA-Net), formed by a bidirectional long short-term memory (BLSTM) model, to predict speech quality and intelligibility scores simultaneously according to input speech signals and specified hearing-loss patterns. To the best of our knowledge, HASA-Net is the first work to incorporate quality and intelligibility assessments utilizing a unified DNN-based non-intrusive model for hearing aids. Experimental results show that the predicted speech quality and intelligibility scores of HASA-Net are highly correlated to two well-known intrusive hearing-aid evaluation metrics, hearing aid speech quality index (HASQI) and hearing aid speech perception index (HASPI), respectively.

eess.AS↗

arXiv2020

BlindSignedID: Mitigating Denial-of-Service Attacks on Digital Contact Tracing

Due to the recent outbreak of COVID-19, many governments suspended outdoor activities and imposed social distancing policies to prevent the transmission of SARS-CoV-2. These measures have had severe impact on the economy and peoples' daily lives. An alternative to widespread lockdowns is effective contact tracing during an outbreak's early stage. However, mathematical models suggest that epidemic control for SARS-CoV-2 transmission with manual contact tracing is implausible. To reduce the effort of contact tracing, many digital contact tracing projects (e.g., PEPP-PT, DP-3T, TCN, BlueTrace, Google/Apple Exposure Notification, and East/West Coast PACT) are being developed to supplement manual contact tracing. However, digital contact tracing has drawn scrutiny from privacy advocates, since governments or other parties may attempt to use contact tracing protocols for mass surveillance. As a result, many digital contact tracing projects build privacy-preserving mechanisms to limit the amount of privacy-sensitive information leaked by the protocol. In this paper, we examine how these architectures resist certain classes of attacks, specifically DoS attacks, and present BlindSignedIDs, a privacy-preserving digital contact tracing mechanism, which are verifiable ephemeral identifiers to limit the effectiveness of MAC-compliant DoS attacks. In our evaluations, we showed BlindSignedID can effectively deny bogus EphIDs, mitigating DoS attacks on the local storage beyond 90% of stored EphIDs. Our example DoS attacks showed that using 4 attackers can cause the gigabyte level DoS attacks within normal working hours and days.

cs.CR↗

arXiv2019

HyperService: Interoperability and Programmability Across Heterogeneous Blockchains

Blockchain interoperability, which allows state transitions across different blockchain networks, is critical functionality to facilitate major blockchain adoption. Existing interoperability protocols mostly focus on atomic token exchange between blockchains. However, as blockchains have been upgraded from passive distributed ledgers into programmable state machines (thanks to smart contracts), the scope of blockchain interoperability goes beyond just token exchange. In this paper, we present HyperService, the first platform that delivers interoperability and programmability across heterogeneous blockchains. HyperService is powered by two innovative designs: (i) a developer-facing programming framework that allows developers to build cross-chain applications in a unified programming model; and (ii) a secure blockchain-facing cryptography protocol that provably realizes those applications on blockchains. We implement a prototype of HyperService in about 35,000 lines of code to demonstrate its practicality. Our experiment results show that HyperService imposes reasonable latency, in order of seconds, on the end-to-end execution of cross-chain applications

cs.CR↗

arXiv2019

Convolution Attack on Frequency-Hopping by Full-Duplex Radios

We propose a new adversarial attack on frequency-hopping based wireless communication between two users, namely Alice and Bob. In this attack, the adversary, referred to as Eve, instantaneously modifies the transmitted signal by Alice before forwarding it to Bob within the symbol-period. We show that this attack forces Bob to incorporate Eve's signal in the decoding process; otherwise, treating it as noise would further degrade the performance akin to jamming. Through this attack, we show that Eve can convert a slow-fading channel between Alice and Bob to a rapid-fading one by modifying every transmitted symbol independently. As a result, neither pilot-assisted coherent detection techniques nor blind-detection methods are directly applicable as countermeasures. As potential mitigation strategies, we explore the applicability of frequency-hopping along with (i) On-Off keying (OOK) and (ii) Binary Frequency-Shift-Keying (FSK) as modulation schemes. In the case of OOK, the attacker attempts to introduce deep-fades on the tone carrying the information bit, whereas in the case of BFSK, the attacker pours comparable energy levels on the tones carrying bit-$0$ and bit-$1$, thereby degrading the performance. Based on extensive analyses and experimental results, we show that (i) when using OOK, Bob must be equipped with a large number of receive antennas to reliably detect Alice's signal, and (ii) when using BFSK, Alice and Bob must agree upon a secret-key to randomize the location of the tones carrying the bits, in addition to randomizing the carrier-frequency of communication.

cs.IT↗

arXiv2018

Signal Jamming Attacks Against Communication-Based Train Control: Attack Impact and Countermeasure

We study the impact of signal jamming attacks against the communication based train control (CBTC) systems and develop the countermeasures to limit the attacks' impact. CBTC supports the train operation automation and moving-block signaling, which improves the transport efficiency. We consider an attacker jamming the wireless communication between the trains or the train to wayside access point, which can disable CBTC and the corresponding benefits. In contrast to prior work studying jamming only at the physical or link layer, we study the real impact of such attacks on end users, namely train journey time and passenger congestion. Our analysis employs a detailed model of leaky medium-based communication system (leaky waveguide or leaky feeder/coaxial cable) popularly used in CBTC systems. To counteract the jamming attacks, we develop a mitigation approach based on frequency hopping spread spectrum taking into account domain-specific structure of the leaky-medium CBTC systems. Specifically, compared with existing implementations of FHSS, we apply FHSS not only between the transmitter-receiver pair but also at the track-side repeaters. To demonstrate the feasibility of implementing this technology in CBTC systems, we develop a FHSS repeater prototype using software-defined radios on both leaky-medium and open-air (free-wave) channels. We perform extensive simulations driven by realistic running profiles of trains and real-world passenger data to provide insights into the jamming attack's impact and the effectiveness of the proposed countermeasure.

cs.CR↗

arXiv2018

CLEF: Limiting the Damage Caused by Large Flows in the Internet Core (Technical Report)

The detection of network flows that send excessive amounts of traffic is of increasing importance to enforce QoS and to counter DDoS attacks. Large-flow detection has been previously explored, but the proposed approaches can be used on high-capacity core routers only at the cost of significantly reduced accuracy, due to their otherwise too high memory and processing overhead. We propose CLEF, a new large-flow detection scheme with low memory requirements, which maintains high accuracy under the strict conditions of high-capacity core routers. We compare our scheme with previous proposals through extensive theoretical analysis, and with an evaluation based on worst-case-scenario attack traffic. We show that CLEF outperforms previously proposed systems in settings with limited memory.

cs.NI↗

arXiv2018

Fine-Grained Endpoint-Driven In-Network Traffic Control for Proactive DDoS Attack Mitigation

Volumetric attacks, which overwhelm the bandwidth of a destination, are among the most common DDoS attacks today. Despite considerable effort made by both research and industry, our recent interviews with over 100 potential DDoS victims in over 10 industry segments indicate that today's DDoS prevention is far from perfect. On one hand, few academical proposals have ever been deployed in the Internet; on the other hand, solutions offered by existing DDoS prevention vendors are not a silver bullet to defend against the entire attack spectrum. Guided by such large-scale study of today's DDoS defense, in this paper, we present MiddlePolice, the first readily deployable and proactive DDoS prevention mechanism. We carefully architect MiddlePolice such that it requires no changes from both the Internet core and the network stack of clients, yielding instant deployability in the current Internet architecture. Further, relying on our novel capability feedback mechanism, MiddlePolice is able to enforce destination-driven traffic control so that it guarantees to deliver victim-desired traffic regardless of the attacker strategies. We implement a prototype of MiddlePolice, and demonstrate its feasibility via extensive evaluations in the Internet, hardware testbed and large-scale simulations.

cs.NI↗

arXiv2018

Cognitive Radio from Hell: Flipping Attack on Direct-Sequence Spread Spectrum

In this paper, we introduce a strong adversarial attack, referred to as the flipping attack, on Direct-Sequence Spread Spectrum (DSSS) systems. In this attack, the attacker, which is appropriately positioned between the transmitter and the receiver, instantaneously flips the transmitted symbols in the air at 50% rate, thereby driving the channel capacity to zero. Unlike the traditional jamming attack, this attack, when perfectly executed, cannot be detected at the receiver using signal-to-noise-ratio measurements. However, this attack necessitates the attacker to perfectly know the realizations of all the channels in the model. We first introduce the consequences of the flipping attack on narrowband frequency-flat channels, and subsequently discuss its feasibility in wideband frequency-selective channels. From the legitimate users' perspective, we present a method to detect this attack and also propose heuristics to improve the error-performance under the attack. We emphasize that future cyber-physical systems that employ DSSS should design transceivers to detect the proposed flipping attack, and then apply appropriate countermeasures.

cs.IT↗

arXiv2018

Enabling Work-conserving Bandwidth Guarantees for Multi-tenant Datacenters via Dynamic Tenant-Queue Binding

Today's cloud networks are shared among many tenants. Bandwidth guarantees and work conservation are two key properties to ensure predictable performance for tenant applications and high network utilization for providers. Despite significant efforts, very little prior work can really achieve both properties simultaneously even some of them claimed so. In this paper, we present QShare, an in-network based solution to achieve bandwidth guarantees and work conservation simultaneously. QShare leverages weighted fair queuing on commodity switches to slice network bandwidth for tenants, and solves the challenge of queue scarcity through balanced tenant placement and dynamic tenant-queue binding. QShare is readily implementable with existing switching chips. We have implemented a QShare prototype and evaluated it via both testbed experiments and simulations. Our results show that QShare ensures bandwidth guarantees while driving network utilization to over 91% even under unpredictable traffic demands.

cs.NI↗

arXiv2017

TorPolice: Towards Enforcing Service-Defined Access Policies in Anonymous Systems

Tor is the most widely used anonymity network, currently serving millions of users each day. However, there is no access control in place for all these users, leaving the network vulnerable to botnet abuse and attacks. For example, criminals frequently use exit relays as stepping stones for attacks, causing service providers to serve CAPTCHAs to exit relay IP addresses or blacklisting them altogether, which leads to severe usability issues for legitimate Tor users. To address this problem, we propose TorPolice, the first privacy-preserving access control framework for Tor. TorPolice enables abuse-plagued service providers such as Yelp to enforce access rules to police and throttle malicious requests coming from Tor while still providing service to legitimate Tor users. Further, TorPolice equips Tor with global access control for relays, enhancing Tor's resilience to botnet abuse. We show that TorPolice preserves the privacy of Tor users, implement a prototype of TorPolice, and perform extensive evaluations to validate our design goals.

cs.CR↗

arXiv2017

Deadline-Aware Multipath Communication: An Optimization Problem

Multipath communication not only allows improved throughput but can also be used to leverage different path characteristics to best fulfill each application's objective. In particular, certain delay-sensitive applications, such as real time voice and video communications, can usually withstand packet loss and aim to maximize throughput while keeping latency at a reasonable level. In such a context, one hard problem is to determine along which path the data should be transmitted or retransmitted. In this paper, we formulate this problem as a linear optimization, show bounds on the performance that can be obtained in a multipath paradigm, and show that path diversity is a strong asset for improving network performance. We also discuss how these theoretical limits can be approached in practice and present simulation results.

cs.NI↗

arXiv2017

Insider-Attacks on Physical-Layer Group Secret-Key Generation in Wireless Networks

Physical-layer group secret-key (GSK) generation is an effective way of generating secret keys in wireless networks, wherein the nodes exploit inherent randomness in the wireless channels to generate group keys, which are subsequently applied to secure messages while broadcasting, relaying, and other network-level communications. While existing GSK protocols focus on securing the common source of randomness from external eavesdroppers, they assume that the legitimate nodes of the group are trusted. In this paper, we address insider attacks from the legitimate participants of the wireless network during the key generation process. Instead of addressing conspicuous attacks such as switching-off communication, injecting noise, or denying consensus on group keys, we introduce stealth attacks that can go undetected against state-of-the-art GSK schemes. We propose two forms of attacks, namely: (i) different-key attacks, wherein an insider attempts to generate different keys at different nodes, especially across nodes that are out of range so that they fail to recover group messages despite possessing the group key, and (ii) low-rate key attacks, wherein an insider alters the common source of randomness so as to reduce the key-rate. We also discuss various detection techniques, which are based on detecting anomalies and inconsistencies on the channel measurements at the legitimate nodes. Through simulations we show that GSK generation schemes are vulnerable to insider-threats, especially on topologies that cannot support additional secure links between neighbouring nodes to verify the attacks.

cs.IT↗

arXiv2013

A System-Theoretic Clean Slate Approach to Provably Secure Ad Hoc Wireless Networking

Traditionally, wireless network protocols have been designed for performance. Subsequently, as attacks have been identified, patches have been developed. This has resulted in an "arms race" development process of discovering vulnerabilities and then patching them. The fundamental difficulty with this approach is that other vulnerabilities may still exist. No provable security or performance guarantees can ever be provided. We develop a system-theoretic approach to security that provides a complete protocol suite with provable guarantees, as well as proof of min-max optimality with respect to any given utility function of source-destination rates. Our approach is based on a model capturing the essential features of an adhoc wireless network that has been infiltrated with hostile nodes. We consider any collection of nodes, some good and some bad, possessing specified capabilities vis-a-vis cryptography, wireless communication and clocks. The good nodes do not know the bad nodes. The bad nodes can collaborate perfectly, and are capable of any disruptive acts ranging from simply jamming to non-cooperation with the protocols in any manner they please. The protocol suite caters to the complete life-cycle, all the way from birth of nodes, through all phases of ad hoc network formation, leading to an optimized network carrying data reliably. It provably achieves the min-max of the utility function, where the max is over all protocol suites published and followed by the good nodes, while the min is over all Byzantine behaviors of the bad nodes. Under the protocol suite, the bad nodes do not benefit from any actions other than jamming or cooperating. This approach supersedes much previous work that deals with several types of attacks.

cs.NI↗

arXiv2012

Mirage: Towards Deployable DDoS Defense for Web Applications

Distributed Denial of Service (DDoS) attacks form a serious threat to the security of Internet services. However, despite over a decade of research, and the existence of several proposals to address this problem, there has been little progress to date on actual adoption. We present Mirage, a protocol that achieves comparable performance to other DDoS mitigation schemes while providing benefits when deployed only in the server's local network and its upstream ISP, where local business objectives may incentivize deployment. Mirage does not require source end hosts to install any software to access Mirage protected websites. Unlike previous proposals, Mirage only requires functionality from routers that is already deployed in today's routers, though this functionality may need to be scaled depending on the point of deployment. Our approach is that end hosts can thwart the attackers by employing the principle of a moving target: end hosts in our architecture periodically change IP addresses to keep the attackers guessing. Knowledge of an active IP address of the destination end host can act as an implicit authorization to send data. We evaluate Mirage using theoretical analysis, simulations and a prototype implementation on PlanetLab. We find that our design provides a first step towards a deployable, yet effective DDoS defense.

cs.NI↗