arXiv subjects

Vireshwar Kumar

Publications and source records attributed to Vireshwar Kumar.

5 recordsLinked to original sources

arXiv2026

SoK: Kicking CAN Down the Road. Systematizing CAN Security Knowledge

For decades, the Controller Area Network (CAN) has served as the primary in-vehicle bus (IVB), extending its use to many non-vehicular systems. In recent years, CAN security has been intensively scrutinized, yielding extensive research literature. Despite its wealth, the literature lacks structured systematization, complicating efforts to assess and compare attack severity, defense efficacy, security gaps, and root causes. This leaves many defenders uncertain about the relevance of specific attacks or defenses to their systems, and even whether CAN's security problems are truly CAN-specific. As newer IVBs emerge, this matters beyond CAN: if CAN's root causes are not CAN-specific, replacing CAN may only move its problems to a new standard. In this paper, we systematize CAN security knowledge, presenting a comprehensive taxonomy and assessment models of attackers, attacks, and defenses. We identify replicable attacks and defense gaps, and investigate their root causes to determine their exclusivity to the CAN standard. We then investigate whether those root causes appear in three emerging IVBs and assess their effectiveness in solving fundamental CAN security problems. Our findings challenge common perceptions: CAN is more securable than perceived, most of its insecurity root causes are shared across IVBs, and merely adopting newer IVB technology does not solve persistent security problems. We conclude by suggesting that securing future in-vehicle communication requires addressing shared root causes, and we propose four research directions with the most promising potential.

cs.CR↗

arXiv2025

Unfolding Challenges in Securing and Regulating Unmanned Air Vehicles

Unmanned Aerial Vehicles (UAVs) or drones are being introduced in a wide range of commercial applications. This has also made them prime targets of attackers who compromise their fundamental security properties, including confidentiality, integrity, and availability. As researchers discover novel threat vectors in UAVs, the government and industry are increasingly concerned about their limited ability to secure and regulate UAVs and their usage. With the aim of unfolding a path for a large-scale commercial UAV network deployment, we conduct a comprehensive state-of-the-art study and examine the prevailing security challenges. Unlike the prior art, we focus on uncovering the research gaps that must be addressed to enforce security policy regulations in civilian off-the-shelf drone systems. To that end, we first examine the known security threats to UAVs based on their impact and effectiveness. We then analyze existing countermeasures to prevent, detect, and respond to these threats in terms of security and performance overhead. We further outline the future research directions for securing UAVs. Finally, we establish the fundamental requirements and highlight critical research challenges in introducing a regulatory entity to achieve a secure and regulated UAV network.

cs.CR↗

arXiv2025

WhiteLie: A Robust System for Spoofing User Data in Android Platforms

Android employs a permission framework that empowers users to either accept or deny sharing their private data (for example, location) with an app. However, many apps tend to crash when they are denied permission, leaving users no choice but to allow access to their data in order to use the app. In this paper, we introduce a comprehensive and robust user data spoofing system, WhiteLie, that can spoof a variety of user data and feed it to target apps. Additionally, it detects privacy-violating behaviours, automatically responding by supplying spoofed data instead of the user's real data, without crashing or disrupting the apps. Unlike prior approaches, WhiteLie requires neither device rooting nor altering the app's binary, making it deployable on stock Android devices. Through experiments on more than 70 popular Android apps, we demonstrate that WhiteLie is able to deceive apps into accepting spoofed data without getting detected. Our evaluation further demonstrates that WhiteLie introduces negligible overhead in terms of battery usage, CPU consumption, and app execution latency. Our findings underscore the feasibility of implementing user-centric privacy-enhancing mechanisms within the existing Android ecosystem.

cs.CR↗

arXiv2020

Cumulative Message Authentication Codes for Resource-Constrained IoT Networks

In resource-constrained IoT networks, the use of conventional message authentication codes (MACs) to provide message authentication and integrity is not possible due to the large size of the MAC output. A straightforward yet naive solution to this problem is to employ a truncated MAC which undesirably sacrifices cryptographic strength in exchange for reduced communication overhead. In this paper, we address this problem by proposing a novel approach for message authentication called \textit{Cumulative Message Authentication Code} (CuMAC), which consists of two distinctive procedures: \textit{aggregation} and \textit{accumulation}. In aggregation, a sender generates compact authentication tags from segments of multiple MACs by using a systematic encoding procedure. In accumulation, a receiver accumulates the cryptographic strength of the underlying MAC by collecting and verifying the authentication tags. Embodied with these two procedures, CuMAC enables the receiver to achieve an advantageous trade-off between the cryptographic strength and the latency in processing of the authentication tags. Furthermore, for some latency-sensitive messages where this trade-off may be unacceptable, we propose a variant of CuMAC that we refer to as \textit{CuMAC with Speculation} (CuMAC/S). In addition to the aggregation and accumulation procedures, CuMAC/S enables the sender and receiver to employ a speculation procedure for predicting future message values and pre-computing the corresponding MAC segments. For the messages which can be reliably speculated, CuMAC/S significantly reduces the MAC verification latency without compromising the cryptographic strength. We have carried out comprehensive evaluation of CuMAC and CuMAC/S through simulation and a prototype implementation on a real car.

cs.CR↗

arXiv2011

Achievable Secrecy Sum-Rate in a Fading MAC-WT with Power Control and without CSI of Eavesdropper

We consider a two user fading Multiple Access Channel with a wire-tapper (MAC-WT) where the transmitter has the channel state information (CSI) to the intended receiver but not to the eavesdropper (eve). We provide an achievable secrecy sum-rate with optimal power control. We next provide a secrecy sum-rate with optimal power control and cooperative jamming (CJ). We then study an achievable secrecy sum rate by employing an ON/OFF power control scheme which is more easily computable. We also employ CJ over this power control scheme. Results show that CJ boosts the secrecy sum-rate significantly even if we do not know the CSI of the eve's channel. At high SNR, the secrecy sum-rate (with CJ) without CSI of the eve exceeds the secrecy sum-rate (without CJ) with full CSI of the eve.

cs.IT↗