VoteGeo: An IoTbased Voting Approach to Verify the Geographic Location of Cloud Hosts We propose VoteGeo, an IoTbased voting approach, to verify the geographic location of the cloud hosts in moderately connected networks, where the correlation between the network delay and the distance is weak. We motive our work by showing that: 1) existing solutions, based on endtoend delay measurement from a group of landmarks with known locations, are only workable when the relationship between the delay and the distance is strong, and 2) such landmarkbased schemes are limited by landmark distribution and deployment costs. In our scheme, to enhance the verification accuracy, we develop a votebased closestshortest approach to determine the location of the target cloud host, which utilizes the adjacent landmarks with the shortest delays. In order to reduce deployment costs, we adopt random IoT devices (i.e., IP cameras) as landmarks, which are widely distributed and considerable. To reduce the measurement cost, we design a twolevel probing method to determine the geographic location of the target cloud hosts step by step, eventually to the citylevel. We introduce a delay threshold method, which does not rely on the IP address of the target cloud hosts, to defend against the middleboxbypass attacks and the delay attacks (i.e., delayshortening attacks and delayadding attacks). The evaluation results show that VoteGeo outperforms existing schemes such as GeoGet 1 and CBG 2.

Towards Trusted and Efficient SDN Topology Discovery: A Lightweight Topology Verification Scheme Abstract   Discovering network topology is critical for Softwaredefined Networking (SDN) controllers to establish the centralized network visibility. However, during the process of SDN topology discovery, SDN controllers tend to suffer from the topology poisoning attacks due to a lack of authentication. Existing methods can hardly solve the problems of SDN topology poisoning attacks in a comprehensive and lightweight manner. To fill this gap, we propose TrustTopo, a lightweight and efficient SDN topology verification scheme. Specifically, we first establish a security threat model to analyze key service vulnerabilities in the SDN controller. Then, we design two verification strategies (i.e., host location verification and link verification) to cope with the host hijacking attack and link fabrication attack, respectively. In more detail, our host location verification strategy is based on the path tracking and asynchronous rollback technique, while our link verification strategy is designed using the chaotic model and dynamic password generation technique. We implement TrustTopo in the mainstream SDN controller (i.e., Floodlight). Experimental results in the Mininet virtual network environment show that TrustTopo can effectively secure the network topology against the representative topology poisoning attacks, while bringing negligible runtime overhead.