@inproceedings {Rios2017query, title = {Query Privacy in Sensing-as-a-Service Platforms}, booktitle = {32nd International Conference on ICT Systems Security and Privacy Protection (IFIP SEC 2017)}, series = {IFIP Advances in Information and Communication Technology (AICT)}, volume = {502}, year = {2017}, month = {05/2017}, pages = {141{\textendash}154}, publisher = {Springer}, organization = {Springer}, address = {Roma, Italy}, abstract = {

The Internet of Things (IoT) promises to revolutionize the way we interact with the physical world. Even though this paradigm is still far from being completely realized, there already exist Sensing-as-a-Service (S2aaS) platforms that allow users to query for IoT data. While this model offers tremendous benefits, it also entails increasingly challenging privacy issues. In this paper, we concentrate on the protection of user privacy when querying sensing devices through a semi-trusted S2aaS platform. In particular, we build on techniques inspired by proxy re-encryption and k-anonymity to tackle two intertwined problems, namely query privacy and query confidentiality. The feasibility of our solution is validated both analytically and empirically.\ 

}, doi = {10.1007/978-3-319-58469-0_10}, author = {Ruben Rios and David Nu{\~n}ez and Javier Lopez}, editor = {Sabrina De Capitani di Vimercati and Fabio Martinelli} } @article {najerascn12, title = {User-centric secure integration of personal RFID tags and sensor networks}, journal = {Security and Communication Networks}, volume = {6}, year = {2013}, month = {Oct 2013}, pages = {1177{\textendash}1197}, publisher = {Wiley-Blackwell}, abstract = {

A personal network (PN) should enable the collaboration of user{\textquoteright}s devices and services in a flexible, self-organizing and friendly manner. For such purpose, the PN must securely accommodate heterogeneous technologies with uneven computational and communication resources. In particular, personal RFID tags can enable seamless recognition of user{\textquoteright}s context, provide user authentication and enable novel services enhancing the quality and quantity of data handled by the PN. However, the highly constrained features of common RFID tags and their passive role in the network highlights the need of an adequate secure communication model with personal tags which enables their participation as a member of the PN. In this paper, we present our concept of PN, with special emphasis on the role of RFID and sensor networks, and define a secure architecture for PNs including methods for the secure access to context-aware technologies from both local PN members and the Internet of Things. The PN architecture is designed to support differentiated security mechanisms to maximize the level of security for each type of personal device. Furthermore, we analyze which security solutions available in the literature can be adapted for our architecture, as well as the challenges and security mechanisms still necessary in the secure integration of personal tags.

}, issn = {1939-0114}, doi = {10.1002/sec.684}, url = {http://dx.doi.org/10.1002/sec.684}, author = {Pablo Najera and Rodrigo Roman and Javier Lopez} } @inproceedings {Najera_STM11, title = {Secure architecure for the integration of RFID and sensors in personal networks}, booktitle = {7th International Workshop on Security and Trust Management (STM{\textquoteright}11)}, series = {LNCS}, volume = {7170}, year = {2012}, pages = {207-222}, publisher = {Springer}, organization = {Springer}, address = {Copenhagen, Denmark}, abstract = {

The secure integration of RFID technology into the personal network paradigm, as a context-aware technology which complements body sensor networks, would provide notable benefits to applications and potential services of the PN. RFID security as an independent technology is reaching an adequate maturity level thanks to research in recent years; however, its integration into the PN model, interaction with other network resources, remote users and service providers requires a specific security analysis and a PN architecture prepared to support these resource-constrained pervasive technologies. This paper provides such PN architecture and analysis. Aspects such as the management of personal tags as members of the PN, the authentication and secure communication of PN nodes and remote users with the context-aware technologies, and the enforcement of security and privacy policies are discussed in the architecture.

}, isbn = {978-3-642-29962-9}, doi = {10.1007/978-3-642-29963-6_15}, author = {Pablo Najera and Rodrigo Roman and Javier Lopez} } @inproceedings {Najera_JITEL11, title = {Acceso seguro a nodos RFID en una arquitectura de red personal}, booktitle = {X Jornadas de Ingenier{\'\i}a Telem{\'a}tica (JITEL 2011)}, year = {2011}, month = {09/2011}, pages = {104 - 111}, publisher = {Universidad de Cantabria}, organization = {Universidad de Cantabria}, address = {Santander, Spain}, abstract = {

El paradigma de red personal (PN) permitir\á la interacci\ón y colaboraci\ón del creciente abanico de dispositivos personales. Con tal fin la PN ha de integrar en su seno m\últiples tecnolog\ías heterog\éneas con diversas capacidades computacionales y de comunicaci\ón de forma segura. En particular, la incorporaci\ón de la tecnolog\ía RFID en objetos personales conlleva m\últiples riesgos de seguridad y privacidad que han suscitado un elevado inter\és de la comunidad investigadora en los \últimos a\ños. M\ás all\á de su seguridad de forma aislada, su integraci\ón en la PN y la interacci\ón de \ésta con redes de \área extensa como Internet of Things requieren una arquitectura de red personal adecuada para tal contexto. Este art\ículo proporciona los fundamentos de tal arquitectura segura incluyendo el an\álisis de aspectos como la incorporaci\ón e inicializaci\ón de las restringidas etiquetas RFID en la red personal, la autenticaci\ón tanto de miembros de la PN como de usuarios y servicios remotos en su acceso a las tecnolog\ías de contexto, el control de las pol\íticas de privacidad y el establecimiento de canales seguros de comunicaci\ón supervisados.

}, keywords = {arquitectura software, red personal, Seguridad RFID}, isbn = {978-84-694-5948-5}, author = {Pablo Najera and Rodrigo Roman and Javier Lopez}, editor = {Klaus Hackbarth and Ram{\'o}n Ag{\"u}ero and Roberto Sanz} } @article {Roman2010, title = {A Cross-layer Approach for Integrating Security Mechanisms in Sensor Networks Architectures}, journal = {Wireless Communications and Mobile Computing}, volume = {11}, year = {2011}, pages = {267-276}, publisher = {Wiley}, abstract = {

The wireless sensor networks (WSN) paradigm is especially vulnerable against external and internal attacks. Therefore, it is necessary to develop security mechanisms and protocols to protect them. These mechanisms must become an integral part of the software architecture and network stack of a sensor node. A question that remains is how to achieve this integration. In this paper we check how both academic and industrial solutions tackle this issue, and we present the concept of a transversal layer, where all the different security mechanisms could be contained. This way, all the elements of the architecture can interact with the security mechanisms, and the security mechanisms can have a holistic point of view of the whole architecture. We discuss the advantages of this approach, and also present how the transversal layer concept was applied to a real middleware architecture.

}, keywords = {architecture, cross-layer, middleware, security, Sensor Networks}, issn = {1530-8669}, doi = {10.1002/wcm.1006}, url = {http://dx.doi.org/10.1002/wcm.1006}, author = {Rodrigo Roman and Javier Lopez and Pablo Najera} } @article {1633, title = {Securing the Internet of Things}, journal = {IEEE Computer}, volume = {44}, number = {9}, year = {2011}, month = {Sept 2011}, pages = {51 -58}, publisher = {IEEE}, abstract = {

This paper presents security of Internet of things. In the Internet of Things vision, every physical object has a virtual component that can produce and consume services Such extreme interconnection will bring unprecedented convenience and economy, but it will also require novel approaches to ensure its safe and ethical use. The Internet and its users are already under continual attack, and a growing economy-replete with business models that undermine the Internet{\textquoteright}s ethical use-is fully focused on exploiting the current version{\textquoteright}s foundational weaknesses.

}, keywords = {business models, computer network security, Internet, Internet of Things, Internet security, IoT, virtual component}, issn = {0018-9162}, doi = {10.1109/MC.2011.291}, url = {http://dx.doi.org/10.1109/MC.2011.291}, author = {Rodrigo Roman and Pablo Najera and Javier Lopez} } @inproceedings {Alcaraz2010, title = {Acceso seguro a redes de sensores en SCADA a trav{\'e}s de Internet}, booktitle = {XI Reuni{\'o}n Espa{\~n}ola sobre Criptolog{\'\i}a y Seguridad de la Informaci{\'o}n (RECSI 2010)}, year = {2010}, month = {September}, pages = {337-342}, address = {Tarragona (Spain)}, abstract = {

Las Infraestructuras Cr\íticas (ICs) son monitorizadas por sistemas altamente complejos, conocidos como sistemas SCADA (Sistemas de Control y Adquisici\ón de Datos), cuyo principal soporte se encuentra en las subestaciones, las cuales miden de primera instancia el estado real de tales ICs. Para mejorar este control, la industria est\á actualmente demandando la integraci\ón en el modelo tradicional de dos avances tecnol\ógicos: Internet y las redes de sensores inal\ámbricas. Sin embargo, su incorporaci\ón requiere analizar los requisitos de seguridad que surgen en dicho contexto, as\í como diversos aspectos correlacionados (ej. mantenimiento, rendimiento, seguridad y optimizaci\ón) y, en base a estos, la estrategia de integraci\ón m\ás adecuada para satisfacer dichos requisitos. Este art\ículo proporciona dicho an\álisis en profundidad con el fin de ofrecer un modelo de integraci\ón seguro adecuado para entornos cr\íticos.

}, keywords = {el Internet, Internet of Things, Redes Mesh Inal{\'a}mbrica de Sensores, Sistemas Cr{\'\i}ticos de Control, Sistemas SCADA}, isbn = {978-84-693-3304-4}, url = {http://crises-deim.urv.cat/recsi2010/}, author = {Cristina Alcaraz and Rodrigo Roman and Pablo Najera and Javier Lopez} } @inproceedings {calcaraz10, title = {Wireless Sensor Networks and the Internet of Things: Do We Need a Complete Integration?}, booktitle = {1st International Workshop on the Security of the Internet of Things (SecIoT{\textquoteright}10)}, year = {2010}, month = {December}, pages = {xxxx}, publisher = {IEEE}, organization = {IEEE}, address = {Tokyo (Japan)}, abstract = {

Wireless sensor networks (WSN) behave as a digital skin, providing a virtual layer where the information about the physical world can be accessed by any computational system. As a result, they are an invaluable resource for realizing the vision of the Internet of Things (IoT). However, it is necessary to consider whether the devices of a WSN should be completely integrated into the Internet or not. In this paper, we tackle this question from the perspective of security. While we will mention the different security challenges that may arise in such integration process, we will focus on the issues that take place at the network level.

}, issn = {xxxx}, author = {Cristina Alcaraz and Pablo Najera and Javier Lopez and Rodrigo Roman} }