@article {Alcaraz2023a, title = {Protecting Digital Twin Networks for 6G-enabled Industry 5.0 Ecosystems}, journal = {IEEE Network Magazine}, year = {In Press}, publisher = {IEEE}, issn = {0890-8044}, author = {Cristina Alcaraz and Javier Lopez} } @article {morales2023psi, title = {Private set intersection: A systematic literature review}, journal = {Computer Science Review}, volume = {49}, number = {100567}, year = {2023}, month = {05/2023}, publisher = {Elsevier}, type = {Review}, address = {ScienceDirect}, abstract = {Secure Multi-party Computation (SMPC) is a family of protocols which allow some parties to compute a function on their private inputs, obtaining the output at the end and nothing more. In this work, we focus on a particular SMPC problem named Private Set Intersection (PSI). The challenge in PSI is how two or more parties can compute the intersection of their private input sets, while the elements that are not in the intersection remain private. This problem has attracted the attention of many researchers because of its wide variety of applications, contributing to the proliferation of many different approaches. Despite that, current PSI protocols still require heavy cryptographic assumptions that may be unrealistic in some scenarios. In this paper, we perform a Systematic Literature Review of PSI solutions, with the objective of analyzing the main scenarios where PSI has been studied and giving the reader a general taxonomy of the problem together with a general understanding of the most common tools used to solve it. We also analyze the performance using different metrics, trying to determine if PSI is mature enough to be used in realistic scenarios, identifying the pros and cons of each protocol and the remaining open problems.}, keywords = {privacy, Private set intersection, Secure Multiparty computation, security}, issn = {1574-0137}, doi = {https://doi.org/10.1016/j.cosrev.2023.100567}, url = {https://www.sciencedirect.com/science/article/pii/S1574013723000345}, author = {Daniel Morales and Isaac Agudo and Javier Lopez} } @article {rios2022pmec, title = {Personal IoT Privacy Control at the Edge}, journal = {IEEE Security \& Privacy }, volume = {20}, year = {2022}, month = {01/2022}, pages = {23 - 32}, publisher = {IEEE}, abstract = {

This article introduces a privacy manager for IoT data based on Edge Computing. This poses the advantage that privacy is enforced before data leaves the control of the user, who is provided with a tool to express data sharing preferences based on a novel context-aware privacy language.

}, issn = {1540-7993}, doi = {10.1109/MSEC.2021.3101865}, author = {Ruben Rios and Jose A. Onieva and Rodrigo Roman and Javier Lopez} } @article {anto2021, title = {P2ISE: Preserving Project Integrity in CI/CD Based on Secure Elements}, journal = {Information}, volume = {12}, number = {357}, year = {2021}, month = {08/2021}, publisher = {MDPI}, issn = {2078-2489,}, author = {Mu{\~n}oz, Antonio and Farao, Aristeidis and Casas, Ryan and Xenakis, Christos} } @article {lopez2017ecn, title = {Protecting Industry 4.0 against Advanced Persistent Threats}, journal = {European CIIP Newsletter}, volume = {11}, number = {1}, year = {2017}, month = {03/2017}, pages = {27-29}, publisher = {European CIIP Newsletter}, issn = {NONE}, author = {Javier Lopez and Cristina Alcaraz and Jes{\'u}s Rodriguez and Rodrigo Roman and Juan E. Rubio} } @article {nunez2017proxy, title = {Proxy Re-Encryption: Analysis of Constructions and its Application to Secure Access Delegation}, journal = {Journal of Network and Computer Applications}, volume = {87}, year = {2017}, month = {06/2017}, pages = {193-209}, publisher = {Elsevier}, abstract = {

This paper analyzes the secure access delegation problem, which occurs naturally in the cloud, and postulate that Proxy Re-Encryption is a feasible cryptographic solution, both from the functional and efficiency perspectives. Proxy re-encryption is a special type of public-key encryption that permits a proxy to transform ciphertexts from one public key to another, without the proxy being able to learn any information about the original message. Thus, it serves as a means for delegating decryption rights, opening up many possible applications that require of delegated access to encrypted data. In particular, sharing information in the cloud is a prime example. In this paper, we review the main proxy re-encryption schemes so far, and provide a detailed analysis of their characteristics. Additionally, we also study the efficiency of selected schemes, both theoretically and empirically, based on our own implementation. Finally, we discuss some applications of proxy re-encryption, with a focus on secure access delegation in the cloud.\ 

}, issn = {1084-8045}, doi = {10.1016/j.jnca.2017.03.005}, author = {David Nu{\~n}ez and Isaac Agudo and Javier Lopez} } @article {alcaraz2016POL, title = {Policy Enforcement System for Secure Interoperable Control in Distributed Smart Grid Systems}, journal = {Journal of Network and Computer Applications}, volume = {59}, year = {2016}, month = {01/2016}, pages = {301{\textendash}314}, publisher = {Elsevier}, abstract = {

Interoperability of distributed systems in charge of monitoring and maintaining the different critical domains belonging to Smart Grid scenarios comprise the central topic of this paper. Transparency in control transactions under a secure and reliable architecture is the aim of the policy enforcement system proposed here. The approach is based on the degree of observation of a context and on the role-based access control model defined by the IEC-62351-8 standard. Only authenticated and authorised entities are able to take control of those distributed elements (e.g., IEC-61850 objects) located at distant geographical locations and close to the critical infrastructures (e.g., substations). To ensure the effectiveness of the approach, it is built on graphical-theoretical formulations corresponding to graph theory, where it is possible to illustrate power control networks through power-law distributions whose monitoring relies on structural controllability theory. The interconnection of these distributions is subject to a network architecture based on the concept of the supernode where the interoperability depends on a simple rule-based expert system. This expert system focuses not only on accepting or denying access, but also on providing the means to attend to extreme situations, avoiding, as much as possible, the overloading of the communication. Through one practical study we also show the functionalities of the approach and the benefits that the authorisation itself can bring to the interoperability.\ 

}, issn = {1084-8045}, author = {Cristina Alcaraz and Javier Lopez and Stephen Wolthusen} } @article {rios2015, title = {Probabilistic receiver-location privacy protection in wireless sensor networks}, journal = {Information Sciences}, volume = {321}, year = {2015}, month = {07/2015}, pages = {205 - 223}, publisher = {Elsevier}, abstract = {

Wireless sensor networks (WSNs) are continually exposed to many types of attacks. Among these, the attacks targeted at the base station are the most devastating ones since this essential device processes and analyses all traffic generated in the network. Moreover, this feature can be exploited by a passive adversary to determine its location based on traffic analysis. This receiver-location privacy problem can be reduced by altering the traffic pattern of the network but the adversary may still be able to reach the base station if he gains access to the routing tables of a number of sensor nodes. In this paper we present HISP-NC (Homogenous Injection for Sink Privacy with Node Compromise protection), a receiver-location privacy solution that consists of two complementary schemes which protect the location of the base station in the presence of traffic analysis and node compromise attacks. The HISP-NC data transmission protocol prevents traffic analysis by probabilistically hiding the flow of real traffic with moderate amounts of fake traffic. Moreover, HISP-NC includes a perturbation mechanism that modifies the routing tables of the nodes to introduce some level of uncertainty in attackers capable of retrieving the routing information from the nodes. Our scheme is validated both analytically and experimentally through extensive simulations.

}, keywords = {node capture, privacy, security, traffic analysis, wireless sensor networks}, issn = {0020-0255}, doi = {10.1016/j.ins.2015.01.016}, author = {Ruben Rios and Jorge Cuellar and Javier Lopez} } @article {MoLo15, title = {A practical solution for sealed bid and multi-currency auctions}, journal = {Computers \& Security}, volume = {45}, year = {2014}, month = {09/2014}, pages = {186-198}, publisher = {Elsevier}, abstract = {
This paper introduces a sealed bid and multi-currency auction using secure multiparty computation (SMC). 
Two boolean functions, a comparison and multiplication function, have been designed as required to apply SMC. These functions are applied without revealing any information, not even to trusted third parties such as the auctioneer. A type of Zero Knowledge proof, discreet proof, has been implemented with three variants, interactive, regular and reduced non interactive proofs. These proofs make it possible to verify the correctness of the functions whilst preserving the privacy of the bid values. Moreover, a system performance evaluation of the proposal has been realized on heterogeneous platforms, including a mobile platform. The evaluation concludes that our proposal is practical even on mobile platforms.
}, keywords = {Multi-currency auctions, proof certification, Sealed auctions, Secure Multiparty computation, Zero Knowledge Protocols}, issn = {0167-4048}, doi = {10.1016/j.cose.2014.06.004}, author = {Jose A. Montenegro and Javier Lopez} } @article {agudo2013, title = {A Privacy-Aware Continuous Authentication Scheme for Proximity-Based Access Control}, journal = {Computers \& Security}, volume = {39 (B)}, year = {2013}, month = {11/2013}, pages = {117-126}, publisher = {Elsevier}, abstract = {

Continuous authentication is mainly associated with the use of biometrics to guarantee that a resource is being accessed by the same user throughout the usage period. Wireless devices can also serve as a supporting technology for continuous authentication or even as a complete alternative to biometrics when accessing proximity-based services. In this paper we present the implementation of a secure, non-invasive continuous authentication scheme supported by the use of Wearable Wireless Devices (WWD), which allow users to gain access to proximity-based services while preserving their privacy. Additionally we devise an improved scheme that circumvents some of the limitations of our implementation.

}, issn = {0167-4048}, doi = {10.1016/j.cose.2013.05.004}, author = {Isaac Agudo and Ruben Rios and Javier Lopez} } @article {munoz2012, title = {A performance-oriented monitoring system for security properties in cloud computing applications}, journal = {The Computer Journal}, year = {2012}, publisher = {Oxford Academic}, address = {Reino Unido}, issn = {1460-2067}, author = {Mu{\~n}oz, Antonio}, editor = {Gonz{\'a}lez, Javier} } @article {JordiForne2009, title = {Pervasive Authentication and Authorization Infrastructures for Mobile Users}, journal = {Computer and Security}, volume = {29}, year = {2010}, pages = {501-514}, publisher = {elsevier}, abstract = {

Network and device heterogeneity, nomadic mobility, intermittent connectivity and, more generally, extremely dynamic operating conditions, are major challenges in the design of security infrastructures for pervasive computing. Yet, in a ubiquitous computing environment, limitations of traditional solutions for authentication and authorization can be overcome with a pervasive public key infrastructure (pervasive-PKI). This choice allows the validation of credentials of users roaming between heterogeneous networks, even when global connectivity is lost and some services are temporarily unreachable. Proof-of-concept implementations and testbed validation results demonstrate that strong security can be achieved for users and applications through the combination of traditional PKI services with a number of enhancements like: (i) dynamic and collaborative trust model, (ii) use of attribute certificates for privilege management, and (iii) modular architecture enabling nomadic mobility and enhanced with reconfiguration capabilities.

}, issn = {0167-4048}, doi = {10.1016/j.cose.2009.09.001}, author = {Jordi Forne and Francisca Hinajeros and Andres Marin and Florina Almenarez and Javier Lopez and Jose A. Montenegro and Marc Lacoste and Daniel Diaz} } @article {JavierLopez2004b, title = {PKI Design Based on the Use of On-line Certification Authorities}, journal = {International Journal of Information Security (IJIS)}, volume = {2}, number = {2}, year = {2004}, pages = {91-102}, publisher = {Springer}, abstract = {

Public-Key Infrastructures (PKIs) are considered the basis of the protocols and tools needed to guarantee the security demanded for new Internet applications like electronic commerce, government-citizen relationships and digital distribution. This paper introduces a new infrastructure design, Cert{\textquoteright}eM, a key management and certification system that is based on the structure of the electronic mail service and on the principle of near-certification. Cert{\textquoteright}eM provides secure means to identify users and distribute their public-key certificates, enhances the efficiency of revocation procedures, and avoids scalability and synchronization problems. Because we have considered the revocation problem as priority in the design process, and with a big influence in the rest of the PKI components, we have developed an alternative solution to the use of Certificate Revocation Lists (CRLs), which has become one of the strongest points in this new scheme.

}, issn = {1615-5262}, author = {Javier Lopez and Antonio Mana and Jose A. Montenegro and Juan J. Ortega} } @article {1711, title = {Proyecto CASENET: Integraci{\'o}n del Dise{\~n}o y An{\'a}lisis de Protocolos Segurospara el Comerio-e}, journal = {Revista SIC: Seguridad en Inform{\'a}tica y Comunicaciones}, volume = {49}, year = {2002}, pages = {1-2}, issn = {1136-06}, author = {Javier Lopez} }