@incollection {2013, title = {POM: A Trust-based AHP-like Methodology to Solve Conflict Requirements for the IoT}, booktitle = {Collaborative Approaches for Cyber Security in Cyber-Physical Systems}, number = {Part of the Advanced Sciences and Technologies for Security Applications book series (ASTSA)}, year = {2023}, month = {01/2023}, pages = {145-170}, publisher = {Springer}, organization = {Springer}, keywords = {Analytic Hierarchy Process (AHP), Internet of Things (IoT), Multi Criteria Decision Analysis (MCDA), Requirements Engineering, Trust}, issn = {1613-5113}, doi = {https://doi.org/10.1007/978-3-031-16088-2_7}, url = {https://link.springer.com/chapter/10.1007/978-3-031-16088-2_7}, author = {Davide Ferraris and Carmen Fernandez-Gago and Javier Lopez} } @inproceedings {2033, title = {CCBHash (Compound Code Block Hash) para An{\'a}lisis de Malware}, booktitle = {XVII Reuni{\'o}n Espa{\~n}ola sobre Criptolog{\'\i}a y Seguridad de la Informaci{\'o}n}, year = {2022}, month = {11/2022}, pages = {168-173}, author = {Pablo P{\'e}rez Jim{\'e}nez and Jose A. Onieva and Gerardo Fernandez} } @inproceedings {1990, title = {Configuration vulnerability in SNORT for Windows operating systems}, booktitle = {2022 IEEE International Conference on Cyber Security and Resilience (IEEE CSR)}, year = {2022}, month = {08/2022}, pages = {82-89}, publisher = {IEEE}, organization = {IEEE}, address = {https://www.ieee-csr.org}, abstract = {

Cyber-attacks against Industrial Control Systems (ICS) can lead to catastrophic events which can be prevented by the use of security measures such as the Intrusion Prevention Systems (IPS). In this work we experimentally demonstrate how to exploit the configuration vulnerabilities of SNORT one of the most adopted IPSs to significantly degrade the effectiveness of the IPS and consequently allowing successful cyber-attacks. We illustrate how to design a batch script able to retrieve and modify the configuration files of SNORT in order to disable its ability to detect and block Denial of Service (DoS) and ARP poisoning-based Man-In-The-Middle (MITM) attacks against a Programmable Logic Controller (PLC) in an ICS network. Experimental tests performed on a water distribution testbed show that, despite the presence of IPS, the DoS and ARP spoofed packets reach the destination causing respectively the disconnection of the PLC from the ICS network and the modification of packets payload.

}, isbn = {978-1-6654-9952-1}, doi = {https://doi.org/10.1109/CSR54599.2022.9850309}, url = {https://ieeexplore.ieee.org/document/9850309}, author = {Luca Faramondi and Marta Grassi and Simone Guarino and Roberto Setola and Cristina Alcaraz} } @inproceedings {1980, title = {Novel Approaches for the Development of Trusted IoT Entities}, booktitle = {37th International Conference on ICT Systems Security and Privacy Protection {\textendash} IFIP SEC 2022}, year = {2022}, month = {06/2022}, pages = {215-230}, publisher = {Springer}, organization = {Springer}, address = {Copenhagen}, keywords = {Internet of Things (IoT), SysML, System Development Life Cycle (SDLC)., Trust, UML}, issn = {1868-4238 }, doi = {https://doi.org/10.1007/978-3-031-06975-8}, url = {https://link.springer.com/content/pdf/10.1007\%2F978-3-031-06975-8_13}, author = {Davide Ferraris and Carmen Fernandez-Gago and Javier Lopez} } @article {munoz2022, title = {A Test Environment for Wireless Hacking in Domestic IoT Scenarios}, journal = {Mobile Networks and Applications}, year = {2022}, month = {2022/10/14}, publisher = {Springer}, keywords = {Domestic security, Hacking the IoT, IoT security, Network Security}, issn = {1383-469X}, doi = {10.1007/s11036-022-02046-x}, url = {https://doi.org/10.1007/s11036-022-02046-x}, author = {Mu{\~n}oz, Antonio and Carmen Fernandez-Gago and Roberto Lopez-villa} } @article {Flamini2022, title = {Towards Trustworthy Autonomous Systems: Taxonomies and Future Perspectives}, journal = {IEEE Transactions on Emerging Topics in Computing}, year = {2022}, publisher = {IEEE}, abstract = {

The class of Trustworthy Autonomous Systems (TAS) includes cyber-physical systems leveraging on self-x technologies that make them capable to learn, adapt to changes, and reason under uncertainties in possibly critical applications and evolving environments. In the last decade, there has been a growing interest in enabling artificial intelligence technologies, such as advanced machine learning, new threats, such as adversarial attacks, and certification challenges, due to the lack of sufficient explainability. However, in order to be trustworthy, those systems also need to be dependable, secure, and resilient according to well-established taxonomies, methodologies, and tools. Therefore, several aspects need to be addressed for TAS, ranging from proper taxonomic classification to the identification of research opportunities and challenges. Given such a context, in this paper address relevant taxonomies and research perspectives in the field of TAS. We start from basic definitions and move towards future perspectives, regulations, and emerging technologies supporting development and operation of TAS.

}, keywords = {Arti cial Intelligence, Cyber- Resilience, Cybersecurity, Dependability, Intelligent Systems, Trustworthy Autonomous Systems}, issn = {2168-6750}, doi = {https://doi.org/10.1109/TETC.2022.3227113}, url = {https://ieeexplore.ieee.org/abstract/document/9979717/authors$\#$authors}, author = {Francesco Flammini and Cristina Alcaraz and Emanuele Bellini and Stefano Marrone and Javier Lopez and Andrea Bondavalli} } @inproceedings {1981, title = {Verification and Validation Methods for a Trust-by-Design Framework for the IoT}, booktitle = {36th Annual IFIP WG 11.3 Conference on Data and Applications Security and Privacy (DBSec{\textquoteright}22)}, volume = {13383}, year = {2022}, month = {07/2022}, pages = {183-194}, publisher = {Springer}, organization = {Springer}, address = {Newark, NJ, USA}, keywords = {Internet of Things (IoT), SysML, System Development Life Cycle (SDLC), Trust, UML}, isbn = {978-3-031-10683-5}, doi = {https://doi.org/10.1007/978-3-031-10684-2_11}, url = {https://link.springer.com/chapter/10.1007/978-3-031-10684-2_11}, author = {Davide Ferraris and Carmen Fernandez-Gago and Javier Lopez} } @article {anto2021, title = {P2ISE: Preserving Project Integrity in CI/CD Based on Secure Elements}, journal = {Information}, volume = {12}, number = {357}, year = {2021}, month = {08/2021}, publisher = {MDPI}, issn = {2078-2489,}, author = {Mu{\~n}oz, Antonio and Farao, Aristeidis and Casas, Ryan and Xenakis, Christos} } @article {Alcaraz2021a, title = {Stakeholder Perspectives and Requirements on Cybersecurity in Europe}, journal = {Journal of Information Security and Applications}, volume = {61}, number = {102916}, year = {2021}, month = {09/2021}, publisher = {Elsevier}, keywords = {Cybersecurity, Requirements, Roadmap, Stakeholder engagement. Research \& innovation}, issn = {2214-2126}, doi = {https://doi.org/10.1016/j.jisa.2021.102916}, url = {https://www.sciencedirect.com/science/article/pii/S2214212621001381}, author = {Simone Fischer-H{\"u}bner and Cristina Alcaraz and Afonso Ferreira and Carmen Fernandez-Gago and Javier Lopez and Evangelos Markatos and Lejla Islami and Mahdi Akil} } @inproceedings {munoz2020icitpm, title = {ICITPM: Integrity validation of software in iterative Continuous Integration through the use of Trusted Platform Module (TPM)}, booktitle = {1st Workshop on Dependability and Safety Emerging Cloud and Fog Systems (DeSECSyS) - Colocated with ESORICS, Guildford (United Kingdom). September 2020.}, year = {2020}, pages = {147{\textendash}165}, publisher = {Springer}, organization = {Springer}, author = {Mu{\~n}oz, Antonio}, editor = {Farao, Aristeidis} } @inproceedings {1852, title = {A Model Specification Implementation for Trust Negotiation}, booktitle = {The 14th International Conference on Network and System Security (NSS 2020)}, volume = {12570}, year = {2020}, month = {11/2020}, pages = {327-341}, publisher = {Springer}, organization = {Springer}, address = {Melbourne, Australia}, abstract = {

Trust negotiation represents a suitable approach for building trust in online environments, where the interacting entities are anonymous. It covers important criteria on security and privacy. In this work, we propose a method for implementing our model specification that handles trust negotiation. We define the structure of the trust negotiation module that is a standalone unit capable of negotiating on its own. It may be included to any software by its defined interfaces. We realise our method with a ride-sharing scenario and four trust negotiation strategies that we apply in order to validate our design and implementation. We propose a solution that is fully customisable based on different requirements. The proposal provides guidelines for developers in the process of including trust negotiation into their software.

}, keywords = {Software Development Life Cycle, Trust, Trust Negotiation}, author = {Martin Kolar and Carmen Fernandez-Gago and Javier Lopez} } @article {ferraris2020b, title = {A model-driven approach to ensure trust in the IoT}, journal = {Human-centric Computing and Information Sciences}, volume = {10}, number = {50}, year = {2020}, month = {12/2020}, publisher = {Springer}, abstract = {

The Internet of Things (IoT) is a paradigm that permits smart entities to be interconnected anywhere and anyhow. IoT opens new opportunities but also rises new issues.
In this dynamic environment, trust is useful to mitigate these issues. In fact, it is important that the smart entities could know and trust the other smart entities in order to collaborate with them.
So far, there is a lack of research when considering trust through the whole System Development Life Cycle (SDLC) of a smart IoT entity.
In this paper, we suggest a new approach that considers trust not only at the end of the SDLC but also at the start of it. More precisely, we explore the modeling phase proposing a model-driven approach extending UML and SysML considering trust and its related domains, such as security and privacy.
We propose stereotypes for each diagram in order to give developers a way to represent trust elements in an effective way.
Moreover, we propose two new diagrams that are very important for the IoT: a traceability diagram and a context diagram.
This model-driven approach will help developers to model the smart IoT entities according to the requirements elicited in the previous phases of the SDLC.
These models will be a fundamental input for the following and final phases of the SDLC.

}, keywords = {Internet of Things (IoT), SysML, System Development Life Cycle (SDLC), Trust, UML}, issn = {2192-1962 }, doi = {10.1186/s13673-020-00257-3}, author = {Davide Ferraris and Carmen Fernandez-Gago and Javier Lopez} } @article {ferraris2020, title = {A Trust Model for Popular Smart Home Devices}, journal = {International Journal of Information Security}, year = {2020}, publisher = {Springer}, abstract = {

Nowadays, smart home devices like Amazon Echo and Google Home have reached mainstream popularity.
Being in the homes of users, these devices are intrinsically intrusive, being able to access details such as users{\textquoteright} name, gender, home address, calendar appointments and others.
There are growing concerns about indiscriminate data collection and invasion of user privacy in smart home devices, but studies show that perceived benefits are exceeding perceived risks when it comes to consumers.
As a result, consumers are placing a lot of trust in these devices, sometimes without realizing it.
Improper trust assumptions and security controls can lead to unauthorized access and control of the devices, which can result in serious consequences.
In this paper, we explore the behaviour of devices such as Amazon Echo and Google Home in a smart home setting with respect to trust relationships and propose a trust model to improve these relationships among all the involved actors.
We have evaluated how trust was built and managed from the initial set up phase to the normal operation phase, during which we performed a number of interaction tests with different types of users (i.e. owner, guests).
As a result, we were able to assess the effectiveness of the provided security controls and identify potential relevant security issues.\  In order to address the identified issues, we defined a trust model and propose a solution based on it for further securing smart home systems.

}, keywords = {Internet of Things, privacy, security, Smart Home, Trust}, issn = {1615-5262}, doi = {10.1007/s10207-020-00519-2}, url = {https://link.springer.com/article/10.1007/s10207-020-00519-2}, author = {Davide Ferraris and Daniel Bastos and Carmen Fernandez-Gago and Fadi El-Moussa} } @inproceedings {1814, title = {An Analysis of Trust in Smart Home Devices}, booktitle = {The 20th World Conference on Information Security Applications: WISA-Workshop 2019}, year = {2019}, publisher = {Springer}, organization = {Springer}, address = {Jeju Island, Korea}, abstract = {

In recent times, smart home devices like Amazon Echo and Google Home have reached mainstream popularity. These devices are intrinsically intrusive, being able to access user{\textquoteright}s personal information. There are growing concerns about indiscriminate data collection and invasion of user privacy in smart home devices. Improper trust assumptions and security controls can lead to unauthorized access of the devices, which can have severe consequences (i.e. safety risks). In this paper, we analysed the behaviour of smart home devices with respect to trust relationships. We set up a smart home environment to evaluate how trust is built and managed. Then, we performed a number of interaction tests with different types of users (i.e. owner, guests). As a result, we were able to assess the effectiveness of the provided security controls and identify some relevant security issues. To address them, we defined a trust model and proposed a solution based on it for securing smart home devices.

}, keywords = {Internet of Things (IoT), security, Smart Home., Trust}, author = {Davide Ferraris and Daniel Bastos and Carmen Fernandez-Gago and Fadi El-Moussa and Javier Lopez} } @article {kolar2019trust, title = {A Model Specification for the Design of Trust Negotiations}, journal = {Computers \& Security}, volume = {84}, year = {2019}, month = {04/2019}, pages = {288-300}, publisher = {Elsevier}, type = {Full article}, abstract = {

Trust negotiation is a type of trust management model for establishing trust between entities by a mutual exchange of credentials. This approach was designed for online environments, where the attributes of users, such as skills, habits, behaviour and experience are unknown. Required criteria of trust negotiation must be supported by a trust negotiation model in order to provide a functional, adequately robust and efficient application. Such criteria were identified previously. In this paper we are presenting a model specification using a UML-based notation for the design of trust negotiation. This specification will become a part of the Software Development Life Cycle, which will provide developers a strong tool for incorporating trust and trust-related issues into the software they create. The specification defines components and their layout for the provision of the essential functionality of trust negotiation on one side as well as optional, additional features on the other side. The extra features make trust negotiation more robust, applicable for more scenarios and may provide a privacy protection functionality.

}, keywords = {Policy, Software Development Life Cycle, Trust Model, Trust Negotiation, UML}, issn = {0167-4048}, doi = {10.1016/j.cose.2019.03.024}, url = {https://www.sciencedirect.com/science/article/pii/S0167404818310484}, author = {Martin Kolar and Carmen Fernandez-Gago and Javier Lopez} } @inproceedings {1815, title = {SealedGRID: A Secure Interconnection of Technologies for Smart Grid Applications}, booktitle = {14th International Conference on Critical Information Infrastructures Security (CRITIS 2019)}, volume = {11777}, year = {2019}, month = {12/2019}, pages = {169-175}, publisher = {Springer, Cham}, organization = {Springer, Cham}, abstract = {

In recent years, the Smart Grid has increasingly integrated cutting-edge technologies that generate several benefits for all the stakeholders involved, such as a more accurate billing system and enhanced Demand Response procedures. However, this modernization also brings with it diverse cyber security and privacy issues, which sets the necessity for developing a security platform specifically tailored to this scenario. In this paper, we present SealedGRID, which proposes a flexible architecture that provides security services at all levels by implementing Trusted Execution Environments on their devices, together with advanced authentication and authorization mechanisms, as well as privacy preserving techniques. These technologies are presented in depth and a final security analysis is conducted, which highlights the contributions of this project.

}, isbn = {978-3-030-37669-7}, doi = {https://doi.org/10.1007/978-3-030-37670-3_14}, author = {Aristeidis Farao and Juan E. Rubio and Cristina Alcaraz and Christoforos Ntantogian and Christos Xenakis and Javier Lopez} } @inproceedings {1780, title = {A Segregated Architecture for a Trust-based Network of Internet of Things}, booktitle = {IEEE Consumer Communications \& Networking Conference 2019}, year = {2019}, month = {03/2019}, publisher = {IEEE}, organization = {IEEE}, address = {Las Vegas (USA)}, abstract = {

With the ever-increasing number of smart home devices, the issues related to these environments are also growing. With an ever-growing attack surface, there is no standard way to protect homes and their inhabitants from new threats. The inhabitants are rarely aware of the increased security threats that they are exposed to and how to manage them. To tackle this problem, we propose a solution based on segmented architectures similar to the ones used in industrial systems. In this approach, the smart home is segmented into various levels, which can broadly be categorised into an inner level and external level. The external level is protected by a firewall that checks the communication from/to the Internet to/from the external devices. The internal level is protected by an additional firewall that filters the information and the communications between the external and the internal devices. This segmentation guarantees a trusted environment between the entities belonging to the internal network. In this paper, we propose an adaptive trust model that checks the behaviour of the entities and, through this model, in case the entities violate trust rules they can be put in quarantine or banned from the network.

}, keywords = {Security; Trust; Privacy; Internet of Things (IoT); Smart Home}, doi = {10.1109/CCNC.2019.8651703}, url = {https://ieeexplore.ieee.org/document/8651703}, author = {Davide Ferraris and Carmen Fernandez-Gago and Joshua Daniel and Javier Lopez} } @article {ferraris2019, title = {TrUStAPIS: A Trust Requirements Elicitation Method for IoT}, journal = {International Journal of Information Security }, year = {2019}, month = {01/2020}, pages = {111-127}, publisher = {Springer}, abstract = {

The Internet of Things (IoT) is an environment of interconnected entities, which are identifiable, usable and controllable via the Internet. Trust is useful for a system such as the IoT as the entities involved would like to know how the other entities they have to interact with are going to perform.
When developing an IoT entity, it will be desirable to guarantee trust during its whole life cycle. Trust domain is strongly dependent on other domains such as security and privacy.
To consider these domains as a whole and to elicit the right requirements since the first phases of the System Development Life Cycle (SDLC) is a key point when developing an IoT entity.
This paper presents a requirements elicitation method focusing on trust plus other domains such as security, privacy and usability that increase the trust level of the IoT entity developed. To help the developers to elicit the requirements, we propose a JavaScript Notation Object (JSON) template containing all the key elements that must be taken into consideration.
We emphasize on the importance of the concept of traceability. This property permits to connect all the elicited requirements guaranteeing more control on the whole requirements engineering process.

}, keywords = {Internet of Things (IoT), Requirements Engineering, System Development Life Cycle (SDLC), Trust, \\ JavaScript Notation Object (JSON)}, issn = {1615-5262}, doi = {10.1007/s10207-019-00438-x}, url = {https://link.springer.com/article/10.1007\%2Fs10207-019-00438-x}, author = {Davide Ferraris and Carmen Fernandez-Gago} } @inproceedings {1701, title = {A comprehensive methodology for deploying IoT honeypots}, booktitle = {15th International Conference on Trust, Privacy and Security in Digital Business (TrustBus 2018)}, volume = {LNCS 11033}, year = {2018}, month = {09/2018}, pages = {229{\textendash}243}, publisher = {Springer Nature Switzerland AG}, organization = {Springer Nature Switzerland AG}, address = {Regensburg (Germany)}, abstract = {

Recent news have raised concern regarding the security on the IoT field. Vulnerabilities in devices are arising and honeypots are an excellent way to cope with this problem. In this work, current solutions for honeypots in the IoT context, and other solutions adaptable to it are analyzed in order to set the basis for a methodology that allows deployment of IoT honeypot.

}, keywords = {Honeypot, IoT, methodology, security}, doi = {https://doi.org/10.1007/978-3-319-98385-1_16}, author = {Antonio Acien and Ana Nieto and Gerardo Fernandez and Javier Lopez} } @article {NAFMONET2018, title = {Crowdsourcing analysis in 5G IoT: Cybersecurity Threats and Mitigation}, journal = {Mobile Networks and Applications (MONET)}, year = {2018}, month = {10/2018}, pages = {881-889}, publisher = {Springer US}, abstract = {
Crowdsourcing can be a powerful weapon against cyberattacks in 5G networks. In this paper we analyse this idea in detail, starting from the use cases in crowdsourcing focused on security, and highlighting those areas of a 5G ecosystem where crowdsourcing could be used to mitigate local and remote attacks, as well as to discourage criminal activities and cybercriminal behaviour. We pay particular attention to the capillary network, where an infinite number of IoT objects coexist. The analysis is made considering the different participants in a 5G IoT ecosystem.
}, keywords = {5G security, Cybersecurity, digital witness, Proactive security}, issn = {1383-469X}, doi = {https://doi.org/10.1007/s11036-018-1146-4}, author = {Ana Nieto and Antonio Acien and Gerardo Fernandez} } @inproceedings {1706, title = {Definici{\'o}n de procedimientos para fabricar honeypots IoT basados en criterios de b{\'u}squeda}, booktitle = {XV Reuni{\'o}n Espa{\~n}ola sobre Criptolog{\'\i}a y Seguridad de la Informaci{\'o}n}, year = {2018}, month = {10/2018}, address = {Granada (Espa{\~n}a)}, abstract = {

Con la revoluci{\'o}n tecnol{\'o}gica que ha supuesto la Internet de las Cosas (Internet of Things, IoT) se han presentado escenarios donde la preocupaci{\'o}n por la seguridad en dicho entorno es cada vez m{\'a}s relevante. Est{\'a}n comenzando a surgir vulnerabilidades en varios dispositivos, y los sistemas trampa son una excelente manera de lidiar con este problema. En este trabajo se analizan soluciones para honeypots en el entorno IoT (y en otros que se puedan adaptar) para sentar las bases de una metodolog{\'\i}a que permita el despliegue de honeypots IoT.

}, isbn = {978-84-09-02463-6}, author = {Antonio Acien and Ana Nieto and Gerardo Fernandez and Javier Lopez} } @article {Ruben2017trust, title = {Modelling Privacy-Aware Trust Negotiations}, journal = {Computers \& Security}, volume = {77 }, year = {2018}, pages = {773-789}, publisher = {Elsevier}, abstract = {

Trust negotiations are mechanisms that enable interaction between previously unknown users. After exchanging various pieces of potentially sensitive information, the participants of a negotiation can decide whether or not to trust one another. Therefore, trust negotiations bring about threats to personal privacy if not carefully considered. This paper presents a framework for representing trust negotiations in the early phases of the Software Development Life Cycle (SDLC). The framework can help software engineers to determine the most suitable policies for the system by detecting conflicts between privacy and trust requirements. More precisely, we extend the SI* modelling language and provide a set of predicates for defining trust and privacy policies and a set of rules for describing the dynamics of the system based on the established policies. The formal representation of the model facilitates its automatic verification. The framework has been validated in a distributed social network scenario for connecting drivers with potential passengers willing to share a journey.

}, keywords = {Goal-Oriented Modelling, Policy, privacy, Requirements Engineering, Secure Software Engineering, Trust}, issn = {0167-4048}, doi = {10.1016/j.cose.2017.09.015}, author = {Ruben Rios and Carmen Fernandez-Gago and Javier Lopez} } @inproceedings {kolar2018, title = {Policy Languages and Their Suitability for Trust Negotiation}, booktitle = {32nd Annual IFIP WG 11.3 Conference on Data and Applications Security and Privacy XXXII, 2018}, volume = {10980}, year = {2018}, month = {07/2018}, pages = {69-84}, publisher = {Springer, Cham}, organization = {Springer, Cham}, address = {Bergamo, Italy}, abstract = {

Entities, such as people, companies, institutions, authorities and web sites live and exist in a conjoined world. In order to live and enjoy social benefits, entities need to share knowledge, resources and to cooperate together. The cooperation brings with it many new challenges and problems, among which one is the problem of trust. This area is also important for the Computer Science. When unfamiliar entities wish to cooperate, they do not know what to expect nor whether they can trust each other. Trust negotiation solves this problem by sequential exchanging credentials between entities, which have decided to establish a trust relationship in order to reach a common goal. Entities specify their own policies that handle a disclosure of confidential information to maintain their security and privacy. Policies are defined by means of a policy language. This paper aims to identify the most suitable policy language for trust negotiation. To do so, policy languages are analysed against a set of criteria for trust negotiation that are first established.

}, isbn = {978-3-319-95728-9}, doi = {10.1007/978-3-319-95729-6_5}, url = {https://link.springer.com/chapter/10.1007/978-3-319-95729-6_5}, author = {Martin Kolar and Carmen Fernandez-Gago and Javier Lopez} } @inproceedings {1684, title = {A Trust-by-Design Framework for the Internet of Things}, booktitle = {2018 9th IFIP International Conference on New Technologies Mobility and Security (NTMS)}, year = {2018}, month = {04/2018}, publisher = {IEEE}, organization = {IEEE}, address = {Paris}, abstract = {

The Internet of Things (IoT) is an environment of interconnected entities, that are identifiable, usable and controllable via the Internet. Trust is necessary in a system such as IoT as the entities involved should know the effect of interacting with other entities. Moreover, the entities must also be able to trust a system to reliably use it. An IoT system is composed of different entities from different vendors, each of them with a different purpose and a different lifecycle. So considering trust in the whole IoT system lifecycle is useful and necessary to guarantee a good service for the whole system. The heterogeneity and dynamicity of this field make it difficult to ensure trust in IoT. We propose a trust by design framework for including trust in the development of an IoT entity considering all the phases of the life-cycle. It is composed of the K-Model and transversal activities.

}, issn = {2157-4960 }, doi = {10.1109/NTMS.2018.8328674}, url = {http://ieeexplore.ieee.org/document/8328674/}, author = {Davide Ferraris and Carmen Fernandez-Gago and Javier Lopez} } @inproceedings {1650, title = {Configuraci{\'o}n de honeypots adaptativos para an{\'a}lisis de malware}, booktitle = {III Jornadas Nacionales de Investigaci{\'o}n en Ciberseguridad (JNIC 2017)}, year = {2017}, month = {06/2017}, pages = {91-98}, publisher = {Servicio de Publicaciones de la URJC}, organization = {Servicio de Publicaciones de la URJC}, address = {Madrid (Spain)}, abstract = {

Este trabajo propone una arquitectura de despliegue de honeypots adaptativos, configurados din{\'a}micamente a partir de los requisitos del malware que intenta infectar los servicios trampa. A diferencia de otros trabajos sobre honeypots adaptativos, los mecanismos de adaptabilidad aqu{\'\i} dise{\~n}ados tomar{\'a}n como base informaci{\'o}n de inteligencia sobre amenazas actuales, indicadores de compromiso (IOCs) conocidos, as{\'\i} como informaci{\'o}n de actividades sospechosas actualmente en estudio por los analistas. Este conocimiento ser{\'a} empleado para configurar honeypots de manera din{\'a}mica, permitiendo satisfacer los requisitos necesarios para que el malware pueda desplegar toda su operativa.\ 

}, keywords = {adaptive, dynamic, Honeypot, intelligence, IOC, malware}, isbn = {978-84-608-4659-8}, url = {https://eciencia.urjc.es/handle/10115/14540}, author = {Gerardo Fernandez and Ana Nieto} } @inproceedings {1656, title = {Modeling Malware-driven Honeypots}, booktitle = {14th International Conference On Trust, Privacy \& Security In Digital Business (TrustBus 2017)}, volume = {10442}, year = {2017}, month = {08/2017}, pages = {130-144}, publisher = {Springer International Publishing}, organization = {Springer International Publishing}, address = {Lyon (France)}, abstract = {

In this paper we propose the Hogney architecture for the deployment of malware-driven honeypots. This new concept refers to honeypots that have been dynamically configured according to the environment expected by malware. The adaptation mechanism designed here is built on services that offer up-to-date and relevant intelligence information\ on current threats. Thus, the Hogney architecture takes advantage of recent Indicators Of Compromise\ (IOC) and information about suspicious activity currently being studied by analysts. The information gathered from these services is then used to adapt honeypots to fulfill malware requirements, inviting them to unleash their full strength.

}, keywords = {adaptive, dynamic, Honeypot, intelligence, IOC, malware}, isbn = {978-3-319-64482-0}, doi = {https://doi.org/10.1007/978-3-319-64483-7_9}, url = {https://link.springer.com/chapter/10.1007/978-3-319-64483-7_9}, author = {Gerardo Fernandez and Ana Nieto and Javier Lopez} } @article {Fer_IS17, title = {Modelling Trust Dynamics in the Internet of Things}, journal = {Information Sciences}, volume = {396}, year = {2017}, pages = {72-82}, publisher = {Elsevier}, abstract = {

The Internet of Things (IoT) is a paradigm based on the interconnection of\ everyday objects. It is expected that the {\textquoteleft}things{\textquoteright} involved in the IoT paradigm\ will have to interact with each other, often in uncertain conditions. It is therefore\ of paramount importance for the success of IoT that there are mechanisms in\ place that help overcome the lack of certainty. Trust can help achieve this goal.\ In this paper, we introduce a framework that assists developers in including\ trust in IoT scenarios. This framework takes into account trust, privacy and\ identity requirements as well as other functional requirements derived from IoT\ scenarios to provide the different services that allow the inclusion of trust in the\ IoT.

}, keywords = {Dynamic Framework, Internet of Things, Trust}, issn = {0020-0255}, doi = {10.1016/j.ins.2017.02.039}, author = {Carmen Fernandez-Gago and Francisco Moyano and Javier Lopez} } @inproceedings {Ifip15, title = {A4Cloud Workshop: Accountability in the Cloud}, booktitle = {IFIP Sumer School 2015 on Privacy and Identity Management. Time for a Revolution?}, volume = {476}, year = {2016}, month = {07/2016}, pages = {61-78}, publisher = {AICT Series, Springer}, organization = {AICT Series, Springer}, address = {Edinburgh (United Kingdon)}, author = {Carmen Fernandez-Gago and Siani Pearson and Michela D{\textquoteright}Errico and Rehab Alnemr and Tobias Pulls and Anderson Santana de Oliveira} } @article {nunez2016eliciting, title = {Eliciting Metrics for Accountability of Cloud Systems}, journal = {Computers \& Security}, volume = {62}, year = {2016}, month = {08/2016}, pages = {149-164}, publisher = {Elsevier}, abstract = {

Cloud computing provides enormous business opportunities, but at the same time is a complex and challenging paradigm. The major concerns for users adopting the cloud are the loss of control over their data and the lack of transparency. Providing accountability to cloud systems could foster trust in the cloud and contribute toward its adoption. Assessing how accountable a cloud provider is becomes then a key issue, not only for demonstrating accountability, but to build it. To this end, we need techniques to measure the factors that influence on accountability. In this paper, we provide a methodology to elicit metrics for accountability in the cloud, which consists of three different stages. Since the nature of accountability at- tributes is very abstract and complex, in the first stage we perform a conceptual analysis of the accountability attributes in order to decompose them into concrete practices and mechanisms. Then, we analyze relevant control frameworks designed to guide the implementation of security and privacy mechanisms, and use them to identify measurable factors, related to the practices and mechanisms defined earlier. Lastly, specific metrics for these factors are derived. We also provide some strategies that we consider relevant for the empirical validation of the elicited accountability metrics.\ 

}, issn = {0167-4048}, doi = {10.1016/j.cose.2016.07.003}, author = {David Nu{\~n}ez and Carmen Fernandez-Gago and Jes{\'u}s Luna} } @article {JNCA16, title = {A Model-driven Approach for Engineering Trust and Reputation into Software Services}, journal = {Journal of Network and Computer Applications}, volume = {69}, year = {2016}, month = {04/2016}, pages = {134-151}, publisher = {Elsevier}, issn = {1084-8045}, author = {Francisco Moyano and Carmen Fernandez-Gago and Javier Lopez} } @inproceedings {rios2016b, title = {Privacy-Aware Trust Negotiation}, booktitle = {12th International Workshop on Security and Trust Management (STM)}, volume = {LNCS 9871}, year = {2016}, month = {09/2016}, pages = {98-105}, publisher = {Springer}, organization = {Springer}, address = {Heraklion, Crete, Greece}, abstract = {

Software engineering and information security have traditionally followed divergent paths but lately some efforts have been made to consider security from the early phases of the Software Development Life Cycle (SDLC). This paper follows this line and concentrates on the incorporation of trust negotiations during the requirements engineering phase. More precisely, we provide an extension to the SI* modelling language, which is further formalised using answer set programming specifications to support the automatic verification of the model and the detection of privacy conflicts caused by trust negotiations.

}, keywords = {Goal-Oriented Modelling, privacy, Requirements Engineering, Secure Software Engineering, Trust}, isbn = {978-3-319-46597-5}, issn = {0302-9743}, doi = {10.1007/978-3-319-46598-2 7}, url = {http://link.springer.com/chapter/10.1007/978-3-319-46598-2_7}, author = {Ruben Rios and Carmen Fernandez-Gago and Javier Lopez} } @book {1517, title = {Accountability and Security in the Cloud}, series = {Lecture Notes in Computer Science}, volume = {8937}, year = {2015}, author = {Carmen Fernandez-Gago and Massimo Felici} } @inproceedings {931, title = {Context-Awareness using Anomaly-based Detectors for Smart Grid Domains}, booktitle = {9th International Conference on Risks and Security of Internet and Systems }, volume = {8924}, year = {2015}, month = {04/2015}, pages = {17-34}, publisher = {Springer International Publishing}, organization = {Springer International Publishing}, address = {Trento}, abstract = {

Anomaly-based detection applied in strongly interdependent systems, like Smart Grids, has become one of the most challenging research areas in recent years. Early detection of anomalies so as to detect and prevent unexpected faults or stealthy threats is attracting a great deal of attention from the scientific community because it offers potential solutions for context-awareness. These solutions can also help explain the conditions leading up\ to a given situation and help determine the degree of its severity. However, not all the existing approaches within the literature are equally effective in covering the needs of a particular scenario. It is necessary to explore the control requirements of the domains that comprise a Smart Grid, identify, and even select, those approaches according to these requirements and the intrinsic conditions related to the application context, such as technological heterogeneity and complexity. Therefore, this paper analyses the functional features of existing anomaly-based approaches so as to adapt them, according to the aforementioned conditions. The result of this investigation is a guideline for the construction of preventive solutions that will help improve the context-awareness in the control of Smart Grid domains in the near future.

}, keywords = {Context-Awareness, Control systems, Prevention, Smart Grid}, isbn = {978-3-319-17126-5}, doi = {10.1007/978-3-319-17127-2_2}, url = {http://link.springer.com/chapter/10.1007\%2F978-3-319-17127-2_2$\#$}, author = {Cristina Alcaraz and Lorena Cazorla and Gerardo Fernandez} } @inproceedings {moyano15SAC, title = {Engineering Trust- and Reputation-based Security Controls for Future Internet Systems}, booktitle = {The 30th ACM/SIGAPP Symposium On Applied Computing (SAC 2015)}, year = {2015}, month = {08/2015}, pages = {1344-1349}, address = {Salamanca, Spain}, isbn = {978-1-4503-3196-8}, doi = {10.1145/2695664.2695713}, author = {Francisco Moyano and Carmen Fernandez-Gago and Kristian Beckers and Maritta Heisel} } @incollection {1512, title = {Metrics for Accountability in the Cloud}, booktitle = {Accountability and Security in the Cloud}, volume = {8937}, number = {LNCS Tutorial}, year = {2015}, pages = {129-153}, author = {Carmen Fernandez-Gago and David Nu{\~n}ez} } @incollection {nunez15privacy, title = {Privacy-Preserving Identity Management as a Service}, booktitle = {Accountability and Security in the Cloud}, series = {Lecture Notes in Computer Science}, volume = {8937}, year = {2015}, pages = {114-125}, publisher = {Springer International Publishing}, organization = {Springer International Publishing}, abstract = {

In this paper we tackle the problem of privacy and confidentiality in Identity Management as a Service (IDaaS). The adoption of cloud computing technologies by organizations has fostered the externalization of the identity management processes, shaping the concept of Identity Management as a Service. However, as it has happened to other cloud-based services, the cloud poses serious risks to the users, since they lose the control over their data. As part of this work, we analyze these concerns and present a model for privacy-preserving IDaaS, called BlindIdM, which is designed to provide data privacy protection through the use of cryptographic safeguards.

}, keywords = {Cloud Computing, Cryptography, Identity Management as a Service, privacy}, isbn = {978-3-319-17198-2}, doi = {10.1007/978-3-319-17199-9_5}, url = {http://dx.doi.org/10.1007/978-3-319-17199-9_5}, author = {David Nu{\~n}ez and Isaac Agudo and Javier Lopez}, editor = {Massimo Felici and Carmen Fernandez-Gago} } @inproceedings {1516, title = {Tools for Cloud Accountability: A4Cloud Tutorial}, booktitle = {9th IFIP Summer School on Privacy and Identity Management for the Future Internet in the Age of Globalisation}, volume = {457}, year = {2015}, pages = {219-236}, publisher = {Springer IFIP AICT}, organization = {Springer IFIP AICT}, address = {Patras (Greece)}, abstract = {

Cloud computing is becoming a key IT infrastructure technology being adopted progressively by companies and users. Still, there are issues and uncertainties surrounding its adoption, such as security and how users data is dealt with that require attention from developers, researchers, providers and users. The A4Cloud project tries to help solving the problem of accountability in the cloud by providing tools that support the process of achieving accountability. This paper presents the contents of the first A4Cloud tutorial. These contents include basic concepts and tools developed within the project. In particular, we will review how metrics can aid the accountability process and some of the tools that the A4Cloud project will produce such as the Data Track Tool (DTT) and the Cloud Offering Advisory Tool (COAT).

}, isbn = {978-3-319-18620-7}, issn = {978-3-319-18621-4}, doi = {10.1007/978-3-319-18621-4_15}, author = {Carmen Fernandez-Gago and Vasilis Tountopoulos and Simone Fischer-H{\"u}bner and Rehab Alnemr and David Nu{\~n}ez and Julio Angulo and Tobias Pulls and Theo Koulouris} } @article {CSI13, title = {Building Trust from Context Similarity Measures}, journal = {Computer Standards \& Interfaces, Special Issue on Security in Information Systems}, volume = {36}, year = {2014}, pages = {792-800}, publisher = {Elsevier}, abstract = {

\ Trust is an essential feature of any system where entities have to\ collaborate among them. Trust can assist entities making decisions\ about what is the best entity for establishing a certain collaboration.\ It would be desirable to simulate behaviour of users as in social environments\ where they tend to establish relationships or to trust users\ who have common interests or share some of their opinions, i.e., users\ who are similar to them to some extent. Thus, in this paper we first\ introduce the concept of context similarity among entities and from it\ we derive a similarity network which can be seen as a graph. Based\ on this similarity network we dene a trust model that allows us also\ to establish trust along a path of entities. A possible applications of\ our model are proximity-based trust establishment. We validate our model in this scenario.

}, issn = {0920-5489}, doi = {10.1016/j.csi.2013.12.012}, author = {Carmen Fernandez-Gago and Isaac Agudo and Javier Lopez} } @incollection {moyano14esfi, title = {Engineering Trust-Awareness and Self-adaptability in Services and Systems}, booktitle = {Engineering Secure Future Internet Services and Systems}, volume = {LNCS 8431}, number = {8431}, year = {2014}, month = {03/2014}, pages = {180-209}, publisher = {Springer}, organization = {Springer}, chapter = {8}, abstract = {
The Future Internet (FI) comprises scenarios where many heterogeneous and dynamic entities must interact to provide services (e.g., sensors, mobile devices and information systems in smart city scenarios). The dynamic conditions under which FI applications must execute call for self-adaptive software to cope with unforeseeable changes in the application environment. Models@run.time is a promising model-driven approach that supports the runtime adaptation of distributed, heterogeneous systems. Yet frameworks that accommodate this paradigm have limited support to address security concerns, hindering their usage in real scenarios. We address this challenge by enhancing models@run.time with the concepts of trust and reputation. Trust improves decision-making processes under risk and uncertainty and constitutes a distributed and flexible mechanism that does not entail heavyweight administration. This chapter introduces a trust and reputation framework that is integrated into a distributed component model that implements the models@run.time paradigm, thus allowing software components to include trust in their reasoning process. The framework is illustrated in a smart grid scenario.
}, isbn = {978-3-319-07451-1}, issn = {0302-9743}, doi = {10.1007/978-3-319-07452-8_8}, author = {Francisco Moyano and Carmen Fernandez-Gago and Benoit Baudry and Javier Lopez} } @inproceedings {moyano14smartgridsec, title = {Enhancing Problem Frames with Trust and Reputation for Analyzing Smart Grid Security Requirements}, booktitle = {Smart Grid Security - Second International Workshop}, series = {LNCS}, volume = {8448}, year = {2014}, month = {Aug}, pages = {166-180}, publisher = {Springer}, organization = {Springer}, address = {Munich}, keywords = {model-driven engineering, problem frames, Reputation, security requirements engineering, Trust, UML4PF}, isbn = {978-3-319-10328-0}, issn = {0302-9743}, doi = {10.1007/978-3-319-10329-7_11}, author = {Francisco Moyano and Carmen Fernandez-Gago and Kristian Beckers and Maritta Heisel}, editor = {Jorge Cuellar} } @inproceedings {1637, title = {An Intelligent and Adaptive Live Simulator: A new Concept for Cybersecurity Training}, booktitle = {9th Future Security Conference}, year = {2014}, address = {Berlin}, abstract = {

The rapid rate of change in technology and the increasing sophistication of cyber attacks require any organization to have a continuous preparation. However, the resource and time intensive nature of cybersecurity education and training renders traditional approaches highly inefficient. Simulators have attracted the attention in the last years as a potential solution for cybersecurity training. However, in spite of the advances achieved, there is still an urgent need to address some open challenges. In this paper we present a novel simulator that solves some these challenges. First, we analyse the main properties that any cybersecurity training solution should comprise, and evaluate to what extent training simulators can meet them. Next, we introduce the functional architecture and innovative features of the simulator, of which a functional prototype has already been released. Finally, we demonstrate how these capabilities are put into practice in training courses already available in the simulator.

}, keywords = {Cyberdefence, Cybersecurity, Education, Simulation, Training}, author = {Jorge L. Hern{\'a}ndez-Ardieta and David Santos and Pascual Parra and Juan E. Tapiador and Pedro Peris-L{\'o}pez and Javier Lopez and Gerardo Fernandez} } @inproceedings {moyano14caise, title = {Trust-Aware Decision-Making Methodology for Cloud Sourcing}, booktitle = {26th International Conference on Advanced Information Systems Engineering (CAiSE 2014)}, series = {LCNS}, volume = {8484}, year = {2014}, month = {06/2014}, pages = {136-149}, publisher = {Springer}, organization = {Springer}, address = {Thessaloniki}, abstract = {

Cloud sourcing consists of outsourcing data, services and infrastructure to cloud providers. Even when this outsourcing model brings advantages to cloud customers, new threats also arise as sensitive data and critical IT services are beyond customers{\textquoteright} control. When an organization considers moving to the cloud, IT decision makers must select a cloud provider and must decide which parts of the organization will be outsourced and to which extent. This paper proposes a methodology that allows decision makers to evaluate their trust in cloud providers. The methodology provides a systematic way to elicit knowledge about cloud providers, quantify their trust factors and aggregate them into trust values that can assist the decision-making process. The trust model that we propose is based on trust intervals, which allow capturing uncertainty during the evaluation, and we define an operator for aggregating these trust intervals. The methodology is applied to an eHealth scenario.

}, keywords = {Cloud Computing, decision making, domain knowledge elicitation, security, Trust}, isbn = {978-3-319-07880-9}, issn = {0302-9743}, doi = {10.1007/978-3-319-07881-6}, author = {Francisco Moyano and Kristian Beckers and Carmen Fernandez-Gago}, editor = {Matthias Jarke and John Mylopoulos and Christoph Quix and Colette Rolland and Yannis Manolopoulos and Haralambos Mouratidis and Jennifer Horkoff} } @inproceedings {moyano2012stm, title = {Building Trust and Reputation In: A Development Framework for Trust Models Implementation}, booktitle = {8th International Workshop on Security and Trust Management (STM 2012)}, series = {LNCS}, volume = {7783}, year = {2013}, pages = {113-128}, publisher = {Springer}, organization = {Springer}, address = {Pisa}, abstract = {

During the last years, many trust and reputation models have been proposed, each one targeting different contexts and purposes, and with their own particularities. While most contributions focus on defining ever-increasing complex models, little attention has been paid to the process of building these models inside applications during their implementation. The result is that models have traditionally considered as ad-hoc and after-the-fact solutions that do not always fit with the design of the application. To overcome this, we propose an object-oriented development framework onto which it is possible to build applications that require functionalities provided by trust and reputation models. The framework is extensible and flexible enough to allow implementing an important variety of trust models. This paper presents the framework, describes its main components, and gives examples on how to use it in order to implement three different trust models.

}, isbn = {978-3-642-38004-4}, issn = {0302-9743}, doi = {10.1007/978-3-642-38004-4}, author = {Francisco Moyano and Carmen Fernandez-Gago and Javier Lopez}, editor = {Audung J{\o}sang and Pierangela Samarati and Marinella Petrocchi} } @inproceedings {moyano2013ares, title = {Detecting Insider Threats: a Trust-Aware Framework}, booktitle = {8th International Conference on Availability, Reliability and Security}, year = {2013}, month = {Nov 2013}, pages = {121-130}, publisher = {IEEE}, organization = {IEEE}, address = {Regensburg, Germany}, abstract = {

The number of insider threats hitting organizations and big enterprises is rapidly growing. Insider threats occur when trusted employees misuse their permissions on organizational assets. Since insider threats know the organization and its processes, very often they end up undetected. Therefore, there is a pressing need for organizations to adopt preventive mechanisms to defend against insider threats. In this paper, we propose a framework for insiders identification during the early requirement analysis of organizational settings and of its IT systems. The framework supports security engineers in the detection of insider threats and in the prioritization of them based on the risk they represent to the organization. To enable the automatic detection of insider threats, we extend the SI* requirement modeling language with an asset model and a trust model. The asset model allows associating security properties and sensitivity levels to assets. The trust model allows specifying the trust level that a user places in another user with respect to a given permission on an asset. The insider threats identification leverages the trust levels associated with the permissions assigned to users, as well as the sensitivity of the assets to which access is granted. We illustrate the approach based on a patient monitoring scenario.

}, isbn = {978-0-7695-5008-4}, doi = {10.1109/ARES.2013.22}, author = {Federica Paci and Carmen Fernandez-Gago and Francisco Moyano} } @article {moyano2013re, title = {A Framework for Enabling Trust Requirements in Social Cloud Applications}, journal = {Requirements Engineering}, volume = {18}, year = {2013}, month = {Nov 2013}, pages = {321-341}, publisher = {Springer London}, abstract = {

Cloud applications entail the provision of a huge amount of heterogeneous, geographically-distributed resources managed and shared by many different stakeholders who often do not know each other beforehand. This raises numerous security concerns that, if not addressed carefully, might hinder the adoption of this promising computational model. Appropriately dealing with these threats gains special relevance in the social cloud context, where computational resources are provided by the users themselves. We argue that taking trust and reputation requirements into account can leverage security in these scenarios by incorporating the notions of trust relationships and reputation into them. For this reason, we propose a development framework onto which developers can implement trust-aware social cloud applications. Developers can also adapt the framework in order to accommodate their application-specific needs.

}, keywords = {architecture, framework, social cloud, Trust and reputation requirements}, issn = {0947-3602}, doi = {10.1007/s00766-013-0171-x}, author = {Francisco Moyano and Carmen Fernandez-Gago and Javier Lopez} } @inproceedings {nunez2013metamodel, title = {A Metamodel for Measuring Accountability Attributes in the Cloud}, booktitle = {2013 IEEE International Conference on Cloud Computing Technology and Science (CloudCom 2013)}, year = {2013}, month = {12/2013}, pages = {355-362}, publisher = {IEEE}, organization = {IEEE}, address = {Bristol, UK}, abstract = {

Cloud governance, and in particular data governance in the cloud, relies on different technical and organizational practices and procedures, such as policy enforcement, risk management, incident management and remediation. The concept of accountability encompasses such practices, and is essential for enhancing security and trustworthiness in the cloud. Besides this, proper measurement of cloud services, both at a technical and governance level, is a distinctive aspect of the cloud computing model. Hence, a natural problem that arises is how to measure the impact on accountability of the procedures held in practice by organizations that participate in the cloud ecosystem. In this paper, we describe a metamodel for addressing the problem of measuring accountability properties for cloud computing, as discussed and defined by the Cloud Accountability Project (A4Cloud). The goal of this metamodel is to act as a language for describing: (i) accountability properties in terms of actions between entities, and (ii) metrics for measuring the fulfillment of such properties. It also allows the recursive decomposition of properties and metrics, from a high-level and abstract world to a tangible and measurable one. Finally, we illustrate our proposal of the metamodel by modelling the transparency property, and define some metrics for it.

}, isbn = {978-0-7685-5095-4}, doi = {10.1109/CloudCom.2013.53}, author = {David Nu{\~n}ez and Carmen Fernandez-Gago and Siani Pearson and Massimo Felici} } @proceedings {1832, title = {Proceedings of the 10th International Conference on Trust, Privacy, and Security in Digital Business (TRUSTBUS 2013)}, journal = {10th International Conference on Trust, Privacy and Security in Digital Business (TRUSTBUS 2013)}, volume = {LNCS 8058}, year = {2013}, month = {Aug 2013}, publisher = {Springer}, address = {Prague, Czech Republic}, isbn = {978-3-642-40342-2}, editor = {Steve Furnell and Costas Lambrinoudakis and Javier Lopez} } @article {MFLR13, title = {Secure sealed-bid online auctions using discreet cryptographic proofs}, journal = {Mathematical and Computer Modelling}, volume = {57}, year = {2013}, month = {Jun 2013}, pages = {2583{\textendash}2595}, publisher = {Elsevier}, abstract = {

This work describes the design and implementation of an auction system using secure multiparty computation techniques. Our aim is to produce a system that is practical under actual field constraints on computation, memory, and communication. The underlying protocol is privacy-preserving, that is, the winning bid is determined without information about the losing bids leaking to either the auctioneer or other bidders. Practical implementation of the protocol is feasible using circuit-based cryptographic proofs along with additively homomorphic bit commitment. Moreover, we propose the development of a\ Proof Certificatestandard. These certificates convey sufficient information to recreate the cryptographic proofs and verify them offline.

}, issn = {0895-7177}, doi = {http://dx.doi.org/10.1016/j.mcm.2011.07.027}, author = {Jose A. Montenegro and Michael J. Fischer and Javier Lopez and Rene Peralta} } @inproceedings {moyano13wisse, title = {Towards Engineering Trust-aware Future Internet Systems}, booktitle = {3rd International Workshop on Information Systems Security Engineering (WISSE 2013)}, series = {LNBIP}, volume = {148}, year = {2013}, month = {Jun 2013}, pages = {490-501}, publisher = {Springer-Verlag}, organization = {Springer-Verlag}, address = {Valencia}, abstract = {

Security must be a primary concern when engineering Future Internet (FI) systems and applications. In order to achieve secure solutions, we need to capture security requirements early in the Software Development Life Cycle (SDLC). Whereas the security community has traditionally focused on providing tools and mechanisms to capture and express hard security requirements (e.g. confidentiality), little attention has been paid to other important requirements such as trust and reputation. We argue that these soft security requirements can leverage security in open, distributed, heterogeneous systems and applications and that they must be included in an early phase as part of the development process. In this paper we propose a UML extension for specifying trust and reputation requirements, and we apply it to an eHealth case study.

}, keywords = {Reputation, Requirements Engineering, Secure Design, Trust}, isbn = {978-3-642-38489-9}, issn = {1865-1348}, doi = {10.1007/978-3-642-38490-5}, url = {http://link.springer.com/book/10.1007/978-3-642-38490-5/page/3}, author = {Francisco Moyano and Carmen Fernandez-Gago and Javier Lopez}, editor = {Xavier Franch and Pnina Soffer} } @inproceedings {moyano2013ifiptm, title = {Towards Trust-Aware and Self-Adaptive Systems}, booktitle = {7th IFIP WG 11.11 International Conference on Trust Management (IFIPTM 2013)}, series = {AICT}, volume = {401}, year = {2013}, month = {Jun 2013}, pages = {255-262}, publisher = {Springer}, organization = {Springer}, address = {Malaga}, abstract = {

The Future Internet (FI) comprises scenarios where many heterogeneous and dynamic entities must interact to provide services (e.g., sensors, mobile devices and information systems in smart city scenarios). The dynamic conditions under which FI applications must execute call for self-adaptive software to cope with unforeseeable changes in the application environment. Software engineering currently provides frameworks to develop reasoning engines that automatically take reconfiguration decisions and that support the runtime adaptation of distributed, heterogeneous applications. However, these frameworks have very limited support to address security concerns of these application, hindering their usage for FI scenarios. We address this challenge by enhancing self-adaptive systems with the concepts of trust and reputation. Trust will improve decision-making processes under risk and uncertainty, in turn improving security of self-adaptive FI applications. This paper presents an approach that includes a trust and reputation framework into a platform for adaptive, distributed component-based systems, thus providing software components with new abilities to include trust in their reasoning process.

}, isbn = {978-3-642-38323-6}, issn = {1868-4238}, doi = {10.1007/978-3-642-38323-6}, author = {Francisco Moyano and Benoit Baudry and Javier Lopez}, editor = {Carmen Fernandez-Gago and Isaac Agudo and Fabio Martinelli and Siani Pearson} } @inproceedings {moyano2013essosds, title = {A Trust and Reputation Framework}, booktitle = {Doctoral Symposium of the International Symposium on Engineering Secure Software and Systems (ESSoS-DS 2013)}, series = {CEUR-WS}, volume = {965}, year = {2013}, pages = {7-12}, publisher = {CEUR-WS}, organization = {CEUR-WS}, address = {Par{\'\i}s}, abstract = {

The Future Internet is posing new security challenges as their scenarios are bringing together a huge amount of stakeholders and devices that must interact under unforeseeable conditions. In addition, in these scenarios we cannot expect entities to know each other beforehand, and therefore, they must be involved in risky and uncertain collaborations. In order to minimize threats and security breaches, it is required that a well-informed decision-making process is in place, and it is here where trust and reputation can play a crucial role. Unfortunately, services and applications developers are often unarmed to address trust and reputation requirements in these scenarios. To overcome this limitation, we propose a trust and reputation framework that allows developers to create trust- and reputation-aware applications.

}, issn = {1613-0073}, url = {http://ceur-ws.org/Vol-965/}, author = {Francisco Moyano and Carmen Fernandez-Gago and Javier Lopez}, editor = {Maritta Heisel and Eda Marchetti} } @proceedings {ifiptm13, title = {Trust Management VII, 7th WG11.11 International conference}, volume = {401}, year = {2013}, month = {June 2013}, publisher = {Springer}, address = {Malaga (Spain)}, isbn = {978-3-642-38323-6}, editor = {Carmen Fernandez-Gago and Fabio Martinelli and Siani Pearson and Isaac Agudo} } @inproceedings {moyano2012trustbus, title = {A Conceptual Framework for Trust Models}, booktitle = {9th International Conference on Trust, Privacy \& Security in Digital Business (TrustBus 2012)}, series = {LNCS}, volume = {7449}, year = {2012}, month = {Sep 2012}, pages = {93-104}, publisher = {Springer Verlag}, organization = {Springer Verlag}, address = {Vienna}, abstract = {

During the last twenty years, a huge amount of trust and reputation models have been proposed, each of them with their own particularities and targeting different domains. While much effort has been made in defining ever-increasing complex models, little attention has been paid to abstract away the particularities of these models into a common set of easily understandable concepts. We propose a conceptual framework for computational trust models that will be used for analyzing their features and for comparing heterogeneous and relevant trust models.

}, isbn = {978-3-642-32286-0}, issn = {0302-9743}, doi = {10.1007/978-3-642-32287-7}, author = {Francisco Moyano and Carmen Fernandez-Gago and Javier Lopez}, editor = {Fischer-H{\"u}bner, Simone and Katsikas, Sokratis and Quirchmayr, Gerald} } @inproceedings {Rios2012, title = {HIDE_DHCP: Covert Communications Through Network Configuration Messages}, booktitle = {Proceedings of the 27th IFIP TC 11 International Information Security and Privacy Conference (SEC 2012)}, series = {IFIP AICT}, volume = {376}, year = {2012}, month = {June 2012}, pages = {162-173}, publisher = {Springer Boston}, organization = {Springer Boston}, address = {Heraklion, Crete, Greece}, abstract = {

Covert channels are a form of hidden communication that may violate the integrity of systems. Since their birth in multilevel security systems in the early 70{\textquoteright}s they have evolved considerably, such that new solutions have appeared for computer networks mainly due to vague protocols specifications. We analyze a protocol extensively used today, the Dynamic Host Configuration Protocol (DHCP), in search of new forms of covert communication. From this analysis we observe several features that can be effectively exploited for subliminal data transmission. This results in the implementation of HIDE_DHCP, which integrates three covert channels that accommodate to different stealthiness and bandwidth requirements

}, keywords = {Covert channels, Network Security, System Information Security}, isbn = {978-3-642-30435-4}, issn = {1868-4238}, doi = {http://dx.doi.org/10.1007/978-3-642-30436-1_14}, author = {Ruben Rios and Jose A. Onieva and Javier Lopez}, editor = {Dimitris Gritzalis and Steve Furnell and Marianthi Theoharidou} } @inproceedings {moyano12qasa, title = {Implementing Trust and Reputation Systems: A Framework for Developers{\textquoteright} Usage}, booktitle = {International Workshop on Quantitative Aspects in Security Assurance}, year = {2012}, address = {Pisa}, abstract = {

During the last decades, a huge amount of trust and reputation models have been proposed, each of them with their own particularities and targeting different domains. While much effort has been made in defining ever-increasing complex models, little attention has been paid to abstract away the particularities of these models into a common set of easily understandable concepts. We propose a conceptual framework for computational trust models that is used for developing a component-oriented development framework that aims to assist developers during the implementation phase.

}, author = {Francisco Moyano and Carmen Fernandez-Gago and Javier Lopez} } @inproceedings {Rios2012d, title = {Robust Probabilistic Fake Packet Injection for Receiver-Location Privacy in WSN}, booktitle = {17th European Symposium on Research in Computer Security (ESORICS 2012)}, series = {LNCS}, volume = {7459}, year = {2012}, month = {Sep 2012}, pages = {163-180}, publisher = {Springer}, organization = {Springer}, address = {Pisa, Italy}, abstract = {

The singular communication model in wireless sensor networks (WSNs) originate pronounced traffic patterns that allow a local observer to deduce the location of the base station, which must be kept secret for both strategical and security reasons. In this work we present a new receiver-location privacy solution called HISP (Homogenous Injection for Sink Privacy). Our scheme is based on the idea of hiding the flow of real traffic by carefully injecting fake traffic to homogenize the transmissions from a node to its neighbors. This process is guided by a lightweight probabilistic approach ensuring that the adversary cannot decide with sufficient precision in which direction to move while maintaining a moderate amount of fake traffic. Our system is both validated analytically and experimentally through simulations.

}, isbn = {978-3-642-33167-1}, issn = {0302-9743}, doi = {10.1007/978-3-642-33167-1_10}, author = {Ruben Rios and Jorge Cuellar and Javier Lopez}, editor = {Sara Foresti and Moti Yung and Fabio Martinelli} } @proceedings {stm11, title = {Security and Trust Management - 7th International Workshop, STM 2011}, volume = {7170}, year = {2012}, month = {July 2012}, publisher = {Springer}, address = {Copenhaguen, Denmark}, isbn = {978-3-642-29963-6}, editor = {Catherine Meadows and Carmen Fernandez-Gago} } @incollection {BC2011Alcaraz, title = {Security Aspects of SCADA and DCS Environments}, booktitle = {Critical Infrastructure Protection: Information Infrastructure Models, Analysis, and Defense}, series = {Advances in Critical Infrastructure Protection: Information Infrastructure Models, Analysis, and Defense. LNCS 7130.}, volume = {7130}, year = {2012}, month = {September 2012}, pages = {120-149}, publisher = {Springer-Verlag}, organization = {Springer-Verlag}, address = {Heidelberger (Berlin, Alemania)}, abstract = {

SCADA Systems can be seen as a fundamental component in Critical Infrastructures, having an impact in the overall performance of other Critical Infrastructures interconnected. Currently, these systems include in their network designs different types of Information and Communication Technology systems (such as the Internet and wireless technologies), not only to modernize operational processes but also to ensure automation and real-time control. Nonetheless, the use of these new technologies will bring new security challenges, which will have a significant impact on both the business process and home users. Therefore, the main purpose of this Chapter is to address these issues and to analyze the interdependencies of Process Control Systems with ICT systems, to discuss some security aspects and to offer some possible solutions and recommendations.

}, keywords = {Critical Information Infrastructure Protection, SCADA Systems}, isbn = {ISBN:978-3-642-28919-4}, issn = {0302-9743}, author = {Cristina Alcaraz and Gerardo Fernandez and Fernando Carvajal}, editor = {Javier Lopez and Stephen. Wolthunsen and Roberto Setola} } @inproceedings {moyano2012essosds, title = {Service-Oriented Trust and Reputation Architecture}, booktitle = {Proceedings of the Doctoral Symposium of the International Symposium on Engineering Secure Software and Systems (ESSoS-DS 2012)}, series = {CEUR-WS}, volume = {834}, year = {2012}, note = {

Partner:UMA, Project:NESSoS

}, pages = {41-46}, publisher = {CEUR-WS}, organization = {CEUR-WS}, address = {Eindhoven}, abstract = {

As the Future Internet arrives, more complex, service-based applications are spreading. These applications pose several challenges, including the huge amount of entities that must interact and their het- erogeneity. The success of these applications depends on the collaboration and communication of these entities, that might belong to different or- ganizations and administrative domains. Therefore, trust and reputation become two crucial issues. We propose the specification and design of a service-based security architecture that stresses the delivery of trust and reputation services to any application that might require them.

}, issn = {1613-0073}, url = {http://ceur-ws.org/Vol-834/paper7_essosds2012.pdf}, author = {Francisco Moyano and Carmen Fernandez-Gago and Javier Lopez}, editor = {Jorge Cuellar and Nora Koch} } @inproceedings {NF_RECSI12, title = {Sistema Colaborativo de Detecci{\'o}n y Reacci{\'o}n ante Intrusiones basado en Intel vPro}, booktitle = {XII Reuni{\'o}n Espa{\~n}ola sobre Criptolog{\'\i}a y Seguridad de la Informaci{\'o}n (RECSI 2012)}, year = {2012}, month = {Sep 2012}, pages = {45-50}, address = {San Sebasti{\'a}n}, abstract = {

En este trabajo proponemos una plataforma para el desarrollo de un sistema colaborativo para la detecci{\'o}n y reacci{\'o}n ante intrusiones, empleando como base las tecnolog{\'\i}as presentes en Intel vPro. La soluci{\'o}n presentada est{\'a} dirigida a solventar la necesidad de implantaci{\'o}n de nuevas tecnolog{\'\i}as que posibiliten la reacci{\'o}n ante ataques, independientemente del sistema operativo usado. Con este fin, en este trabajo abordamos tres puntos fundamentales: la detecci{\'o}n de intrusiones colaborativa, la respuesta autom{\'a}tica de los nodos ante la detecci{\'o}n de una intrusi{\'o}n y el uso de herramientas que posibiliten asegurar la confianza en un nodo. En un sistema colaborativo como el que se propone aqu{\'\i}, un aspecto clave para la seguridad es la protecci{\'o}n de las comunicaciones entre los mecanismos de detecci{\'o}n y reacci{\'o}n frente a intrusiones. La modificaci{\'o}n o el simple acceso a los datos intercambiados por tales sistemas supone un grave riesgo para la seguridad del entorno. Como resultado hemos desarrollado un prototipo preliminar para probar la soluci{\'o}n propuesta en un escenario de ataque real.

}, keywords = {IDS, Intel vPro, IRS}, isbn = {978-84-615-9933-2}, author = {Ana Nieto and Gerardo Fernandez} } @inproceedings {Moyano_ESSoS12, title = {A Task Ordering Approach for Automatic Trust Establishment}, booktitle = {Proceedings of the 2012 International Symposium on Engineering Secure Software and Systems (ESSoS 2012)}, series = {LNCS}, volume = {7159}, year = {2012}, month = {Feb 2012}, pages = {76{\textendash}89}, publisher = {Springer}, organization = {Springer}, address = {Eindhoven, The Netherlands}, abstract = {

Trust has become essential in computer science as a way of assisting the process of decision-making, such as access control. In any system, several tasks may be performed, and each of these tasks might pose different associated trust values between the entities of the system. For instance, in a file system, reading and overwriting a file are two tasks that pose different trust values between the users who can carry out these tasks. In this paper, we propose a simple model for automatically establishing trust relationships between entities considering an established order among tasks.

}, keywords = {task ordering, trust evaluation, trust graph}, doi = {10.1007/978-3-642-28166-2_8}, author = {Francisco Moyano and Carmen Fernandez-Gago and Isaac Agudo and Javier Lopez}, editor = {Gilles Barthe and Ben Livshits and Riccardo Scandariato} } @inproceedings {422, title = {Un protocolo para la firma de contratos en escenarios multi-two-party con atomicidad}, booktitle = {XII Reuni{\'o}n Espa{\~n}ola de Criptolog{\'\i}a y Seguridad de la Informaci{\'o}n}, year = {2012}, month = {09/2012}, pages = {357-362}, abstract = {

Los avances tecnol{\'o}gicos que est{\'a} experimentando el mundo digital (Internet, comunicaciones, etc.) est{\'a}n acercando a consumidores y proveedores. Los proveedores pueden ofrecer sus productos directamente a los consumidores finales, y {\'e}stos son capaces de acceder a los proveedores desde cualquier lugar y en cualquier momento. A la hora de adquirir productos o
servicios, esta facilidad de acceso permite a los consumidores consultar distintas ofertas de diferentes proveedores. Pero en el caso de que el consumidor quiera m{\'u}ltiples productos, como los paquetes tur{\'\i}sticos, formados por vuelos, hoteles, excursiones, etc, los consumidores carecen de herramientas que les permitan realizar la contrataci{\'o}n multi-two-party de manera at{\'o}mica. En
este art{\'\i}culo presentamos un protocolo de firma de contratos multi-two-party con atomicidad que garantiza la equitatividad de todas las partes.

}, author = {Gerard Draper-Gil and Josep L. Ferrer-Gomilla and M.F. Hinarejos and Jose A. Onieva and Javier Lopez} } @inproceedings {1642, title = {Analysis of Secure Mobile Grid Systems: A systematic approach}, booktitle = {XVI Jornadas de Ingenier{\'\i}a del Software y Bases de Datos (JISBD 2011)}, year = {2011}, month = {2011}, pages = {487-491}, publisher = {Servizo de publicaci{\'o}ns da Universidade da Coru{\~n}a}, organization = {Servizo de publicaci{\'o}ns da Universidade da Coru{\~n}a}, address = {A Coru{\~n}a, Spain}, abstract = {

Developing software through systematic processes is becoming more and more important due to the growing complexity of software development. It is important that the development process used integrates security aspects from the first stages at the same level as other functional and non-functional requirements. The identification of security aspects in the first stages ensures a more robust development and permits the security requirements to be perfectly coupled with the design and the rest of the system\’s requirements. Systems which are based on Grid Computing are a kind of systems that have clear differentiating features in which security is a highly important aspect. Generic development processes are sometimes used to develop Grid specific systems without taking into consideration either the subjacent technological environment or the special features and particularities of these specific systems. In fact, the majority of existing Grid applications have been built without a systematic development process and are based on ad hoc developments.

}, isbn = {978-84-9749-486-1}, author = {David G. Rosado and E. Fernandez-Medina and M. Pattini and Javier Lopez} } @article {Alcaraz2011, title = {An Early Warning System based on Reputation for Energy Control Systems}, journal = {IEEE Transactions on Smart Grid}, volume = {2}, number = {4}, year = {2011}, month = {Nov 2011}, pages = {827-834}, publisher = {IEEE}, abstract = {

Most of energy control or SCADA (Supervisory Control and Data Acquisition) systems are very dependent on advanced technologies and on traditional security mechanisms for protecting the a system against anomalous events. Security mechanisms are not enough to be used in critical systems, since they can only detect anomalous events occurring at a certain moment in time. For this reason it becomes of paramount importance the usage of intelligent systems with capability for preventing anomalous situations and reacting against them on time. This type of systems are, for example, Early Warning Systems (EWS). In this paper, we propose an EWS based on Wireless Sensor Networks (WSNs) (under the ISA100.11a standard) and reputation for controling the network behaviour. The WSN are organized into clusters where a Cluster Head (CH) is designated. This CH will contain a Reputation Manager Module. The usability of this approach is also analyzed considering a Smart Grid scenario.} keywords = {Critical Information Infrastructures, Sensor Networks, Early Warning Systems, Reputation, SCADA Systems, Smart Grid.

}, keywords = {Early Warning Systems, Reputation, SCADA Systems, Smart Grid, wireless sensor networks}, issn = {1949-3053}, doi = {10.1109/TSG.2011.2161498}, author = {Cristina Alcaraz and Carmen Fernandez-Gago and Javier Lopez} } @inproceedings {6059235, title = {OSAMI Commons: An open dynamic services platform for ambient intelligence}, booktitle = {IEEE 16th Conference on Emerging Technologies Factory Automation (ETFA 2011)}, year = {2011}, month = {Sep 2011}, pages = {1-10}, publisher = {IEEE}, organization = {IEEE}, address = {Toulouse, France}, abstract = {

Today we live in an environment surrounded with networked converging devices. Human computer interactions are becoming personalized and a new concept of a global and cross-domain platform is emerging to exploit the full potential of the network in all business areas. In this convergence process, the software platform should be able to personalize itself dynamically in devices according to the context. OSAmI-Commons, an ITEA2 project for developing an open-source common approach to such a dynamic service-based platform, allows any type of device to connect and exchange information and services. OSAMI consortium is contributing to defining the foundations of a cross-platform open-services ecosystem. The sustainability of this platform is an objective beyond the project duration.

}, isbn = {978-1-4577-0016-3}, issn = {1946-0740}, doi = {10.1109/ETFA.2011.6059235}, author = {Naci Dai and Jesus Bermejo and Felix Cuadrado Latasa and Alejandra Ruiz L{\'o}pez and Isaac Agudo and Elmar Zeeb and Jan Krueger and Oliver Dohndorf and Wolfgang Thronicke and Christoph Fiehe and Anna Litvina} } @incollection {1626, title = {Security in the Developments Process of Mobile Grid Systems}, booktitle = {Advances in Grid Computing}, year = {2011}, pages = {173-198}, publisher = {Intech}, organization = {Intech}, edition = {Zoran Constantinescu}, author = {David G. Rosado and E. Fernandez-Medina and Javier Lopez} } @article {rosado2010d, title = {Security Services Architecture for Secure Mobile Grid Systems}, journal = {Journal of Systems Architecture}, volume = {57}, year = {2011}, month = {2011}, pages = {240-258}, publisher = {Elsevier}, address = {Mobile Grid, is a full inheritor of the Grid with the additional feature that it supports mobile users and resources. Security is an important aspect in Grid based systems, and it is more complex to ensure this in a mobile platform owing to the limitation}, abstract = {

\ Mobile Grid, is a full inheritor of the Grid with the additional feature that it supports mobile users andresources. Security is an important aspect in Grid based systems, and it is more complex to ensure thisin a mobile platform owing to the limitations of resources in these devices. A Grid infrastructure that supportsthe participation of mobile nodes and incorporates security aspects will thus play a significant rolein the development of Grid computing. The idea of developing software through systematic developmentprocesses to improve software quality is not new. However, many information systems such as those ofGrid Computing are still not developed through methodologies which have been adapted to their mostdifferentiating features. The lack of adequate development methods for this kind of systems in whichsecurity is taken into account has encouraged us to build a methodology to develop them, offering adetailed guide for their analysis, design and implementation. It is important to use software V\&V techniques,according to IEEE Std. 1012 for Software Verification and Validation, to ensure that a software systemmeets the operational needs of the user. This ensures that the requirements for the system arecorrect, complete, and consistent, and that the life-cycle products correctly design and implement systemrequirements. This paper shows part of a development process that we are elaborating for the constructionof information systems based on Grid Computing, which are highly dependent on mobile devices inwhich security plays a highly important role. In the design activity of the process, we design a securityarchitecture which serves as a reference for any mobile Grid application that we wish to build since thissecurity architecture defines a complete set of security services which will be instantiated depending onthe requirements and features found in previous activities of the process. A V\&V task is also defined in thedesign activity to validate and verify both the architecture built and the traceability of the artifacts generatedin this activity. In this paper, we will present the service-oriented security architecture for MobileGrid Systems which considers all possible security services that may be required for any mobile Grid application.

}, issn = {1383-7621}, author = {David G. Rosado and Eduardo Fernandez-Medina and Javier Lopez} } @article {rosado2011, title = {Systematic Design of Secure Mobile Grid Systems}, journal = {Journal of Network and Computer Applications}, volume = {34}, year = {2011}, month = {2011}, pages = {1168-1183}, publisher = {Elsevier}, abstract = {

\ Grid computing has arisen as an evolution of distributed systems mainly focused on the sharing of and remote access to resources in a uniform, transparent, secure, efficient and reliable manner. It is possible to join Grid technology and mobile technology in order to create one of the most promising technologies and developments to appear in recent years, in that they enrich one another and provide new solutions that solve many of the limitations and problems found in different technologies. Security is a very important factor in Mobile Grid Computing and is also difficult to achieve owing to the open nature of wireless networks and heterogeneous and distributed environments. Success in obtaining a secure system originates in incorporating security from the first stages of the development process. It has therefore been necessary to define a development process for this kind of systems in which security is incorporated in all stages of the development and the features and particularities of the Mobile Grid systems are taken into consideration. This paper presents one of the activities of this development process, the design activity, which consists of defining and designing a security software architecture. This architecture will be built from a security architecture, defined as reference architecture, in which security services, interfaces and operations are defined with the purpose of defining a reference security architecture which covers the majority of security requirements identified in the analysis activity. The design activity will build the system architecture that will be the input artefact for the subsequent activity in the process, which is the construction activity.

}, issn = {1084-8045}, author = {David G. Rosado and Eduardo Fernandez-Medina and Javier Lopez and Mario Piattini} } @article {rosado2009, title = {Towards a UML Extension of Reusable Secure Use Cases for Mobile Grid systems}, journal = {IEICE Trans. on Information and Systems}, volume = {E94-D}, year = {2011}, month = {Feb 2011}, pages = {243-254}, publisher = {IEICE}, abstract = {

The systematic processes exactly define the development cycle and help the development team follow the same development strategies and techniques, thus allowing a continuous improvement in the quality of the developed products. Likewise, it is important that the development process used integrates security aspects from the first stages at the same level as other functional and non-functional requirements. Grid systems allow us to build very complex information systems with different and remarkable features (interoperability between multiple security domains, cross-domain authentication and authorization, dynamic, heterogeneous and limited mobile devices, etc). With the development of wireless technology and mobile devices, the Grid becomes the perfect candidate for letting mobile users make complex works that add new computational capacity to the Grid. A methodology of development for secure mobile Grid systems is being defined. One of the activities of this methodology is the requirements analysis which is based in reusable use cases. In this paper, we will present a UML-extension for security use cases and Grid use case which capture the behaviour of this kind of systems. A detailed description of all these new use cases defined in the UML extension is necessary, describing the stereotypes, tagged values, constraints and graphical notation. We show an example of how to apply and use this extension for building the diagram of use cases and incorporating common security aspects for this kind of systems. Also, we will see how the diagrams built can be reused in the construction of others diagrams saving time and effort in this task.

}, issn = {0916-8532}, doi = {10.1587/transinf.E94.D.243}, author = {David G. Rosado and Eduardo Fernandez-Medina and Javier Lopez and Mario Piattini} } @article {rosado2010b, title = {Analysis of Secure Mobile Grid Systems: A Systematic Approach}, journal = {Information and Software Technology}, volume = {52}, year = {2010}, month = {May 2010}, pages = {517-536}, publisher = {Elsevier}, abstract = {

Developing software through systematic processes is becoming more and more important due to the growing complexity of software development. It is important that the development process used integrates security aspects from the first stages at the same level as other functional and non-functional requirements. Systems which are based on Grid Computing are a kind of systems that have clear differentiating features in which security is a highly important aspect. The Mobile Grid, which is relevant to both Grid and Mobile Computing, is a full inheritor of the Grid with the additional feature that it supports mobile users and resources. A development methodology for Secure Mobile Grid Systems is proposed in which the security aspects are considered from the first stages of the life-cycle and in which the mobile Grid technological environment is always present in each activity. This paper presents the analysis activity, in which the requirements (focusing on the grid, mobile and security requirements) of the system are specified and which is driven by reusable use cases through which the requirements and needs of these systems can be defined. These use cases have been defined through a UML-extension for security use cases and Grid use cases which capture the behaviour of this kind of systems. The analysis activity has been applied to a real case.

}, issn = {0950-5849}, doi = {10.1016/j.infsof.2010.01.002}, author = {David G. Rosado and Eduardo Fernandez-Medina and Javier Lopez and Mario Piattini} } @article {FerrerGomilla2009, title = {Certified electronic mail: Properties revisited}, journal = {Computers \& Security}, volume = {29}, number = {2}, year = {2010}, pages = {167 - 179}, abstract = {

Certified electronic mail is an added value to traditional electronic mail. In the definition of this service some differences arise: a message in exchange for a reception proof, a message and a non repudiation of origin token in exchange for a reception proof, etc. It greatly depends on whether we want to emulate the courier service or improve the service in the electronic world. If the definition of the service seems conflictive, the definition of the properties and requirements of a good certified electronic mail protocol is even more difficult. The more consensuated features are the need of a fair exchange and the existence of a trusted third party (TTP). Each author chooses the properties that considers the most important, and many times the list is conditioned by the proposal. Which kind of TTP must be used? Must it be verifiable, transparent and/or stateless? Which features must the communication channel fulfil? Which temporal requirements must be established? What kind of fairness is desired? What efficiency level is required? Are confidentiality or transferability of the proofs compulsory properties? In this paper we collect the definitions, properties and requirements related with certified electronic mail. The aim of the paper is to create a clearer situation and analyze how some properties cannot be achieved simultaneously. Each protocol designer will have to decide which properties are the most important in the environment in where the service is to be deployed.

}, keywords = {Certified electronic mail, Fairness, Non repudiation, Properties, Timeliness, Trusted third parties}, issn = {0167-4048}, doi = {DOI: 10.1016/j.cose.2009.06.009}, url = {http://www.sciencedirect.com/science/article/B6V8G-4WR19XR-1/2/eda89f747b077fc68fa061f213ddf6d5}, author = {Josep L. Ferrer-Gomilla and Jose A. Onieva and Magdalena Payeras and Javier Lopez} } @article {rofelopi, title = {Developing a Secure Mobile Grid System through a UML Extension}, journal = {Journal of Universal Computer Science}, volume = {16}, number = {17}, year = {2010}, month = {Sep 2010}, pages = {2333-2352}, publisher = {Springer}, abstract = {

The idea of developing software through systematic development processes toimprove software quality is not new. Nevertheless, there are still many information systemssuch as those of Grid Computing which are not developed through methodologies that areadapted to their most differentiating features. A systematic development process for Gridsystems that supports the participation of mobile nodes and incorporates security aspects intothe entire software lifecycle will thus play a significant role in the development of systemsbased on Grid computing. We are creating a development process for the construction ofinformation systems based on Grid Computing, which is highly dependent on mobile devices,in which security plays a highly important role. One of the activities in this process is that ofanalysis which is focused on ensuring that the system{\textquoteright}s security and functional requirements areelicited, specified and modelled. In our approach, this activity is driven by use cases andsupported by the reusable repository. This obtains, builds, defines and refines the use cases ofthe secure Mobile Grid systems which represent the functional and non-functional requirementsof this kind of systems. In this paper, we present the proposed development process throughwhich we introduce the main aspects of the UML profile defined for building use case diagramsin the mobile Grid context through which it is possible to represent specific mobile Gridfeatures and security aspects, showing in detail how to build use case diagrams for a real mobile Grid application by using our UML profile, denominated as GridUCSec-Profile.

}, issn = {0948-695x}, doi = {10.3217/jucs-016-17-2333}, author = {David G. Rosado and Eduardo Fernandez-Medina and Javier Lopez and Mario Piattini} } @article {JordiForne2009, title = {Pervasive Authentication and Authorization Infrastructures for Mobile Users}, journal = {Computer and Security}, volume = {29}, year = {2010}, pages = {501-514}, publisher = {elsevier}, abstract = {

Network and device heterogeneity, nomadic mobility, intermittent connectivity and, more generally, extremely dynamic operating conditions, are major challenges in the design of security infrastructures for pervasive computing. Yet, in a ubiquitous computing environment, limitations of traditional solutions for authentication and authorization can be overcome with a pervasive public key infrastructure (pervasive-PKI). This choice allows the validation of credentials of users roaming between heterogeneous networks, even when global connectivity is lost and some services are temporarily unreachable. Proof-of-concept implementations and testbed validation results demonstrate that strong security can be achieved for users and applications through the combination of traditional PKI services with a number of enhancements like: (i) dynamic and collaborative trust model, (ii) use of attribute certificates for privilege management, and (iii) modular architecture enabling nomadic mobility and enhanced with reconfiguration capabilities.

}, issn = {0167-4048}, doi = {10.1016/j.cose.2009.09.001}, author = {Jordi Forne and Francisca Hinajeros and Andres Marin and Florina Almenarez and Javier Lopez and Jose A. Montenegro and Marc Lacoste and Daniel Diaz} } @article {Agudo2010b, title = {A Scale Based Trust Model for Multi-Context Environments}, journal = {Computers and Mathematics with Applications}, volume = {60}, year = {2010}, month = {July}, pages = {209-216}, publisher = {Elsevier}, abstract = {

When interactions among users of a system have to take place, for example, over the internet, establishing trust relationships among these users becomes crucial. However, the way this trust is established depends to a certain extent on the context where the interactions take place. Most of the time, trust is encoded as a numerical value that might not be very meaningful for a not very experienced user. In this paper we propose a model that takes into account the semantic and the computational sides of trust. This avoids users having to deal directly with the computational side; they instead deal with meaningful labels such as Bad or Good in a given context.

}, issn = {0898-1221}, doi = {10.1016/j.camwa.2010.02.009}, author = {Isaac Agudo and Carmen Fernandez-Gago and Javier Lopez} } @article {vivas2009, title = {A security framework for a workflow-based grid development platform.}, journal = {Computer Standards and Interfaces}, volume = {32}, number = {5-6}, year = {2010}, month = {Oct 2010}, pages = {230-245}, publisher = {Elsevier}, abstract = {

This paper describes the security framework that is to be developed for the generic grid platform created for the project GREDIA. This platform is composed of several components that need to be secured. The platform uses the OGSA standards, so that the security framework will follow GSI, the portion of Globus that implements security. Thus, we will show the security features that GSI already provides and we will outline which others need to be created or enhanced.

}, issn = {0920-5489}, doi = {http://dx.doi.org/10.1016/j.csi.2009.04.001}, author = {Jose L. Vivas and Carmen Fernandez-Gago and Andres Benjumea and Javier Lopez} } @inproceedings {Rios2010, title = {Source Location Privacy Considerations in Wireless Sensor Networks}, booktitle = {4th International Symposium of Ubiquitous Computing and Ambient Intelligence (UCAmI{\textquoteright}10)}, year = {2010}, month = {Sept.}, pages = {29 - 38}, publisher = {IBERGARCETA PUBLICACIONES, S.L.}, organization = {IBERGARCETA PUBLICACIONES, S.L.}, address = {Valencia (Spain)}, abstract = {

Wireless Sensor Networks are considered to be one of the cornerstones of Ambient Intelligence since they can be used in countless applications, where sensors are unobtrusively embedded into the environment to perform operations like monitoring, tracking and reporting. In such scenarios, privacy issues must be carefully considered since the mere observation of the network operation might reveal great amounts of private information to unauthorised parties. One of the problems that is gaining more attention in the realm of privacy, is the location privacy problem, which aims to prevent an attacker from obtaining the location of specific nodes of interest to him. In this paper we provide a general overview of the proposed solutions to counter this threat. Finally, we will also discuss some open challenges and future directions of research for a convenient management of privacy issues in smart environments.

}, isbn = {978-84-92812-61-5}, author = {Ruben Rios and Javier Lopez}, editor = {Lidia Fuentes and Nadia G{\'a}mez and Jos{\'e} Bravo} } @inproceedings {rosado2010c, title = {A Study of Security Approaches for the Development of Mobile Grid Systems}, booktitle = {5th International Conference on Software and Data Technologies (ICSOFT{\textquoteright}10)}, volume = {1}, year = {2010}, month = {july}, pages = {133-138}, publisher = {Springer}, organization = {Springer}, address = {Athens, Greece}, abstract = {

Mobile Grid systems allow us to build highly complex information systems with various and remarkable features (interoperability between multiple security domains, cross-domain authentication and authorization, dynamic, heterogeneous and limited mobile devices, etc), which demand secure development methodologies to build quality software, offering methods, techniques and tools that facilitate the work of the entire team involved in software development. These methodologies should be supported by Grid security architectures that define the main security aspects to be considered, and by solutions to the problem of how to integrate mobile devices within Grid systems. Some approaches regarding secure development methodologies of Grid security architectures and of the integration of mobile devices in the Grid have been found in literature, and these are analyzed and studied in this paper, offering a comparison framework of all the approaches related to security in Mobile Grid environments.

}, isbn = {978-989-8425-22-5}, author = {David G. Rosado and Eduardo Fernandez-Medina and Javier Lopez} } @article {JavierLopezMunoz2010, title = {Trust Management Systems for Wireless Sensor Networks: Best practices}, journal = {Computer Communications}, volume = {33}, number = {9}, year = {2010}, pages = {0140-3664}, publisher = {Elsevier}, abstract = {

Wireless sensor networks (WSNs) have been proven a useful technology for perceiving information about the physical world and as a consequence has been used in many applications such as measurement of temperature, radiation, flow of liquids, etc. The nature of this kind of technology, and also their vulnerabilities to attacks make the security tools required for them to be considered in a special way. The decision making in a WSN is essential for carrying out certain tasks as it aids sensors establish collaborations. In order to assist this process, trust management systems could play a relevant role. In this paper, we list the best practices that we consider are essential for developing a good trust management system for WSN and make an analysis of the state of the art related to these practices.

}, issn = {0140-3664}, doi = {10.1016/j.comcom.2010.02.006}, author = {Javier Lopez and Rodrigo Roman and Isaac Agudo and Carmen Fernandez-Gago} } @inproceedings {Alcaraz2009, title = {Adaptive Dispatching of Incidences Based on Reputation for SCADA Systems}, booktitle = {6th International Conference on Trust, Privacy and Security in Digital Business (TrustBus{\textquoteright}09)}, series = {LNCS}, year = {2009}, month = {September}, pages = {86-94}, publisher = {Springer-Verlag}, organization = {Springer-Verlag}, address = {Linz, Austria}, abstract = {

SCADA systems represent a challenging scenario where the management of critical alarms is crucial. Their response to these alarms should be efficient and fast in order to mitigate or contain undesired effects. This work presents a mechanism, the Adaptive Assignment Manager (AAM) that will aid to react to incidences in a more efficient way by dynamically assigning alarms to the most suitable human operator. The mechanism uses various inputs for identifying the operators such as their availability, workload and reputation. In fact, we also define a reputation component that stores the reputation of the human operators and uses feedback from past experiences.

}, keywords = {Critical Control Systems, Reputation, Supervisory Control and Data Acquisition Systems}, isbn = {978-3-642-03747-4}, doi = {10.1007/978-3-642-03748-1_9}, author = {Cristina Alcaraz and Isaac Agudo and Carmen Fernandez-Gago and Rodrigo Roman and Gerardo Fernandez and Javier Lopez} } @inproceedings {rosado2009f, title = {Applying a UML Extension to build Use Cases diagrams in a secure mobile Grid application}, booktitle = {5th International Workshop on Foundations and Practices of UML}, series = {LNCS}, volume = {5833}, year = {2009}, pages = {126-136}, publisher = {Springer Berlin Heidelberg}, organization = {Springer Berlin Heidelberg}, address = {Gramado, Brasil}, abstract = {

Systems based on Grid computing have not traditionally beendeveloped through suitable methodologies and have not taken into accountsecurity requirements throughout their development, offering technical securitysolutions only during the implementation stages. We are creating a developmentmethodology for the construction of information systems based on GridComputing, which is highly dependent on mobile devices, in which securityplays a highly important role. One of the activities in this methodology is therequirements analysis which is use-case driven. In this paper, we build use casediagrams for a real mobile Grid application by using a UML-extension, calledGridUCSec-Profile, through which it is possible to represent specific mobileGrid features and security aspects for use case diagrams, thus obtainingdiagrams for secure mobile Grid environments.

}, isbn = {978-3-642-04946-0}, author = {David G. Rosado and Eduardo Fernandez-Medina and Javier Lopez} } @article {Agudo2009, title = {Concurrent access control for multi-user and multi-processor systems based on trust relationships}, journal = {Concurrency and Computation: Practice and Experience}, volume = {21}, year = {2009}, month = {July}, pages = {1389-1403}, publisher = {John Wiley \& Sons}, abstract = {

Concurrent access control is an old problem in many fields in Computer Science. It has been solved in many languages and systems, using mechanisms like monitors or priority queues. Nowadays computers implement multi-core capabilities. This means that they are virtually capable of execution of processes in parallel. This requires new techniques and open new issues in the field of concurrent access control. Moreover, most operating systems are multi-user; thus, we have to focus on a multi-processor multi-user scenario. Trust becomes a paramount aspect when building distributed applications; the same applies on a lower scale in modern computers. We propose the use of a trust graph that keeps record of the trust relationships of the system and helps in deciding on concurrent access requests. The information encoded in the graph will be used both in order to decide on the access requests and to order granted requests in terms of their associated trust level

}, issn = {1532-0626}, doi = {10.1002/cpe.1430}, author = {Isaac Agudo and Carmen Fernandez-Gago and Javier Lopez} } @inproceedings {rosado2009e, title = {Extensi{\'o}n UML para Casos de Uso Reutilizables en entornos Grid M{\'o}viles Seguros}, booktitle = {XIV Jornadas de Ingenier{\'\i}a del Software y Bases de Datos (JISBD 2009)}, year = {2009}, month = {September}, pages = {331-342}, publisher = {Antonio Vallecillo and Goiuria Sagardui (Eds.)}, organization = {Antonio Vallecillo and Goiuria Sagardui (Eds.)}, address = {San Sebasti{\'a}n, Espa{\~n}a}, abstract = {

Los sistemas Grid nos permiten construir sistemas complejos concaracter{\'\i}sticas diferenciadoras (interoperabilidad entre m{\'u}ltiples dominios deseguridad, autenticaci{\'o}n y autorizaci{\'o}n a trav{\'e}s de dominios, sistema din{\'a}micoy heterog{\'e}neo, etc.). Con el desarrollo de la tecnolog{\'\i}a wireless y losdispositivos m{\'o}viles, el Grid llega a ser el candidato perfecto para que losusuarios m{\'o}viles puedan realizar trabajos complejos, a la vez que a{\~n}aden nuevacapacidad computacional al Grid. Estamos construyendo un proceso completode desarrollo para sistemas Grid m{\'o}viles seguros, y una de las actividades es elan{\'a}lisis de requisitos, que est{\'a} basado en casos de uso reutilizables. En esteart{\'\i}culo, presentaremos una extensi{\'o}n UML para casos de uso de seguridad yGrid, los cuales capturan el comportamiento de este tipo de sistemas. Estaextensi{\'o}n UML est{\'a} siendo aplicado a un caso real para construir diagramas decasos de uso de la aplicaci{\'o}n, incorporando los aspectos de seguridadnecesarios.

}, isbn = {978-84-692-4211-7}, author = {David G. Rosado and Eduardo Fernandez-Medina and Javier Lopez} } @inproceedings {rosado2009d, title = {Hacia una Arquitectura de Servicios de Seguridad para entornos Grid m{\'o}viles}, booktitle = {V Congreso Iberoamericano de Seguridad Inform{\'a}tica (CIBSI{\textquoteright}09)}, year = {2009}, pages = {409-423}, publisher = {Universidad de la Rep{\'u}blica, Uruguay}, organization = {Universidad de la Rep{\'u}blica, Uruguay}, address = {Montevideo, Uruguay}, abstract = {

Grid m{\'o}vil incluye las caracter{\'\i}sticas de los sistemas Grid junto conlas peculiaridades de la computaci{\'o}n m{\'o}vil, a{\~n}adiendo la propiedad de soportarusuarios y recursos m{\'o}viles de forma homog{\'e}nea, transparente, segura yeficiente. La seguridad de estos sistemas, debido a su naturaleza abierta ydistribuida, es un tema de gran inter{\'e}s. Una arquitectura de seguridad basada enSOA proporciona una arquitectura distribuida dise{\~n}ada para interoperabilidadde servicios, f{\'a}cil integraci{\'o}n, y acceso seguro, simple y extensible. Por tanto,una arquitectura orientada a servicios de seguridad es construida para entornosGrid m{\'o}viles, ofreciendo servicios de seguridad a usuarios m{\'o}viles quienesusan servicios Grid y recursos para ejecutar sus trabajos y tareas. Estaarquitectura es integrada con otras arquitecturas existentes proporcionandomayor seguridad y permitiendo que los usuarios m{\'o}viles puedan acceder aservicios Grid existentes ofreciendo nuevos y necesarios servicios de seguridadpara Grid m{\'o}viles. Hemos definido un conjunto de servicios de seguridad, quejunto a protocolos, pol{\'\i}ticas y est{\'a}ndares de seguridad forman una arquitecturade seguridad orientada a servicios para entornos Grid m{\'o}viles. Esta arquitecturaes abierta, escalable, din{\'a}mica, interoperable y flexible.

}, isbn = {978-9974-0-0593-8}, author = {David G. Rosado and Eduardo Fernandez-Medina and Javier Lopez} } @inproceedings {Agudo2009a, title = {A Multidimensional Reputation Scheme for Identity Federations}, booktitle = {Sixth European Workshop on Public Key Services, Applications and Infrastructures (EuroPKI{\textquoteright}09)}, series = {LNCS}, volume = {6391}, year = {2009}, pages = {225-238}, publisher = {Springer}, organization = {Springer}, abstract = {

Deciding who to trust in the internet of services paradigm is an important and open question. How to do it in an optimal way is not always easy to determine. Trust is usually referred to a particular context whereas a single user may interact in more than one given context. We are interested in investigating how a Federated Reputation System can help exporting trust perceptions from one context to another. We propose a model for deriving trust in online services. In this context, trust is defined as the level of confidence that the service provider holds on the subject interacting with it to behave in a proper way while using the service. Thus, we derive trust by using the reputation values that those users have gained for interacting with these services.

}, isbn = {978-3-642-16440-8}, issn = {0302-9743 (Print) 1611-3349 (Online)}, doi = {10.1007/978-3-642-16441-5_15}, author = {Isaac Agudo and Carmen Fernandez-Gago and Javier Lopez} } @article {rosado2009c, title = {Obtaining Security Requirements for a Mobile Grid System}, journal = {International Journal of Grid and High Performance Computing}, volume = {1}, year = {2009}, month = {Jan 2009}, pages = {1-17}, publisher = {IGI-Global}, abstract = {

Mobile Grid includes the characteristics of the Grid systems together with the peculiarities of Mobile Computing, withthe additional feature of supporting mobile users and resources ina seamless, transparent, secure and efficient way. Security ofthese systems, due to their distributed and open nature, isconsidered a topic of great interest. We are elaborating amethodology of development to build secure mobile grid systemsconsidering security on all life cycle. In this paper we present thepractical results applying our methodology to a real case,specifically we apply the part of security requirements analysis toobtain and identify security requirements of a specific applicationfollowing a set of tasks defined for helping us in the definition,identification and specification of the security requirements onour case study. The methodology will help us to build a securegrid application in a systematic and iterative way.

}, issn = {1938-0259}, doi = {10.4018/IJGHPC}, author = {David G. Rosado and Eduardo Fernandez-Medina and Javier Lopez} } @inproceedings {rosado2009b, title = {Reusable Security Use Cases for Mobile Grid environments}, booktitle = {Workshop on Software Engineering for Secure Systems}, year = {2009}, pages = {1-8}, publisher = {IEEE}, organization = {IEEE}, address = {Vancouver, Canada}, abstract = {

Due to the growing complexity of softwaredevelopment, developing software through systematicprocesses is becoming more and more important.Likewise, it is important that the development processused integrates security aspects from the first stages atthe same level as other functional and non-functionalrequirements. In the last years, GRID technology hasshown to be the most important one and it allows us tobuild very complex information systems with differentand remarkable features (interoperability betweenmultiple security domains, cross-domainauthentication and authorization, dynamic,heterogeneous and limited mobile devices, etc).Traditionally, systems based on GRID Computing havenot been developed through adequate methodologiesand have not taken into account security requirementsthroughout their development, only offering securitytechnical solutions at the implementation stages. Thispaper shows part of a development methodology thatwe are elaborating for the construction of informationsystems based on Grid Computing highly dependent onmobile devices where security plays a very importantrole. Specifically, in this paper, we will present theanalysis phase, managed by reusable use casesthrough which we can define the requirements andneeds of these systems obtaining an analysis modelthat can be used as input to the following phase of themethodology, the design phase of mobile Grid systems.

}, isbn = {978-1-4244-3725-2}, author = {David G. Rosado and Eduardo Fernandez-Medina and Javier Lopez} } @inproceedings {rosado2009a, title = {Reutilizaci{\'o}n de Casos de Uso en el Desarrollo de Sistemas Grid seguros}, booktitle = {XII Conferencia Iberoamericana de Ingenier{\'\i}a de Requisitos y Ambientes de Software (IDEAS{\textquoteright}09)}, year = {2009}, pages = {388-393}, publisher = {University of Colombia}, organization = {University of Colombia}, address = {Medell{\'\i}n, Colombia}, abstract = {

El desarrollo software debe estar basado en un proceso sistem{\'a}tico y estructurado donde se definan los m{\'e}todos y t{\'e}cnicas a utilizar en todo su ciclo de vida, ayudando as{\'\i} a obtener un producto de calidad. Es igualmente importante que el proceso sistem{\'a}tico considere aspectos de seguridad desde las primeras etapas, integr{\'a}ndola como un elemento m{\'a}s en el ciclo de desarrollo. En este art{\'\i}culo mostramos la metodolog{\'\i}a de desarrollo sistem{\'a}tico que sirve de gu{\'\i}a para el desarrollo de cualquier sistema Grid con dispositivos m{\'o}viles, considerando la seguridad durante todas las fases de desarrollo, lo que nos permitir{\'a} obtener como resultado sistemas Grid seguros, robustos y escalables. Este art{\'\i}culo presenta la fase de an{\'a}lisis, dirigida por casos de uso reutilizables, mediante los cuales se definen los requisitos y necesidades de estos sistemas, y es aplicada a un caso de estudio real de un Grid para el acceso de contenidos multimedia en un contexto period{\'\i}stico.

}, isbn = {978-958-44-5028-9}, author = {David G. Rosado and Eduardo Fernandez-Medina and Javier Lopez} } @incollection {Roman2009b, title = {Trust and Reputation Systems for Wireless Sensor Networks}, booktitle = {Security and Privacy in Mobile and Wireless Networking}, year = {2009}, pages = {105-128}, publisher = {Troubador Publishing Ltd}, organization = {Troubador Publishing Ltd}, abstract = {

The concept of trust has become very relevant in the late years as a consequence of the growth of fields such as internet transactions or electronic commerce. In general, trust has become of paramount importance for any kind of distributed networks, such as wireless sensor networks (WSN in the following). In this chapter of the book, we try to give a general overview of the state of the art on trust management systems for WSN and also try to identify the main features of the architectures of these trust management systems.

}, isbn = {978-1905886-906}, author = {Rodrigo Roman and Carmen Fernandez-Gago and Javier Lopez and Hsiao Hwa Chen}, editor = {Stefanos Gritzalis and Tom Karygiannis and Charalabos Skianis} } @inproceedings {Agudo2008, title = {Delegating Privileges over Finite Resources: A Quota Based Delegation Approach}, booktitle = {5th International Workshop on Formal Aspects in Security and Trust (FAST{\textquoteright}08)}, series = {LNCS}, volume = {5491}, year = {2008}, pages = {302-315}, publisher = {Springer}, organization = {Springer}, address = {Malaga (Spain)}, abstract = {

When delegation in real world scenarios is considered, the delegator (the entity that posses the privileges) usually passes the privileges on to the delegatee (the entity that receives the privileges) in such a way that the former looses these privileges while the delegation is effective. If we think of a physical key that opens a door, the privilege being delegated by the owner of the key is opening the door. Once the owner of the key delegates this privilege to another entity, by handing over the key, he is not able to open the door any longer. This is due to the fact that the key is not copied and handed over but handed over to the delegatee. When delegation takes place in the electronic world, the delegator usually retains also the privileges. Thus, both users have them simultaneously. This situation, which in most cases is not a problem, may be undesirable when dealing with certain kind of resources. In particular, if we think of finite resources, those in which the number of users accessing simultaneously is finite, we can not allow that a user delegating his access privilege is also granted access when the delegation if effective. In this paper we propose an approach where each user is delegated an access quota for a resource. If further delegating of the delegated quota occurs, this is subtracted from his quota. That is, when delegating, part of the quota remains with the delegator and another part goes to the delegatee. This allows a more fairly access to the resource. Moreover, we show that this approach can also be applied to any kind of resources by defining appropriate authorization policies.

}, isbn = {978-3-642-01464-2}, issn = {0302-9743 (Print) 1611-3349 (Online)}, doi = {10.1007/978-3-642-01465-9}, author = {Isaac Agudo and Carmen Fernandez-Gago and Javier Lopez} } @inproceedings {rosado2008a, title = {Engineering Process Based On Grid Use Cases For Mobile Grid Systems}, booktitle = {Third International Conference on Software and Data Technologies (ICSOFT{\textquoteright}08)}, year = {2008}, pages = {146-151}, publisher = {Springer}, organization = {Springer}, address = {Porto, Portugal}, abstract = {

The interest to incorporate mobile devices into Grid systems has arisen with two main purposes. The firstone is to enrich users of these devices while the other is that of enriching the own Grid infrastructure.Security of these systems, due to their distributed and open nature, is considered a topic of great interest. Aformal approach to security in the software life cycle is essential to protect corporate resources. However,little attention has been paid to this aspect of software development. Due to its criticality, security should beintegrated as a formal approach into the software life cycle. We are developing a methodology ofdevelopment for secure mobile Grid computing based systems that helps to design and build secure Gridsystems with support for mobile devices directed by use cases and security use cases and focused onservice-oriented security architecture. In this paper, we will present one of the first steps of ourmethodology consisting of analyzing security requirements of mobile grid systems. This analysis will allowus to obtain a set of security requirements that our methodology must cover and implement.

}, isbn = {978-3-642-05200-2}, issn = {1865-0929}, author = {David G. Rosado and Eduardo Fernandez-Medina and Javier Lopez and Mario Piattini} } @inproceedings {Agudo2008b, title = {An Evolutionary Trust and Distrust Model}, booktitle = {4th Workshop on Security and Trust Management (STM{\textquoteright}08)}, series = {ENTCS}, volume = {224}, year = {2008}, pages = {3-12}, publisher = {Elsevier}, organization = {Elsevier}, address = {Trondheim, Norway}, abstract = {

In this paper we propose a trust model, where besides considering trust and distrust, we also consider another parameter that measures the reliability on the stability of trust or distrust. The inclusion of this new parameter will allow us to use trust in a more accurate way. We consider trust is not static but dynamic and trust values can change along time. Thus, we will also take time into account, using it as a parameter of our model. There is very little work done about the inclusion of time as an influence on trust. We will show the applicability of our model in the scenario of the process of reviewing papers for a conference. Sometimes for these kind of processes the Chair of the conference should first find the suitable reviewers. He can make this selection by using our model. Once the reviewers are selected they send out their reviews to the Chair who can also use our model in order to make the final decision about acceptance of papers.

}, issn = {1571-0661}, doi = {10.1016/j.entcs.2009.07.034}, author = {Isaac Agudo and Carmen Fernandez-Gago and Javier Lopez} } @article {Alcaraz2008a, title = {Gesti{\'o}n segura de redes SCADA}, journal = {Nuevas tendencias en gesti{\'o}n de redes, Nov{\'a}tica}, number = {196}, year = {2008}, month = {December}, pages = {20-25}, publisher = {CEPIS}, abstract = {

En el momento que se introduce en el mercado nuevas tecnolog\ías basadas en entornos distribuidos comienzan a surgir en paralelo nuevos problemas de seguridad en los sistemas SCADA (Supervisory Control and Data Acquisition), los cuales monitorizan y gestionan otras infraestructuras de gran complejidad y escala. Un fallo o una interrupci\ón en uno de sus componentes podr\ía suponer un impacto negativo sobre la funcionalidad de otras infraestructuras, por lo que se hace necesario realizar frecuentes an\álisis de seguridad para as\í mantener actualizado el conocimiento y proveer recomendaciones y/o soluciones para mitigar o evitar futuras ocurrencias, garantizando una gesti\ón de red fiable y siempre disponible.

}, keywords = {An{\'a}lisis de Seguridad, Gesti{\'o}n de red SCADA, Supervisory Control and Data Acquisition Systems}, issn = {0211-2124}, url = {http://www.ati.es/novatica/indice.html$\#$196}, author = {Cristina Alcaraz and Gerardo Fernandez and Rodrigo Roman and Angel Balastegui and Javier Lopez} } @inproceedings {Agudo2008a, title = {A Model for Trust Metrics Analysis}, booktitle = {5th International Conference on Trust, Privacy and Security in Digital Business (TrustBus{\textquoteright}08)}, series = {LNCS}, volume = {5185}, year = {2008}, pages = {28-37}, publisher = {Springer}, organization = {Springer}, abstract = {

Trust is an important factor in any kind of network essential, for example, in the decision-making process. As important as the definition of trust is the way to compute it. In this paper we propose a model for defining trust based on graph theory and show examples of some simple operators and functions that will allow us to compute trust.

}, isbn = {978-3-540-85734-1}, issn = {0302-9743 (Print) 1611-3349 (Online)}, doi = {10.1007/978-3-540-85735-8_4}, author = {Isaac Agudo and Carmen Fernandez-Gago and Javier Lopez} } @inproceedings {rosado2008, title = {PSecGCM: Process for the development of Secure Grid Computing based Systems with Mobile devices}, booktitle = {International Conference on Availability, Reliability and Security (ARES{\textquoteright}08)}, year = {2008}, pages = {136-143}, publisher = {IEEE Computer Society}, organization = {IEEE Computer Society}, address = {A Grid computing system is defined as a platform that supports distributed system applications which require fast access to a large quantity of distributed resources in a coordinated manner. With the development of wireless technology and mobile devices,}, abstract = {

A Grid computing system is defined as a platformthat supports distributed system applications which require fastaccess to a large quantity of distributed resources in acoordinated manner. With the development of wirelesstechnology and mobile devices, the Grid becomes the perfectcandidate so that mobile users can make complex works that addnew computational capacity to the Grid. Security of thesesystems, due to their distributed and open nature, receives greatinterest. The growing size and profile of the grid requirecomprehensive security solutions as they are critical to thesuccess of the endeavour. A formal approach to security in thesoftware life cycle is essential to protect corporate resources.However, little thought has been given to this aspect of softwaredevelopment. Due to its criticality, security should be integratedas a formal approach in the software life cycle. A methodology ofdevelopment for secure mobile Grid computing based systems isdefined, that is to say, an engineering process that defines thesteps to follow so that starting from the necessities to solve, wecan design and construct a secure Grid system with support formobile devices that is able to solve and cover these necessities.

}, issn = {978-0-7695-3102-1}, author = {David G. Rosado and Eduardo Fernandez-Medina and Javier Lopez and Mario Piattini} } @article {Alcaraz2008b, title = {Secure Management of SCADA Networks}, journal = {Novatica, New Trends in Network Management}, volume = {9}, number = {6}, year = {2008}, month = {December}, pages = {22-28}, publisher = {Cepis UPGRADE}, abstract = {

When a Supervisory Control and Data Acquisition (SCADA) system monitors and manages other complex infrastructures through the use of distributed technologies, it becomes a critical infrastructure by itself: A failure or disruption in any of its components could implicate a serious impact on the performance of the other infrastructures. The connection with other systems makes a SCADA system more vulnerable against attacks, generating new security problems. As a result, it is essential to perform diverse security analysis frequently in order to keep an updated knowledge and to provide recommendations and/or solutions to mitigate or avoid anomalous events. This will facilitate the existence of a suitable, reliable, and available control network.

}, keywords = {SCADA network management, Security Analysis, Supervisory Control and Data Acquisition Systems}, issn = {1684-5285}, url = {http://www.upgrade-cepis.org/issues/2008/6/up9-6Alcaraz.pdf}, author = {Cristina Alcaraz and Gerardo Fernandez and Rodrigo Roman and Angel Balastegui and Javier Lopez} } @book {1620, title = {Securing Information and Communications Systems: Principles, Technologies and Applications}, year = {2008}, publisher = {Artech House}, organization = {Artech House}, issn = {1596932287}, author = {Furnell, S and Sokratis K. Katsikas and Javier Lopez and Patel, A} } @inproceedings {Roman2007c, title = {Featuring Trust and Reputation Management Systems for Constrained Hardware Devices}, booktitle = {1st International Conference on Autonomic Computing and Communication Systems (Autonomics{\textquoteright}07)}, year = {2007}, month = {October}, publisher = {ICST}, organization = {ICST}, address = {Rome (Italy)}, abstract = {

Research on trust management systems for wireless sensor networks is still at a very early stage and few works have done so far. It seems that for those works which deal with the topic general features of how these systems should be are not clearly identified. In this paper we try to identify the main features that a trust management system should have and justify their importance for future developments.

}, keywords = {Sensor Networks, Trust Management}, isbn = {978-963-9799-09-7}, author = {Rodrigo Roman and Carmen Fernandez-Gago and Javier Lopez} } @inproceedings {Rosado2007, title = {Hacia un Proceso sistem{\'a}tico para el desarrollo de sistemas Grid Seguros con Dispositivos M{\'o}viles}, booktitle = {IV Congreso Iberoamericano de Seguridad Inform{\'a}tica (CIBSI{\textquoteright}07)}, year = {2007}, pages = {111-124}, publisher = {Sebasti{\'a}n Ca{\~n}{\'o}n, M.A.}, organization = {Sebasti{\'a}n Ca{\~n}{\'o}n, M.A.}, address = {Mar del Plata, Argentina}, isbn = {978-950-623-043-2}, author = {David G. Rosado and Eduardo Fernandez-Medina and Javier Lopez and Mario Piattini} } @proceedings {1609, title = {Public Key Infrastructure, 4th European PKI Workshop: Theory and Practice, EuroPKI 2007, Palma de Mallorca, Spain, June 28-30, 2007, Proceedings}, journal = {EuroPKI}, volume = {4582}, year = {2007}, publisher = {Springer}, isbn = {978-3-540-73407-9}, editor = {Javier Lopez and Pierangela Samarati and Josep L. Ferrer} } @inproceedings {FernandezGago2007, title = {A Survey on the Applicability of Trust Management Systems for Wireless Sensor Networks}, booktitle = {3rd International Workshop on Security, Privacy and Trust in Pervasive and Ubiquitous Computing (SecPerU{\textquoteright}07)}, year = {2007}, pages = {25-30}, publisher = {IEEE Computer Society}, organization = {IEEE Computer Society}, address = {Istanbul (Turkey)}, abstract = {

Trust plays an important role in human life environments and virtual organizations. In the context of a network, trust may help its elements to decide whether another member of the same network is being uncooperative or malicious. Trust becomes quite important in self-configurable and autonomous systems, such as wireless sensor networks (WSN). However, very little effort has been done in the field of trust management in WSN. On the other hand, some efforts have been made in quite related fields such as Ad-hoc and P2P networks. In this paper we give an overview of existing trust management solutions, mainly those developed for Ad-Hoc and P2P networks and, more importantly, investigate their suitability to WSN. We also provide some guidelines to aid the development of trust management systems for WSN according to the nature of these networks.

}, doi = {10.1109/SECPERU.2007.3}, author = {Carmen Fernandez-Gago and Rodrigo Roman and Javier Lopez} } @article {Dix07, title = {Temporal Logics of Knowledge and their Applications in Security}, journal = {First Workshop in Information and Computer Security (ICS{\textquoteright}06)}, volume = {186}, year = {2007}, pages = {27-42}, publisher = {Elsevier}, address = {Timisoara, Romania}, abstract = {

\ Temporal logics of knowledge are useful for reasoning about situations where the knowledge of an agent or component is important, and where change in this knowledge may occur over time. Here we investigate the application of temporal logics of knowledge to the specification and verification of security protocols. We show how typical assumptions relating to authentication protocols can be specified. We consider verification methods for these logics, in particular, focusing on proofs using clausal resolution. Finally we present experiences from using a resolution based theorem prover applied to security protocols specified in temporal logics of knowledge.

}, keywords = {security, temporal resolution}, issn = {1571-0661}, doi = {"DOI: 10.1016/j.entcs.2006.11.043"}, author = {Clare Dixon and Carmen Fernandez-Gago and Michale Fisher and Wiebe van der Hoek} } @inproceedings {Cid2006, title = {Software Engineering Techniqes Applied to AmI: Security Patterns}, booktitle = {First International Conference on Ambient Intelligence Developments (AmID{\textquoteright}06)}, year = {2006}, month = {September}, pages = {108-123}, publisher = {Springer}, organization = {Springer}, address = {Sophia-Antipolis (France)}, abstract = {

The realization of the Ambient Intelligence concept entails many important challenges, but the most important barriers to this realization is the lack of adequate support for security. In this paper we present a conceptual model of our solution for building secure systems for AmI environments, taking as basis the concept of Security and Dependability (S\&D) Pattern as a precise representation of validated S\&D solutions and mechanisms. The main elements embedded in our solution framework (S\&D library, monitoring interface and S\&D Manager) are presented both conceptually, and also using a simple example scenario based on an hospital AmI environment.

}, keywords = {Ambient Intelligence, security}, isbn = {978-3-642-01464-2}, doi = {http://dx.doi.org/10.1007/978-2-287-47610-5_8}, author = {Francisco Sanchez-Cid and Mu{\~n}oz, Antonio and Daniel Serrano and Carmen Fernandez-Gago} } @article {Fernandez2005, title = {First-Order Temporal Verification in Practice}, journal = {Journal of Automated Reasoning}, volume = {34}, year = {2005}, pages = {295-321}, publisher = {Springer}, abstract = {

First-order temporal logic, the extension of first-order logic with operators dealing with time, is a powerful and expressive formalism with many potential applications. This expressive logic can be viewed as a framework in which to investigate problems specified in other logics. The monodic fragment of first-order temporal logic is a useful fragment that possesses good computational properties such as completeness and sometimes even decidability. Temporal logics of knowledge are useful for dealing with situations where the knowledge of agents in a system is involved. In this paper we present a translation from temporal logics of knowledge into the monodic fragment of first-order temporal logic. We can then use a theorem prover for monodic first-order temporal logic to prove properties of the translated formulas. This allows problems specified in temporal logics of knowledge to be verified automatically without needing a specialized theorem prover for temporal logics of knowledge. We present the translation, its correctness, and examples of its use.

}, issn = {0168-7433}, doi = {dx.doi.org/10.1007/s10817-005-7354-1}, author = {Carmen Fernandez-Gago and Ullrich Hustadt and Clare Dixon and Michale Fisher and Boris Konev} } @article {Winfield2005, title = {On the Formal Specification of Emergent Behaviours of Swarm Robotics Systems}, journal = {International Journal of Advanced Robotics Systems}, volume = {2}, year = {2005}, pages = {363-371}, publisher = {SAGE Publishing}, abstract = {

It is a characteristic of swarm robotics that specifying overall emergent swarm behaviours in terms of the low-level behaviours of individual robots is very difficult. Yet if swarm robotics is to make the transition from the laboratory to real-world engineering realisation we need such specifications. This paper explores the use of temporal logic to formally specify, and possibly also prove, the emergent behaviours of a robotic swarm. The paper makes use of a simplified wireless connected swarm as a case study with which to illustrate the approach. Such a formal approach could be an important step toward a disciplined design methodology for swarm robotics.

}, keywords = {Swarm Robotics, temporal resolution}, issn = {1729-8806}, doi = {dx.doi.org/10.5772/5769}, author = {Alan Winfield and Jin Sa and Carmen Fernandez-Gago and Clare Dixon and Michale Fisher} } @inproceedings {Dix04, title = {Using Temporal Logics of Knowledge in the Formal Verification of Security Protocols}, booktitle = {11th International Symposium on Temporal Representation and Reasoning (TIME{\textquoteright}04)}, year = {2004}, pages = {148-151}, publisher = {IEEE Computer Society}, organization = {IEEE Computer Society}, address = {Tatihou, Normandie, France}, abstract = {

Temporal logics of knowledge are useful for reasoning about situations where the knowledge of an agent or component is important, and where change in this knowledge may occur over time. Here we use temporal logics of knowledge to reason about security protocols. We show how to specify part of the Needham-Schroeder protocol using temporal logics of knowledge and prove various properties using a clausal resolution calculus for this logic.

}, keywords = {security protocols, temporal resolution, verification}, issn = {1530-1311}, doi = {http://doi.ieeecomputersociety.org/10.1109/TIME.2004.1314432}, author = {Clare Dixon and Carmen Fernandez-Gago and Michale Fisher and Wiebe van der Hoek} } @inproceedings {Fernandez02, title = {Algorithms for Guiding Clausal Temporal Resolution}, booktitle = {25th Conference on Artificial Intelligence (KI{\textquoteright}02)}, series = {LNAI}, volume = {2479}, year = {2002}, month = {September}, pages = {235-249}, publisher = {Springer}, organization = {Springer}, address = {Aachen, Germany}, abstract = {

Clausal temporal resolution is characterised by a translation of the formulae whose satisfiability is to be established to a normal form, step resolution (similar to classical resolution) on formulae occurring at the same states and temporal resolution between formulae describing properties over a longer period. The most complex part of the method occurs in searching for candidates for the temporal resolution operation, something that may need to be carried out several times. In this paper we consider a new technique for finding the candidates for the temporal resolution operation. Although related to the previously developed external search procedure, this new approach not only allows the temporal resolution operation to be carried out at any moment, but also simplifies any subsequent search required for similar temporal formulae. Finally, in contrast with previous approaches, this search can be seen as an inherent part of the resolution process, rather than an external procedure that is only called in certain situations.} year = {2002

}, keywords = {Temporal logic, temporal resolution}, author = {Carmen Fernandez-Gago and Michale Fisher and Clare Dixon} } @inproceedings {Fernandez01, title = {An Algorithm for Guiding Clausal Temporal Resolution}, booktitle = {4th International Workshop on Strategies in Automated Deduction (STRATEGIES{\textquoteright}01)}, year = {2001}, month = {June}, address = {Siena, Italy}, abstract = {

The clausal resolution method developed for discrete temporal log- ics involves translation to a normal form, classical resolution on formulae within states (termed step resolution) and temporal resolution between states. Step res- olution may generate an unnecessarily large set of clauses. In addition, the most expensive part of the method is the application of the temporal resolution oper- ation. In this paper we develop an algorithm to guide the search for the set of clauses needed for the application of temporal resolution. The algorithm is based on the outputs of a refined temporal resolution rule which allows us to generate temporal resolvents earlier within the process. In particular, this can also help us to avoid unnecessary step resolution and focus search for the most relevant clauses.

}, author = {Carmen Fernandez-Gago and Michale Fisher and Clare Dixon} } @inproceedings {1722, title = {Internet Secure Communications Between Citizens and Public Administrations}, booktitle = {IFIP Conference on Advances in Electronic Government}, year = {2000}, pages = {109-120}, author = {Jorge Davila and Lidia Fuentes and Javier Lopez and Jose maria troya and Antonio Vallecillo} } @inproceedings {1739, title = {Arquitectura Composicional de Seguridad para Servicios Telem{\'a}ticos}, booktitle = {II Jornadas de Ingenier{\'\i}a Telem{\'a}tica (JITEL{\textasciiacute}99)}, year = {1999}, month = {Sep 1999}, pages = {141-148}, isbn = {84-89315-14-0}, author = {Lidia Fuentes and Javier Lopez} }