@inproceedings {morales2023metacom, title = {Integration of MPC into Besu through an extended private transaction model}, booktitle = {IEEE International Conference on Metaverse Computing, Networking and Applications}, year = {2023}, month = {06/2023}, address = {Kyoto, Japan}, abstract = {In the last few years we have seen many different approaches to incorporate privacy features to blockchains. In the area of cryptocurrencies that would normally mean protecting the identity of the owner of some funds, but there are other applications where privacy is even more important, especially in permissioned blockchains. Permissioned blockchain platforms, such as Hyperledger Besu or Hyperledger Fabric, already include the concept of private transactions, which essentially defines a sub-group of the blockchain where their participants share some private data. We want to go one step ahead and propose an extended model for private transactions where the different participants can have a separated view of the same transaction, allowing the integration of Multi-party Computation protocols in the blockchain. Our work extends Hyperledger Besu{\textquoteright}s design for private transactions, offering better security properties and a finer grain customization. We cover two specific MPC examples, Private Set Intersection and Byzantine Fault-Tolerant Random Number Generation, and propose a mechanism to run them using smart contract interfaces. }, keywords = {blockchain, hyperledger besu, privacy, secure multi-party computation}, author = {Daniel Morales and Isaac Agudo and Javier Lopez} } @inproceedings {2016, title = {AndroCIES: Automatizaci{\'o}n de la certificaci{\'o}n de seguridad para aplicaciones Android}, booktitle = {XVII Reuni{\'o}n Espa{\~n}ola sobre Criptolog{\'\i}a y Seguridad de la Informaci{\'o}n (RECSI 2022)}, volume = {265}, year = {2022}, month = {10/2022}, pages = {192-197}, publisher = {Ediciones Universidad Cantabria}, organization = {Ediciones Universidad Cantabria}, address = {Santander, Spain}, abstract = {

El auge de las plataformas m{\'o}viles est{\'a} impulsando el desarrollo de un gran n{\'u}mero de aplicaciones, muchas de las cuales salen al mercado sin las convenientes comprobaciones de seguridad. Recientemente, Google est{\'a} apostando por hacer este problema m{\'a}s visible y concienciar a los usuarios de la necesidad de instalar aplicaciones verificadas por laboratorios independientes. Sin embargo, la certificaci{\'o}n de aplicaciones suele ser una tarea ardua y no exenta de errores. Por ello, en este trabajo, presentamos la herramienta AndroCIES, que es capaz de automatizar en gran medida las evaluaciones necesarias para la certificaci{\'o}n de aplicaciones m{\'o}viles, reduciendo en torno a un 20\% el tiempo empleado en este proceso.

}, keywords = {an{\'a}lisis est{\'a}tico, aplicaciones, certificaci{\'o}n, seguridad}, author = {Manuel Ruiz and Ruben Rios and Rodrigo Roman and Mu{\~n}oz, Antonio and Juan Manuel Mart{\'\i}nez and Jorge Wallace} } @inproceedings {morales2022cc, title = {Real-time Crowd Counting based on Wearable Ephemeral IDs}, booktitle = {19th International Conference on Security and Cryptography (SECRYPT 2022)}, year = {2022}, month = {07/2022}, pages = {249-260}, publisher = {Scitepress}, organization = {Scitepress}, address = {Lisbon}, abstract = {Crowd Counting is a very interesting problem aiming at counting people typically based on density averages and/or aerial images. This is very useful to prevent crowd crushes, especially on urban environments with high crowd density, or to count people in public demonstrations. In addition, in the last years, it has become of paramount importance for pandemic management. For those reasons, giving users automatic mechanisms to anticipate high risk situations is essential. In this work, we analyze ID-based Crowd Counting, and propose a real-time Crowd Counting system based on the Ephemeral ID broadcast by contact tracing applications on wearable devices. We also performed some simulations that show the accuracy of our system in different situations. }, keywords = {Crowd Counting, IDS, Pandemics, privacy, Secure Multiparty computation}, isbn = {978-989-758-590-6}, issn = {2184-7711}, doi = {10.5220/0011327200003283}, author = {Daniel Morales and Isaac Agudo and Javier Lopez} } @inproceedings {munoz2020icitpm, title = {ICITPM: Integrity validation of software in iterative Continuous Integration through the use of Trusted Platform Module (TPM)}, booktitle = {1st Workshop on Dependability and Safety Emerging Cloud and Fog Systems (DeSECSyS) - Colocated with ESORICS, Guildford (United Kingdom). September 2020.}, year = {2020}, pages = {147{\textendash}165}, publisher = {Springer}, organization = {Springer}, author = {Mu{\~n}oz, Antonio}, editor = {Farao, Aristeidis} } @inproceedings {1985, title = {Desarrollo de un sem{\'a}foro inteligente basado en comunicaciones seguras}, booktitle = {XIV Jornadas de Ingenier{\'\i}a Telem{\'a}tica (JITEL 2019)}, year = {2019}, month = {10/2019}, abstract = {

En los nuevos paradigmas de movilidad surgidos durante los {\'u}ltimos a{\~n}os y en aquellos a{\'u}n por llegar ha quedado patente la necesidad de modernizar la infraestructura viaria y los elementos de se{\~n}alizaci{\'o}n y gesti{\'o}n del tr{\'a}fico. En el presente trabajo se presenta una propuesta para esta nueva generaci{\'o}n de dispositivos de gesti{\'o}n del tr{\'a}fico: un prototipo de sem{\'a}foro inteligente conectado que implementa diversas medidas de seguridad. Adem{\'a}s de las tradicionales se{\~n}ales luminosas, los usuarios de la v{\'\i}a pueden conocer a trav{\'e}s de sus dispositivos el estado del sem{\'a}foro, adem{\'a}s de otra informaci{\'o}n complementaria a trav{\'e}s de la difusi{\'o}n de mensajes BLE firmados con criptograf{\'\i}a de curva el{\'\i}ptica. A su vez, el sem{\'a}foro puede ser gestionado remotamente a trav{\'e}s de la tecnolog{\'\i}a LTE Cat M1 protegida por TLS. Esto abre la puerta, entre otros, a facilitar el tr{\'a}nsito de los veh{\'\i}culos de emergencia cuando estos se acercan a un cruce o modificar el tiempo de los estados del ciclo en funci{\'o}n de las necesidades del tr{\'a}fico.

}, author = {Isaac Agudo and Manuel Montenegro-G{\'o}mez} } @inproceedings {RubioESORICS2019, title = {Enhancing Security and Dependability of Industrial Networks with Opinion Dynamics}, booktitle = {European Symposium on Research in Computer Security (ESORICS2019)}, volume = {11736}, year = {2019}, month = {09/2019}, pages = {263-280}, doi = {https://doi.org/10.1007/978-3-030-29962-0_13}, author = {Juan E. Rubio and Mark Manulis and Cristina Alcaraz and Javier Lopez} } @inproceedings {morales2019, title = {Prueba de concepto de Autoridad de Certificaci{\'o}n usando Computaci{\'o}n Segura Multiparte}, booktitle = {XIV Jornadas de Ingenier{\'\i}a Telem{\'a}tica}, year = {2019}, month = {10/2019}, pages = {50-53}, address = {Zaragoza}, abstract = {Este trabajo pretende analizar el paradigma de la Computaci{\'o}n Segura Multiparte y sus posibles aplicaciones en el campo de la criptograf{\'\i}a. Se plantea como modelo alternativo, mas escalable y seguro al uso de m{\'o}dulos hardware de seguridad para aplicaciones que requieran de Terceras Partes Confiables. Concretamente, se ha integrado un protocolo de criptograf{\'\i}a RSA multiparte con la librer{\'\i}a certbuilder, para la creaci{\'o}n de certificados X.509. De esta forma se asegura que la creaci{\'o}n de los certificados ra{\'\i}z de la Infraestructura de Clave Publica se realiza de forma que la generaci{\'o}n de claves y firma de este se ejecute {\'\i}ntegramente sobre el sistema multiparte, con un modelo de tres partes que trabaja con circuitos aritm{\'e}ticos, sin que ninguna de ellas, de forma aislada, tenga posibilidad de comprometer la clave privada correspondiente. Para comprobar la viabilidad del sistema se han realizado pruebas de generaci{\'o}n de certificados con diferentes longitudes de clave, siendo el proceso determinante la creaci{\'o}n de las claves. Los elevados tiempos hacen que una aplicaci{\'o}n como esta no sea asumible en otros escenarios, pero creemos que para el caso de la creaci{\'o}n de los certificados ra{\'\i}z de una infraestructura de clave p{\'u}blica las garant{\'\i}as avanzadas de seguridad compensan el tiempo extra. }, keywords = {privacy, Secure Multiparty computation}, isbn = {978-84-09-21112-8}, doi = {10.26754/uz.978-84-09-21112-8}, author = {Daniel Morales and Isaac Agudo} } @inproceedings {Rios2017query, title = {Query Privacy in Sensing-as-a-Service Platforms}, booktitle = {32nd International Conference on ICT Systems Security and Privacy Protection (IFIP SEC 2017)}, series = {IFIP Advances in Information and Communication Technology (AICT)}, volume = {502}, year = {2017}, month = {05/2017}, pages = {141{\textendash}154}, publisher = {Springer}, organization = {Springer}, address = {Roma, Italy}, abstract = {

The Internet of Things (IoT) promises to revolutionize the way we interact with the physical world. Even though this paradigm is still far from being completely realized, there already exist Sensing-as-a-Service (S2aaS) platforms that allow users to query for IoT data. While this model offers tremendous benefits, it also entails increasingly challenging privacy issues. In this paper, we concentrate on the protection of user privacy when querying sensing devices through a semi-trusted S2aaS platform. In particular, we build on techniques inspired by proxy re-encryption and k-anonymity to tackle two intertwined problems, namely query privacy and query confidentiality. The feasibility of our solution is validated both analytically and empirically.\ 

}, doi = {10.1007/978-3-319-58469-0_10}, author = {Ruben Rios and David Nu{\~n}ez and Javier Lopez}, editor = {Sabrina De Capitani di Vimercati and Fabio Martinelli} } @inproceedings {moyano15SAC, title = {Engineering Trust- and Reputation-based Security Controls for Future Internet Systems}, booktitle = {The 30th ACM/SIGAPP Symposium On Applied Computing (SAC 2015)}, year = {2015}, month = {08/2015}, pages = {1344-1349}, address = {Salamanca, Spain}, isbn = {978-1-4503-3196-8}, doi = {10.1145/2695664.2695713}, author = {Francisco Moyano and Carmen Fernandez-Gago and Kristian Beckers and Maritta Heisel} } @inproceedings {alcaraz2013controla, title = {Multi-Round Attacks on Structural Controllability Properties for Non-Complete Random Graphs}, booktitle = {The 16th Information Security Conference (ISC)}, volume = {7807}, year = {2015}, month = {09/2015}, pages = {140{\textendash}151}, publisher = {Springer}, organization = {Springer}, address = {Springer International Publishing Switzerland}, abstract = {

\ The notion of controllability, informally the ability to force a system\ into a desired state in a finite time or number of steps, is most closely associated with control systems such as those used to maintain power networks and other critical infrastructures, but has wider relevance in distributed systems. It is clearly highly desirable to understand under which conditions attackers may be able to disrupt legitimate control, or to force overriding controllability themselves. Following recent results by Liu et al., there has been considerable interest also in graph-theoretical interpretation of Kalman controllability originally introduced by Lin, structural controllability. This permits the identification of sets of driver nodes with the desired state-forcing property, but determining such nodes\ is aW[2]-hard problem. To extract these nodes and represent the control relation, here we apply the POWER DOMINATING SET problem and investigate the effects of targeted iterative multiple-vertex removal. We report the impact that different attack strategies with multiple edge and vertex removal will have, based on underlying non-complete graphs, with an emphasis on power-law random graphs with different degree sequences.

}, doi = {10.1007/978-3-319-27659-5 10}, author = {Cristina Alcaraz and Estefania Etcheves Miciolino and Stephen Wolthusen} } @inproceedings {moyano14smartgridsec, title = {Enhancing Problem Frames with Trust and Reputation for Analyzing Smart Grid Security Requirements}, booktitle = {Smart Grid Security - Second International Workshop}, series = {LNCS}, volume = {8448}, year = {2014}, month = {Aug}, pages = {166-180}, publisher = {Springer}, organization = {Springer}, address = {Munich}, keywords = {model-driven engineering, problem frames, Reputation, security requirements engineering, Trust, UML4PF}, isbn = {978-3-319-10328-0}, issn = {0302-9743}, doi = {10.1007/978-3-319-10329-7_11}, author = {Francisco Moyano and Carmen Fernandez-Gago and Kristian Beckers and Maritta Heisel}, editor = {Jorge Cuellar} } @inproceedings {moyano14caise, title = {Trust-Aware Decision-Making Methodology for Cloud Sourcing}, booktitle = {26th International Conference on Advanced Information Systems Engineering (CAiSE 2014)}, series = {LCNS}, volume = {8484}, year = {2014}, month = {06/2014}, pages = {136-149}, publisher = {Springer}, organization = {Springer}, address = {Thessaloniki}, abstract = {

Cloud sourcing consists of outsourcing data, services and infrastructure to cloud providers. Even when this outsourcing model brings advantages to cloud customers, new threats also arise as sensitive data and critical IT services are beyond customers{\textquoteright} control. When an organization considers moving to the cloud, IT decision makers must select a cloud provider and must decide which parts of the organization will be outsourced and to which extent. This paper proposes a methodology that allows decision makers to evaluate their trust in cloud providers. The methodology provides a systematic way to elicit knowledge about cloud providers, quantify their trust factors and aggregate them into trust values that can assist the decision-making process. The trust model that we propose is based on trust intervals, which allow capturing uncertainty during the evaluation, and we define an operator for aggregating these trust intervals. The methodology is applied to an eHealth scenario.

}, keywords = {Cloud Computing, decision making, domain knowledge elicitation, security, Trust}, isbn = {978-3-319-07880-9}, issn = {0302-9743}, doi = {10.1007/978-3-319-07881-6}, author = {Francisco Moyano and Kristian Beckers and Carmen Fernandez-Gago}, editor = {Matthias Jarke and John Mylopoulos and Christoph Quix and Colette Rolland and Yannis Manolopoulos and Haralambos Mouratidis and Jennifer Horkoff} } @inproceedings {moyano2012stm, title = {Building Trust and Reputation In: A Development Framework for Trust Models Implementation}, booktitle = {8th International Workshop on Security and Trust Management (STM 2012)}, series = {LNCS}, volume = {7783}, year = {2013}, pages = {113-128}, publisher = {Springer}, organization = {Springer}, address = {Pisa}, abstract = {

During the last years, many trust and reputation models have been proposed, each one targeting different contexts and purposes, and with their own particularities. While most contributions focus on defining ever-increasing complex models, little attention has been paid to the process of building these models inside applications during their implementation. The result is that models have traditionally considered as ad-hoc and after-the-fact solutions that do not always fit with the design of the application. To overcome this, we propose an object-oriented development framework onto which it is possible to build applications that require functionalities provided by trust and reputation models. The framework is extensible and flexible enough to allow implementing an important variety of trust models. This paper presents the framework, describes its main components, and gives examples on how to use it in order to implement three different trust models.

}, isbn = {978-3-642-38004-4}, issn = {0302-9743}, doi = {10.1007/978-3-642-38004-4}, author = {Francisco Moyano and Carmen Fernandez-Gago and Javier Lopez}, editor = {Audung J{\o}sang and Pierangela Samarati and Marinella Petrocchi} } @inproceedings {moyano2013ares, title = {Detecting Insider Threats: a Trust-Aware Framework}, booktitle = {8th International Conference on Availability, Reliability and Security}, year = {2013}, month = {Nov 2013}, pages = {121-130}, publisher = {IEEE}, organization = {IEEE}, address = {Regensburg, Germany}, abstract = {

The number of insider threats hitting organizations and big enterprises is rapidly growing. Insider threats occur when trusted employees misuse their permissions on organizational assets. Since insider threats know the organization and its processes, very often they end up undetected. Therefore, there is a pressing need for organizations to adopt preventive mechanisms to defend against insider threats. In this paper, we propose a framework for insiders identification during the early requirement analysis of organizational settings and of its IT systems. The framework supports security engineers in the detection of insider threats and in the prioritization of them based on the risk they represent to the organization. To enable the automatic detection of insider threats, we extend the SI* requirement modeling language with an asset model and a trust model. The asset model allows associating security properties and sensitivity levels to assets. The trust model allows specifying the trust level that a user places in another user with respect to a given permission on an asset. The insider threats identification leverages the trust levels associated with the permissions assigned to users, as well as the sensitivity of the assets to which access is granted. We illustrate the approach based on a patient monitoring scenario.

}, isbn = {978-0-7695-5008-4}, doi = {10.1109/ARES.2013.22}, author = {Federica Paci and Carmen Fernandez-Gago and Francisco Moyano} } @inproceedings {rios2013b, title = {Ocultaci{\'o}n de la estaci{\'o}n base en redes inal{\'a}mbricas de sensores}, booktitle = {XI Jornadas de Ingenier{\'\i}a Telem{\'a}tica (JITEL 2013)}, year = {2013}, month = {Oct 2013}, pages = {481-486}, publisher = {Asociaci{\'o}n de Telem{\'a}tica}, organization = {Asociaci{\'o}n de Telem{\'a}tica}, address = {Granada}, abstract = {

La estaci{\'o}n base es el elemento m{\'a}s importante en un red de sensores y, por tanto, es necesario evitar que un atacante pueda hacerse con el control de este valioso dispositivo. Para ello, el atacante puede valerse tanto de t{\'e}cnicas de an{\'a}lisis de tr{\'a}fico como de la captura de nodos. En este trabajo presentamos un esquema que consta de dos fases, la primera est{\'a} dedicada a homogeneizar los patrones de tr{\'a}fico y la segunda encargada de perturbar las tablas de rutas de los nodos. Ambas fases permiten mantener a la estaci{\'o}n base fuera del alcance del atacante con un coste computacional insignificante y un consumo energ{\'e}tico moderado. La validez de nuestro esquema ha sido validada anal{\'\i}ticamente y a trav{\'e}s de numerosas simulaciones.

}, isbn = {978-84-616-5597-7}, author = {Ruben Rios and Jorge Cuellar and Javier Lopez}, editor = {Jes{\'u}s E. D{\'\i}az Verdejo and Jorge Navarro Ortiz and Juan J. Ramos Mu{\~n}oz} } @inproceedings {1810, title = {Structural Controllability of Networks for Non-Interactive Adversarial Vertex Removal}, booktitle = {8th International Conference on Critical Information Infrastructures Security}, volume = {8328}, year = {2013}, pages = {120-132}, publisher = {Springer}, organization = {Springer}, address = {Amsterdam, The Netherlands}, abstract = {

The problem of controllability of networks arises in a number of different\ domains, including in critical infrastructure systems where control must be\ maintained continuously. Recent work by Liu et al. has renewed interest in the\ seminal work by Lin on structural controllability, providing a graph-theoretical\ interpretation. This allows the identification of driver nodes capable of forcing the\ system into a desired state, which implies an obvious target for attackers wishing\ to disrupt the network control. Several methods for identifying driver nodes\ exist, but require undesirable computational complexity. In this paper, we therefore\ investigate the ability to regain or maintain controllability in the presence\ of adversaries able to remove vertices and implicit edges of the controllability\ graph. For this we rely on the POWER DOMINATING SET (PDS) formulation for\ identifying the control structure and study different attack strategies for multiple\ network models. As the construction of a PDS for a given graph is not unique,\ we further investigate different strategies for PDS construction, and provide a\ simulative evaluation.

}, issn = {0302-9743}, doi = {http://link.springer.com/chapter/10.1007\%2F978-3-319-03964-0_11}, author = {Cristina Alcaraz and Estefania Etcheves Miciolino and Stephen Wolthusen} } @inproceedings {moyano13wisse, title = {Towards Engineering Trust-aware Future Internet Systems}, booktitle = {3rd International Workshop on Information Systems Security Engineering (WISSE 2013)}, series = {LNBIP}, volume = {148}, year = {2013}, month = {Jun 2013}, pages = {490-501}, publisher = {Springer-Verlag}, organization = {Springer-Verlag}, address = {Valencia}, abstract = {

Security must be a primary concern when engineering Future Internet (FI) systems and applications. In order to achieve secure solutions, we need to capture security requirements early in the Software Development Life Cycle (SDLC). Whereas the security community has traditionally focused on providing tools and mechanisms to capture and express hard security requirements (e.g. confidentiality), little attention has been paid to other important requirements such as trust and reputation. We argue that these soft security requirements can leverage security in open, distributed, heterogeneous systems and applications and that they must be included in an early phase as part of the development process. In this paper we propose a UML extension for specifying trust and reputation requirements, and we apply it to an eHealth case study.

}, keywords = {Reputation, Requirements Engineering, Secure Design, Trust}, isbn = {978-3-642-38489-9}, issn = {1865-1348}, doi = {10.1007/978-3-642-38490-5}, url = {http://link.springer.com/book/10.1007/978-3-642-38490-5/page/3}, author = {Francisco Moyano and Carmen Fernandez-Gago and Javier Lopez}, editor = {Xavier Franch and Pnina Soffer} } @inproceedings {moyano2013ifiptm, title = {Towards Trust-Aware and Self-Adaptive Systems}, booktitle = {7th IFIP WG 11.11 International Conference on Trust Management (IFIPTM 2013)}, series = {AICT}, volume = {401}, year = {2013}, month = {Jun 2013}, pages = {255-262}, publisher = {Springer}, organization = {Springer}, address = {Malaga}, abstract = {

The Future Internet (FI) comprises scenarios where many heterogeneous and dynamic entities must interact to provide services (e.g., sensors, mobile devices and information systems in smart city scenarios). The dynamic conditions under which FI applications must execute call for self-adaptive software to cope with unforeseeable changes in the application environment. Software engineering currently provides frameworks to develop reasoning engines that automatically take reconfiguration decisions and that support the runtime adaptation of distributed, heterogeneous applications. However, these frameworks have very limited support to address security concerns of these application, hindering their usage for FI scenarios. We address this challenge by enhancing self-adaptive systems with the concepts of trust and reputation. Trust will improve decision-making processes under risk and uncertainty, in turn improving security of self-adaptive FI applications. This paper presents an approach that includes a trust and reputation framework into a platform for adaptive, distributed component-based systems, thus providing software components with new abilities to include trust in their reasoning process.

}, isbn = {978-3-642-38323-6}, issn = {1868-4238}, doi = {10.1007/978-3-642-38323-6}, author = {Francisco Moyano and Benoit Baudry and Javier Lopez}, editor = {Carmen Fernandez-Gago and Isaac Agudo and Fabio Martinelli and Siani Pearson} } @inproceedings {moyano2013essosds, title = {A Trust and Reputation Framework}, booktitle = {Doctoral Symposium of the International Symposium on Engineering Secure Software and Systems (ESSoS-DS 2013)}, series = {CEUR-WS}, volume = {965}, year = {2013}, pages = {7-12}, publisher = {CEUR-WS}, organization = {CEUR-WS}, address = {Par{\'\i}s}, abstract = {

The Future Internet is posing new security challenges as their scenarios are bringing together a huge amount of stakeholders and devices that must interact under unforeseeable conditions. In addition, in these scenarios we cannot expect entities to know each other beforehand, and therefore, they must be involved in risky and uncertain collaborations. In order to minimize threats and security breaches, it is required that a well-informed decision-making process is in place, and it is here where trust and reputation can play a crucial role. Unfortunately, services and applications developers are often unarmed to address trust and reputation requirements in these scenarios. To overcome this limitation, we propose a trust and reputation framework that allows developers to create trust- and reputation-aware applications.

}, issn = {1613-0073}, url = {http://ceur-ws.org/Vol-965/}, author = {Francisco Moyano and Carmen Fernandez-Gago and Javier Lopez}, editor = {Maritta Heisel and Eda Marchetti} } @inproceedings {moyano2012trustbus, title = {A Conceptual Framework for Trust Models}, booktitle = {9th International Conference on Trust, Privacy \& Security in Digital Business (TrustBus 2012)}, series = {LNCS}, volume = {7449}, year = {2012}, month = {Sep 2012}, pages = {93-104}, publisher = {Springer Verlag}, organization = {Springer Verlag}, address = {Vienna}, abstract = {

During the last twenty years, a huge amount of trust and reputation models have been proposed, each of them with their own particularities and targeting different domains. While much effort has been made in defining ever-increasing complex models, little attention has been paid to abstract away the particularities of these models into a common set of easily understandable concepts. We propose a conceptual framework for computational trust models that will be used for analyzing their features and for comparing heterogeneous and relevant trust models.

}, isbn = {978-3-642-32286-0}, issn = {0302-9743}, doi = {10.1007/978-3-642-32287-7}, author = {Francisco Moyano and Carmen Fernandez-Gago and Javier Lopez}, editor = {Fischer-H{\"u}bner, Simone and Katsikas, Sokratis and Quirchmayr, Gerald} } @inproceedings {moyano12qasa, title = {Implementing Trust and Reputation Systems: A Framework for Developers{\textquoteright} Usage}, booktitle = {International Workshop on Quantitative Aspects in Security Assurance}, year = {2012}, address = {Pisa}, abstract = {

During the last decades, a huge amount of trust and reputation models have been proposed, each of them with their own particularities and targeting different domains. While much effort has been made in defining ever-increasing complex models, little attention has been paid to abstract away the particularities of these models into a common set of easily understandable concepts. We propose a conceptual framework for computational trust models that is used for developing a component-oriented development framework that aims to assist developers during the implementation phase.

}, author = {Francisco Moyano and Carmen Fernandez-Gago and Javier Lopez} } @inproceedings {Rios2012d, title = {Robust Probabilistic Fake Packet Injection for Receiver-Location Privacy in WSN}, booktitle = {17th European Symposium on Research in Computer Security (ESORICS 2012)}, series = {LNCS}, volume = {7459}, year = {2012}, month = {Sep 2012}, pages = {163-180}, publisher = {Springer}, organization = {Springer}, address = {Pisa, Italy}, abstract = {

The singular communication model in wireless sensor networks (WSNs) originate pronounced traffic patterns that allow a local observer to deduce the location of the base station, which must be kept secret for both strategical and security reasons. In this work we present a new receiver-location privacy solution called HISP (Homogenous Injection for Sink Privacy). Our scheme is based on the idea of hiding the flow of real traffic by carefully injecting fake traffic to homogenize the transmissions from a node to its neighbors. This process is guided by a lightweight probabilistic approach ensuring that the adversary cannot decide with sufficient precision in which direction to move while maintaining a moderate amount of fake traffic. Our system is both validated analytically and experimentally through simulations.

}, isbn = {978-3-642-33167-1}, issn = {0302-9743}, doi = {10.1007/978-3-642-33167-1_10}, author = {Ruben Rios and Jorge Cuellar and Javier Lopez}, editor = {Sara Foresti and Moti Yung and Fabio Martinelli} } @inproceedings {moyano2012essosds, title = {Service-Oriented Trust and Reputation Architecture}, booktitle = {Proceedings of the Doctoral Symposium of the International Symposium on Engineering Secure Software and Systems (ESSoS-DS 2012)}, series = {CEUR-WS}, volume = {834}, year = {2012}, note = {

Partner:UMA, Project:NESSoS

}, pages = {41-46}, publisher = {CEUR-WS}, organization = {CEUR-WS}, address = {Eindhoven}, abstract = {

As the Future Internet arrives, more complex, service-based applications are spreading. These applications pose several challenges, including the huge amount of entities that must interact and their het- erogeneity. The success of these applications depends on the collaboration and communication of these entities, that might belong to different or- ganizations and administrative domains. Therefore, trust and reputation become two crucial issues. We propose the specification and design of a service-based security architecture that stresses the delivery of trust and reputation services to any application that might require them.

}, issn = {1613-0073}, url = {http://ceur-ws.org/Vol-834/paper7_essosds2012.pdf}, author = {Francisco Moyano and Carmen Fernandez-Gago and Javier Lopez}, editor = {Jorge Cuellar and Nora Koch} } @inproceedings {Moyano_ESSoS12, title = {A Task Ordering Approach for Automatic Trust Establishment}, booktitle = {Proceedings of the 2012 International Symposium on Engineering Secure Software and Systems (ESSoS 2012)}, series = {LNCS}, volume = {7159}, year = {2012}, month = {Feb 2012}, pages = {76{\textendash}89}, publisher = {Springer}, organization = {Springer}, address = {Eindhoven, The Netherlands}, abstract = {

Trust has become essential in computer science as a way of assisting the process of decision-making, such as access control. In any system, several tasks may be performed, and each of these tasks might pose different associated trust values between the entities of the system. For instance, in a file system, reading and overwriting a file are two tasks that pose different trust values between the users who can carry out these tasks. In this paper, we propose a simple model for automatically establishing trust relationships between entities considering an established order among tasks.

}, keywords = {task ordering, trust evaluation, trust graph}, doi = {10.1007/978-3-642-28166-2_8}, author = {Francisco Moyano and Carmen Fernandez-Gago and Isaac Agudo and Javier Lopez}, editor = {Gilles Barthe and Ben Livshits and Riccardo Scandariato} } @inproceedings {1622, title = {Engineering Secure Future Internet Services}, booktitle = {Future Internet Assembly 2011: Achievements and Technological Promises (FIA 2011)}, series = {LNCS}, volume = {6656}, year = {2011}, pages = {177-191}, publisher = {Springer Berlin Heidelberg}, organization = {Springer Berlin Heidelberg}, address = {Budapest}, abstract = {

In this paper we analyze the need and the opportunity forestablishing a discipline for engineering secure Future Internet Services,typically based on research in the areas of software engineering, of serviceengineering and security engineering. Generic solutions that ignore thecharacteristics of Future Internet services will fail, yet it seems obviousto build on best practices and results that have emerged from variousresearch communities.The paper sketches various lines of research and strands within each lineto illustrate the needs and to sketch a community wide research plan. Itwill be essential to integrate various activities that need to be addressedin the scope of secure service engineering into comprehensive softwareand service life cycle support. Such a life cycle support must deliverassurance to the stakeholders and enable risk and cost management forthe business stakeholders in particular. The paper should be considereda call for contribution to any researcher in the related sub domains inorder to jointly enable the security and trustworthiness of Future Internetservices.

}, isbn = {978-3-642-20897-3}, issn = {0302-9743}, author = {W. Joosen and Javier Lopez and F. Martinelli and F. Massacci} } @inproceedings {JoseA.Montenegro2010, title = {Computacion Segura Multiparte Aplicada a Subastas Electr{\'o}nicas}, booktitle = {IX Jornadas de Ingenier{\'\i}a Telemenatica (JITEL 2010)}, year = {2010}, month = {Octubre}, abstract = {

La confidencialidad ha pasado de ser un requisito de seguridad a ser considerado como requisito funcional y de obligado cumplimiento e inclusi\ón en todos los sistemas de comunicaciones. Un inconveniente que presenta las t\écnicas criptogr\áficas, utilizadas para obtener la confidencialidad de la informaci\ón, surge cuando varias entidades se ven forzadas a compartir informaci\ón secreta para realizar tareas puntuales de colaboraci\ón, ya que las primitivas tradicionales utilizadas para conseguir la confidencialidad resultan poco flexibles. La situaci\ón ideal permitir\ía hacer posible dicha colaboraci\ón sin que ninguna de las partes revele la informaci\ón aportada. En este escenario entra en juego la tecnolog\ía de Computaci\ón Segura Multiparte (CSM) que posibilita realizar operaciones con la informaci\ón compartida sin tener que hacerla p\ública. Este trabajo muestra una soluci\ón CSM aplicada a una subasta electr\ónica que permite la realizaci\ón de la subasta sin que las apuestas sean reveladas a ning\ún participante, incluyendo el subastador, por lo que no necesita el estableciendo de ninguna autoridad confiable. Aunque la literatura ofrece una amplia variedad de propuestas te\óricas de CSM desde su creaci\ón en la d\écada de los ochenta, no es com\ún su aplicacion pr\áctica en situaciones reales.

}, author = {Jose A. Montenegro and Javier Lopez and Rene Peralta} } @inproceedings {Agudo2010, title = {Distribuci{\'o}n segura de componentes software basada en OpenID}, booktitle = {XI Reuni{\'o}n Espa{\~n}ola sobre Criptolog{\'\i}a y Seguridad de la Informaci{\'o}n (RECSI 2010)}, year = {2010}, month = {September}, address = {Tarragona, Spain}, abstract = {

En la actualidad, cada vez son m\ás frecuentes los ataques software mediante la utilizaci\ón de malware o sustituci\ón de programas (o componentes) en los repositorios a los cuales los usuarios finales (o m\áquinas) acceden. Esta situaci\ón se ve de alguna manera acentuada con el dinamismo existente en la programaci\ón y ejecuci\ón de estos componentes, en la que distintos desarrolladores pueden participar para desplegar un determinado servicio o parte de \él. Por ello, en este art\ículo se presenta una soluci\ón para la distribuci\ón de c\ódigo de forma segura usando OpenID y firmas con certificados de clave p\ública de corta duraci\ón. De esta forma, se consigue un compromiso de seguridad que permite distribuir c\ódigo firmado sin la necesidad de que los desarrolladores dispongan a priori de un certificado espec\ífico. Presentamos adem\ás algunos detalles acerca de la implementaci\ón realizada para hacer realidad este dise\ño.

}, isbn = {978-84-693-3304-4}, author = {Isaac Agudo and Jose A. Onieva and Daniel Merida} } @inproceedings {PNajera2009, title = {Secure Integration of RFID Technology in Personal Documentation for Seamless Identity Validation}, booktitle = {3rd Symposium of Ubiquitous Computing and Ambient Intelligence 2008}, series = {Advances in Soft Computing}, volume = {51/2009}, year = {2008}, month = {October}, pages = {134-138}, publisher = {Springer}, organization = {Springer}, address = {Salamanca (Spain)}, abstract = {

Seamless human identification and authentication in the information system is a fundamental step towards the transparent interaction between the user and its context proposed in ambient intelligence. In this context, the IDENTICA project is aimed to the design and implementation of a distributed authentication platform based on biometrics (i.e. voice and facial image) and personal documentation. In this paper, we present our work in this project focused on the secure integration of RFID technology in personal documentation in order to provide seamless identity validation. Our actual work status, first results and future directions are described in detail.

}, keywords = {Biometry, identity verification, privacy, RFID, security}, isbn = {978-3-540-85866-9}, doi = {http://dx.doi.org/10.1007/978-3-540-85867-6_16}, url = {http://www.springerlink.com/content/bx8t243130k07585/}, author = {Pablo Najera and Francisco Moyano and Javier Lopez} } @inproceedings {Marquez2008, title = {Secure Real-Time Integration of Services in a OSGi Distributed Environment}, booktitle = {Fourth International Conference on Networked Computing and Advanced Information Management (NCM{\textquoteright}08)}, volume = {1}, year = {2008}, month = {September}, pages = {631-635}, publisher = {IEEE}, organization = {IEEE}, address = {Gyeongju, South Korea}, abstract = {This paper presents a service oriented architecture for real-time integration of services, how to distribute them in a local domain and how to define a secure way of accessing resources using users{\textquoteright} and services{\textquoteright} authorization and authentication. This work take advantage of previous European R amp;D projects focused on del.ivering applications and utilities in embedded real-time environments and the convergence of different worlds like Internet and digital TV.}, keywords = {authentication, authorisation, authorization, digital TV, embedded real-time environments, embedded systems, Internet, message authentication, open systems, OSGi distributed environment, secure real-time integration, service oriented architecture, software architecture}, isbn = {978-0-7695-3322-3}, doi = {10.1109/NCM.2008.173}, author = {Jose Manuel Marquez and Javier Jimenez and Isaac Agudo} } @inproceedings {Agudo2007a, title = {Attribute delegation in ubiquitous environments}, booktitle = {3rd international conference on Mobile multimedia communications (MobiMedia {\textquoteright}07)}, year = {2007}, pages = {43:1{\textendash}43:6}, publisher = {ICST}, organization = {ICST}, address = {Nafpaktos, Greece}, abstract = {

When delegation is implemented using the attribute certificates in a Privilege Management Infrastructure (PMI), this one reaches a considerable level of distributed functionality. However, the approach is not flexible enough for the requirements of ubiquitous environments. Additionally, the PMI can become a too complex solution for devices such as smartphones and PDAs, where resources are limited. In this work, we solve the previous limitations by defining a second class of attributes, called domain attributes, which are managed directly by users and are not right under the scope of the PMI, thus providing a light solution for constrained devices. The two classes of attributes are related by defining a simple ontology. We also introduce in the paper the concept of Attribute Federation which is responsible for supporting domain attributes and the corresponding ontology.

}, isbn = {978-963-06-2670-5}, author = {Isaac Agudo and Javier Lopez and Jose A. Montenegro} } @inproceedings {Agudo2007, title = {Implementation aspects of a delegation system}, booktitle = {3rd international conference on Mobile multimedia communications (MobiMedia {\textquoteright}07)}, year = {2007}, pages = {50:1{\textendash}50:6}, publisher = {ICST}, organization = {ICST}, address = {Nafpaktos, Greece}, abstract = {

In this paper we simulate an authorization and delegation system using knowledge based technology. This proposal is part of a visual tool that is intended to be an implementation of the theoretical model weighted trust graph (WTG). A brief description of WTG Model and its associated tool is included in the text. In essence, the model is based on the inclusion of real numbers between zero and one in certificates to represent the trust level between the entities involved in them. This trust level is used to control delegation. Moreover, attributes from di_erent domains may be interrelated, so attribute delegation is also taken into account. The proposed Simulation Engine supports one directional and bidirectional search algorithms.

}, isbn = {978-963-06-2670-5}, author = {Isaac Agudo and Javier Lopez and Jose A. Montenegro} } @inproceedings {IsaacAgudo2006, title = {Attributes Delegation Based on Ontologies and Context Information}, booktitle = {10th IFIP TC-6 TC-11 International Conference on Communications and Multimedia on Security (CMS{\textquoteright}06)}, series = {LNCS}, volume = {4237}, year = {2006}, month = {October}, pages = {54-66}, publisher = {Springer}, organization = {Springer}, address = {Heraklion, Crete}, abstract = {

This paper presents a model for delegation based on partial orders, proposing the subclass relation in OWL as a way to represent the partial orders. Delegation and authorization decisions are made based on the context. In order to interact with the context, we define the Type of a credential as a way to introduce extra information regarding context constraints. When reasoning about delegation and authorization relationships, our model benefits from partial orders, defining them over entities, attributes and the credential type. Using these partial orders, the number of credentials required is reduced. It also classifies the possible criteria for making authorization decisions based on the context, in relation to the necessary information.

}, isbn = {978-3-540-47820-1}, issn = {0302-9743 (Print) 1611-3349 (Online)}, doi = {10.1007/11909033_6}, author = {Isaac Agudo and Javier Lopez and Jose A. Montenegro} } @inproceedings {Agudo2006a, title = {Graphical Representation of Authorization Policies for Weighted Credentials}, booktitle = {11th Australasian Conference on Information Security and Privacy (ACISP{\textquoteright}06)}, series = {LNCS}, volume = {4058}, year = {2006}, pages = {383-394}, publisher = {Springer}, organization = {Springer}, address = {Melbourne, Australia}, abstract = {

This paper elaborates on a solution to represent authorization and delegation in a graphical way, allowing users to better interpret delegation relationships. We make use of Weighted Trust Graph (WTG) as an instrument to represent delegation and authorization, extending it to cope with more complicated concepts, and providing a graphical representation of the level of confidence that exists between two entities regarding a resource or attribute. We represent the level of confidence for each pair of entities as a point in an axis diagram, as a set of points, or as a set of triangular regions depending on the accuracy we need. Then, we use the same diagram to represent the set of acceptable confidence level, that we call authorization policy set. In this way, a single diagram can be used to decide about authorization, thus providing a powerful tool for systems in which interaction of users is needed.

}, isbn = {978-3-540-35458-1}, issn = {0302-9743 (Print) 1611-3349 (Online)}, doi = {10.1007/11780656_32}, author = {Isaac Agudo and Javier Lopez and Jose A. Montenegro} } @inproceedings {IsaacAgudo2006a, title = {Pol{\'\i}ticas de delegaci{\'o}n para credenciales ponderadas y su representaci{\'o}n gr{\'a}fica}, booktitle = {IX Reuni{\'o}n Espa{\~n}ola sobre Criptolog{\'\i}a y Seguridad de la informaci{\'o}n (RECSI{\textquoteright}06)}, year = {2006}, month = {Septiembre}, pages = {311-322}, address = {Barcelona, Spain}, isbn = {84-9788-502-3}, author = {Isaac Agudo and Javier Lopez and Jose A. Montenegro} } @inproceedings {JavierLopez2006, title = {A Secure and Auto-configurable Environment for Mobile Agents in Ubiquitous Computing Scenarios}, booktitle = {Third International Conference on Ubiquitous Intelligence and Computing}, series = {LNCS}, volume = {4159}, number = {4159}, year = {2006}, month = {August}, pages = {977-987}, publisher = {Springer}, organization = {Springer}, address = {Wuhan, China}, abstract = {
The increased heterogeneity and dynamism of new computing paradigms and especially of ubiquitous computing models is boosting the need for auto-configurable systems. In these new scenarios, heterogeneity and dynamism are inherent properties and applications are built by aggregating distributed information and services that are not under the control of a single entity. Furthermore, the current trend towards distributed computing poses important problems related to the need to transmit large amounts of data between the distributed nodes of the computing system; the control over the information; and the flexibility to adapt to heterogeneous client requirements. These characteristics are difficult to manage by traditional computing models. For these reasons, the mobile agent paradigm is gaining momentum and the interest of researchers and industry in this paradigm is increasing. In this paper we present a solution to provide a secure and auto-configurable environment for mobile agents in ubiquitous computing scenarios. Our approach is based on two main building blocks: trusted platforms and profiles.
}, author = {Javier Lopez and Antonio Mana and Mu{\~n}oz, Antonio} } @inproceedings {JavierLopez2006a, title = {Service-Oriented Security Architecture for CII based on Sensor Networks}, booktitle = {2nd International Workshop on Security Privacy and Trust in Pervasive and Ubiquitous Computing (SecPerU{\textquoteright}06)}, year = {2006}, month = {June}, pages = {1-6}, publisher = {IEEE Press}, organization = {IEEE Press}, address = {Lyon, France}, abstract = {

The extraordinary growth of the Information Society is originating a high dependency on ICT. This provokes that those strongly interrelated technological infrastructures, as well as the information systems that underpin them, become highly critical, since their disruption would lead to high economical, material and, sometimes, human loss. As a consequence, the protection of these Critical Information Infrastructures is becoming a major objective for governments and companies. In this paper, we give an overview of the main challenges and open research issues on Critical Information Infrastructure security, and introduce an on-going research project that, using wireless sensor networks as an underlying technology, is dealing with those problems. Our research project focuses on the development of protection, control, evaluation, maintenance and verification mechanisms, integrated into a secure service-oriented architecture.

}, author = {Javier Lopez and Jose A. Montenegro and Rodrigo Roman} } @inproceedings {Cid2006, title = {Software Engineering Techniqes Applied to AmI: Security Patterns}, booktitle = {First International Conference on Ambient Intelligence Developments (AmID{\textquoteright}06)}, year = {2006}, month = {September}, pages = {108-123}, publisher = {Springer}, organization = {Springer}, address = {Sophia-Antipolis (France)}, abstract = {

The realization of the Ambient Intelligence concept entails many important challenges, but the most important barriers to this realization is the lack of adequate support for security. In this paper we present a conceptual model of our solution for building secure systems for AmI environments, taking as basis the concept of Security and Dependability (S\&D) Pattern as a precise representation of validated S\&D solutions and mechanisms. The main elements embedded in our solution framework (S\&D library, monitoring interface and S\&D Manager) are presented both conceptually, and also using a simple example scenario based on an hospital AmI environment.

}, keywords = {Ambient Intelligence, security}, isbn = {978-3-642-01464-2}, doi = {http://dx.doi.org/10.1007/978-2-287-47610-5_8}, author = {Francisco Sanchez-Cid and Mu{\~n}oz, Antonio and Daniel Serrano and Carmen Fernandez-Gago} } @inproceedings {IsaacAgudo2005a, title = {Delegation Perspective of Practical Authorization Schemes}, booktitle = {Fifth International Network Conference (INC{\textquoteright}05)}, year = {2005}, pages = {157-164}, address = {Samos Island, Greece}, isbn = {960-7475-32-1}, author = {Isaac Agudo and Javier Lopez and Jose A. Montenegro and Eiji Okamoto and Ed Dawson} } @inproceedings {AntonioMunoz2005a, title = {Perfiles Seguros para Comercio Movil}, booktitle = {III Simposio Espa{\~n}ol de Comercio Electronico (SCE{\textquoteright}05)}, year = {2005}, pages = {235-244}, publisher = {Universitat de les Illes Balears}, organization = {Universitat de les Illes Balears}, abstract = {

Los escenarios de comercio m{\'o}vil existentes en la actualidad presentan muchas deficiencias. La mayor{\'\i}a de estos escenarios, como no podr{\'\i}a ser de otra forma, tienen en cuenta aspectos relativos a la seguridad, prestando especial atenci{\'o}n a las propiedades de Autenticaci{\'o}n y Autorizaci{\'o}n. De entre los elementos esenciales que se utilizan para proporcionar estos servicios de seguridad, los perfiles son un elemento com{\'u}n que permiten la personalizaci{\'o}n de los servicios del usuario m{\'o}vil. Sin embargo, los perfiles tambi{\'e}n precisan de una administraci{\'o}n segura. En este trabajo presentamos unas consideraciones iniciales respecto a los distintos tipos de perfiles, sus niveles de seguridad para cada tipo, as{\'\i} como indicaciones para el almacenamiento de manera segura. Por lo tanto, analizaremos las distintas alternativas como medio de almacenamiento, discuti{\'e}ndolas y prestando especial atenci{\'o}n a las tarjetas inteligentes.

}, author = {Mu{\~n}oz, Antonio and Jose A. Onieva and Javier Lopez} } @inproceedings {IsaacAgudo2005b, title = {A Representation Model of Trust Relationships with Delegation Extensions}, booktitle = {3th International Conference on Trust Management (iTRUST{\textquoteright}05)}, series = {LNCS}, volume = {3477}, year = {2005}, month = {May}, pages = {9-22}, publisher = {Springer}, organization = {Springer}, address = {Versailles, France}, abstract = {

Logic languages establish a formal framework to solve authorization and delegation conflicts. However, we consider that a visual representation is necessary since graphs are more expressive and understandable than logic languages. In this paper, and after overviewing previous works using logic languages, we present a proposal for graph representation of authorization and delegation statements. Our proposal is based on Varadharajan et al. solution, though improve several elements of that work. We also discuss about the possible implementation of our proposal using attribute certificates.

}, isbn = {978-3-540-26042-4}, issn = {0302-9743 (Print) 1611-3349 (Online)}, doi = {10.1007/11429760_9}, author = {Isaac Agudo and Javier Lopez and Jose A. Montenegro} } @inproceedings {AntonioMunoz2005, title = {On Secure Profiling}, booktitle = {1st International Workshop on Secure Ubiquitous Networks (SUN{\textquoteright}05)}, year = {2005}, month = {August}, pages = {214-218}, publisher = {IEEE Press}, organization = {IEEE Press}, abstract = {

Ubiquitous environments have several drawbacks to be solved. Most of them are focused on security, and relevant ones are authorization and authentication. Amongst the essential elements to adequately provide solutions, we can find profiles. A profile can be defined as a repository to store structured data from users, networks, devices, applications, etc. As profiles are needed in ubiquitous environments, and these need of secure management as well, in this paper, we provide some initial guidance on the security storage of profiles and on security levels needed for each type of profile. Additionally, we review different alternatives to bear profiles, concluding that smartcards are the most suitable devices.

}, author = {Mu{\~n}oz, Antonio and Jose A. Onieva and Javier Lopez} } @inproceedings {JoseA.Montenegro2004, title = {Dise{\~n}o e Implementaci{\'o}n del Marco de Trabajo de Certificado de Atributos X509 para la Delegaci{\'o}n de Privilegios}, booktitle = {VIII Reuni{\'o}n Espa{\~n}ola sobre Criptolog{\'\i}a y Seguridad de la informaci{\'o}n (VIII RECSI),Madrid}, year = {2004}, month = {Septiembre}, pages = {571-581}, abstract = {

Este trabajo muestra los detalles de una implementacion prototipo del marco de trabajo de Certificados de Atributos X.509 (Xac), propuesto por la recomendacion ITU-T. La implementacion utiliza como base de la plataforma la librer

}, author = {Jose A. Montenegro and Javier Lopez and Fernando Moya} } @inproceedings {VicenteBenjumea2004, title = {A First Approach to Provide Anonymity in Attribute Certificates}, booktitle = {2004 International Workshop on Practice and Theory in Public Key Cryptography (PKC{\textquoteright}04)}, series = {LNCS}, volume = {2947}, year = {2004}, month = {March}, pages = {402-415}, publisher = {Springer}, organization = {Springer}, abstract = {

This paper focus on two security services for internet applications:authorization and anonymity. Traditional authorization solutionsare not very helpful for many of the Internet applications; however,attribute certificates proposed by ITU-T seems to be well suited andprovide adequate solution. On the other hand, special attention is paidto the fact that many of the operations and transactions that are part ofInternet applications can be easily recorded and collected. Consequently,anonymity has become a desirable feature to be added in many cases. Inthis work we propose a solution to enhance the X.509 attribute certificatein such a way that it becomes a conditionally anonymous attributecertificate. Moreover, we present a protocol to obtain such certificatesin a way that respects users\’ anonymity by using a fair blind signaturescheme. We also show how to use such certificates and describe a fewcases where problems could arise, identifying some open problems.

}, author = {Vicente Benjumea and Javier Lopez and Jose A. Montenegro and Jose M. Troya} } @inproceedings {JavierLopez2004a, title = {On a Taxonomy of Systems for Authentication and/or Authorization Services}, booktitle = {TERENA Networking Conference}, year = {2004}, month = {June}, address = {Rhodes, Greece}, abstract = {

In this work we elaborate on a taxonomy of systems that provide either joint solutions for both authentication and authorization problems, or solutions for only one of the problems. Basically, we do not focus our work on theoretical systems that have been proposed only in the literature. On the other hand, we focus on: (i) systems that are already developed; (ii) systems that are under development or deployment; and (iii) systems that are still in the initial stages of design but are supported by international working groups or bodies. More precisely, we elaborate on a taxonomy of systems that are (or will be soon) available to final users.

}, author = {Javier Lopez and Jose A. Montenegro and Rolf Oppliger and Guenther Pernul} } @inproceedings {1719, title = {Applying the Semantic Web Layers to Access Control}, booktitle = {IEEE International Workshop on Web Semantics (WebS{\textquoteright}03)}, year = {2003}, pages = {622-626}, publisher = {IEEE Press}, organization = {IEEE Press}, isbn = {0-7695-1993-8}, author = {Javier Lopez and Antonio Mana and Jose maria troya and Marienma Yague} } @inproceedings {EdDawson2003, title = {BAAI: Biometric Authentication and Authorization Infrastructure}, booktitle = {IEEE International Conference on Information Technology (ITRE{\textquoteright}03)}, year = {2003}, pages = {274-278}, publisher = {IEEE}, organization = {IEEE}, abstract = {The combined use of authorization and authentication infrastructures has led to AAIs (authorization and authentication infrastructures). These new infrastructures supply identification and authorization services to a distributed environment There are many possibilities of linkages to get AAIs; one of them is to include the PMI (privilege management infrastructure) as authorization infrastructure and an authentication infrastructure that can be a PKI (public key infrastructure) or kerberos. This symbiosis gives service to applications and servers. However, in physical environments where the physical presence of an individual is required, it is necessary to use biometric systems. This paper describes the development of a solution that combines the relationship between the biometric based systems and the PMIs to finally obtain the biometric AAI.}, isbn = {0780377249}, doi = {10.1109/ITRE.2003.1270620} month={august}, author = {Ed Dawson and Javier Lopez and Jose A. Montenegro and Eiji Okamoto} } @inproceedings {JoseA.Montenegro2003, title = {Taxonom{\'\i}a de las Infraestructuras de Autorizaci{\'o}n y Autentificaci{\'o}n}, booktitle = {XIII Jornadas TELECOM I+D 2003}, year = {2003}, month = {Noviembre}, author = {Jose A. Montenegro and Javier Lopez} } @inproceedings {josevivas2003, title = {Towards Business Process-Driven Framework for Security Engineering with the UML}, booktitle = {6th International Conference on Information Security (ISC{\textquoteright}03)}, series = {LNCS}, volume = {2851}, year = {2003}, month = {October}, pages = {381-395}, publisher = {Springer-Verlag}, organization = {Springer-Verlag}, address = {Bristol, U.K.}, abstract = {

A challenging task in security engineering concerns the specification and integration of security with other requirements at the top level of requirements engineering. Empirical studies show that it is commonly at the business process level that customers and end users are able to express their security needs. In addition, systems are often developed by automating existing manual business processes. Since many security notions belongs conceptually to the world of business processes, it is natural to try to capture and express them in the context of business models in which moreover customers and end users feel most comfortable. In this paper, based on experience drawn from an ongoing work within the CASENET project \cite{CASENET}, we propose a UML-based business process-driven framework for the development of security-critical systems.

}, isbn = {1-4020-7449-2}, author = {Jose L. Vivas and Jose A. Montenegro and Javier Lopez} } @inproceedings {JavierLopez2002j, title = {Access Control Infrastructure for Digital Objects}, booktitle = {International Conference on Information and Communications Security (ICICS{\textquoteright}02)}, series = {LNCS}, volume = {2513}, year = {2002}, month = {December}, pages = {399-410}, publisher = {Springer-Verlag}, organization = {Springer-Verlag}, address = {Singapore}, abstract = {

Distributed systems usually contain objects with heterogeneous security requirements that pose important challenges on the underlying security mechanisms and especially in access control systems. Access control in distributed systems often relies on centralized security administration. Existing solutions for distributed access control do not provide the flexibility and manageability required. This paper presents the XML-based Secure Content Distribution (XSCD) infrastructure is based on the production of self-protected software objects that convey contents (software or data) and can be distributed without further security measures because they embed the access control enforcement mechanism. It also provides means for integrating Privilege Management Infrastructures (PMIs). Semantic information is used in the dynamic instantiation and semantic validation of policies. XSCD is scalable, facilitates the administration of the access control system, guarantees the secure distribution of the contents, enables semantic integration and interoperability of heterogeneous sources, solves the \“originator retained control\” issue and allows activities (such as payment) to be bound to the access to objects.

}, author = {Javier Lopez and Antonio Mana and Ernesto Pimentel and Jose M. Troya and Mariemma I. Yague} } @inproceedings {JavierLopez2002c, title = {Design of a VPN Software Solution Integrating TCP and UDP Services}, booktitle = {International Conference on Infrastructure Security (InfraSec{\textquoteright}02)}, series = {LNCS}, volume = {2437}, year = {2002}, month = {October}, pages = {325-337}, publisher = {Springer-Verlag}, organization = {Springer-Verlag}, address = {Bristol, U.K.}, abstract = {

The main aims of Virtual Private Network (VPN) are to isolate a distributed network from outsiders, as well as to protect the confidentiality and integrity of sensitive information traversing a non-trusted network such as the Internet. However, some problems arise when security is considered as the unique problem because VPN users suffer from restrictions in their access to the network. They are not free to use traditional Internet services such as electronic mail exchange with non-VPN users, and to access Web and FTP servers external to the organization. This paper presents a new solution that allows the open use of traditional network services running over TCP and UDP layers, while maintaining strong security features. The new scheme works at the TCP/IP transport layer and does not require the addition of new hardware because it is a totally software solution. As a consequence, the application is totally portable. Moreover, and because of its implementation at the transport layer, there is no need to modify any traditional communication applications previously installed in the network system.

}, author = {Javier Lopez and Jose A. Montenegro and Rodrigo Roman and Jorge Davila} } @inproceedings {JavierLopez2002f, title = {Designing Software Tools for the Use of Secure Electronic Forms}, booktitle = {3rd ACIS Int. Conf. on Software Engineering, Artificial Intelligence Networking and Parallel/Distributed Computing (SNPD{\textquoteright}02)}, year = {2002}, month = {Junio}, pages = {157-163}, address = {Madrid, Spain)}, abstract = {

Interaction of organizations and their clients by using the Internet can produce meaningful benefits in the accessibility, efficiency and availability of documents, regardless of time and location. However, some types of problems hinder a higher degree of communication. This paper presents some of the results of a Research Project that focuses on the influence of typical open networks risks in electronic interactions and on the need of creating software tools to manage electronic versions of the paper-based forms, as this is the traditional way of interaction through the Web.

}, author = {Javier Lopez and Antonio Mana and Jose A. Montenegro and Juan J. Ortega and Jose M. Troya} } @inproceedings {EdDawson2002, title = {A New Design of Privilege Management Infrastructure (PMIs) for Organizations Using Outsourced PKI}, booktitle = {5th International Conference on Information Security (ISC{\textquoteright}02)}, series = {LNCS}, volume = {2433}, year = {2002}, month = {September}, pages = {136-149}, publisher = {Springer-Verlag}, organization = {Springer-Verlag}, abstract = {Authentication services provided by Public Key Infrastructures (PKI) do not satisfy the needs of many e-commerce applications. These applications require additional use of authorization services in order for users to prove what they are allowed to do. Attribute certificates have changed the way in which the authorization problem has been considered until now, and Privilege Management Infrastructures (PMI) provide the necessary support for a wide use of those certificates. Although both types of infrastructures, PKIs and PMIs, keep some kind of relation, they can operate autonomously. This fact is specially interesting for companies who have taken or will take the decision to outsource PKI services. However, outsourcing PMI services is not a good option for many companies because sometimes information contained in attribute certificates is confidential. Therefore attribute certificates must be managed very carefully and, preferably, only inside the company. In this paper we present a new design of PMI that is specially suited for those companies that outsource PKI services but still need to manage the PMI internally. The scheme provides additional advantages that satisfy the needs of intra-company attribute certification, and eliminates some of the problems associated with the revocation procedures.}, isbn = {3540442707}, doi = {10.1007/3-540-45811-5_10}, author = {Ed Dawson and Javier Lopez and Jose A. Montenegro and Eiji Okamoto} } @inproceedings {JavierLopez2002h, title = {Observaciones sobre las t{\'e}cnicas de an{\'a}lisis formal de protocolos de seguridad}, booktitle = {VII Reuni{\'o}n Espa{\~n}ola sobre Criptolog{\'\i}a y Seguridad de la Informaci{\'o}n (VII RECSI)}, year = {2002}, month = {Septiembre}, pages = {471-483}, address = {Oviedo, Espa}, abstract = {

La aplicaci\ón de los m\étodos formales para el dise\ño y an\álisis de sistemas cr\íticos est\á ampliamente aceptada en el desarrollo de estos sistemas. Los protocolos de seguridad abordan el objetivo de garantizar servicios y derechos como el de la confidencialidad de los datos personales o el de garantizar la identidad de acceso a un sistema. Por lo tanto, ya que un protocolo de seguridad es un sistema cr\ítico, es necesario utilizar m\étodosformales para su dise\ño y an\álisis. Debido a las caracter\ísticas especiales que presentan este tipo de protocolos, se deben utilizar m\étodos que no son los tradicionales utilizados para los protocolos de comunicaciones, sino que deben utilizarse otros espec\íficos. En este art\ículo vamos a hacer un estudio de las principales propiedades de seguridad que poseen los protocolos criptogr\áficos y de la manera de aplicar los m\étodos formales en su dise\ño y an\álisis.

}, author = {Javier Lopez and Sonia Matamoros and Juan J. Ortega and Jose M. Troya} } @inproceedings {JavierLopez2002i, title = {Perspectiva Composicional para el Dise{\~n}o y la Implementaci{\'o}n de una PKI}, booktitle = {I Congreso Internacional Sociedad de la Informaci{\'o}n}, year = {2002}, pages = {423-428}, address = {Las Palmas, Espa}, abstract = {
The important role of Public Key Infrastructures (PKIs) inside the general scope of Internet communication, and more precisely, inside electronic commerce, has driven us to the revision of actual procedures followed in the development of software of these elements that provide security and trust to the digital certification environment. In this work we introduce the actual results of a joint research project of the Security Group of the University of Malaga and the Department of Technology Innovation of Banesto regarding a PKI implementation. The originality of this work is that we have paid attention not only to functional aspects of the infrastructure, but also to the programming techniques used. Basically, we have developed a solution in which implementation has been guided by the increase in the study of software architectures and those paradigms that have emerged in parallel, as component orientation, software frameworks, and design patterns. The correct use of these techniques provide a different point of view that allows the development of every PKI building block in a modular and independent way.
}, author = {Javier Lopez and Jose A. Montenegro and Jose M. Troya} } @inproceedings {JavierLopez2002, title = {Protecci{\'o}n de Software basada en Tarjetas Inteligentes}, booktitle = {VII Reuni{\'o}n Espa{\~n}ola sobre Criptolog{\'\i}a y Seguridad de la Informaci{\'o}n (VII RECSI)}, year = {2002}, month = {Septiembre}, pages = {485-497}, address = {Oviedo, Espa}, author = {Javier Lopez and Antonio Mana and Juan J. Ortega and Ernesto Pimentel} } @inproceedings {JavierLopez2002g, title = {Towards a Trustful and Flexible Environment for Secure Communications with Public Administrations}, booktitle = {First International Conference on Electronic Government (EGOV{\textquoteright}02)}, series = {LNCS}, volume = {2456}, year = {2002}, month = {September}, pages = {211-214}, publisher = {Springer}, organization = {Springer}, address = {Aix-en-Provence, France)}, abstract = {

Interaction of citizens and private organizations with Public Administrations can produce meaningful benefits in the accessibility, efficiency and availability of documents, regardless of time, location and quantity. Although there are some experiences in the field of e-government there are still some technological and legal difficulties that avoid a higher rate of communications with Public Administrations through Internet, not only from citizens, but also from private companies. We have studied two of the technological problems, the need to work in a trustful environment and the creation of tools to manage electronic versions of the paper-based forms.

}, author = {Javier Lopez and Antonio Mana and Jose A. Montenegro and Juan J. Ortega and Jose M. Troya} } @inproceedings {JavierLopez2002e, title = {XML-Based Distributed Access Control System}, booktitle = {Third International Conference on E-Commerce and Web Technologies (ECWeb{\textquoteright}02)}, series = {LNCS}, volume = {2455}, year = {2002}, month = {September}, pages = {203-213}, publisher = {Springer}, organization = {Springer}, abstract = {

The use of attribute certificates and the concept of mobile policies have been proposed to overcome some of the limitations of the role based access control (RBAC) paradigm and to implement security requirements such as the {\textquoteleft}{\textquoteleft}originator controlled{\textquoteright}{\textquoteright} (ORCON) policy. Mobile policies are attached to the data that they control and enforced by their execution in trusted servers. In this paper we extend this idea to allow the execution of the policies in untrusted systems. Our extension allows that policies are bound to the data but not attached to it. By this modification security administrators are able to change policies dynamically and transparently. Additionally, we introduce X-ACS, an XML-based language designed to express policies in a simple and unambiguous way overcoming the limitations of other approaches. Important features of X-ACS are that it can be used by processors with limited capabilities such as smart cards while allowing the automated validation of policies.

}, author = {Javier Lopez and Antonio Mana and Mariemma I. Yague} } @inproceedings {JavierAreitio2001, title = {An{\'a}lisis, Dise{\~n}o e Implementaci{\'o}n de un Entorno Escalable de Comercio-e con Seguridad Telem{\'a}tica Adaptable Basada en PKI}, booktitle = {I Simposio Espa{\~n}ol de Comercio Electr{\'o}nico (SEC{\textquoteright}01)}, year = {2001}, month = {Octubre}, pages = {145-160}, address = {M{\'a}laga, Espa}, abstract = {

La presente ponencia aborda el desarrollo de un entorno seguro escalable para el Comercio Electr\ónico. Se ha tratado la cuesti\ón en dos fases: primero, idear un prototipo generalizado distribuido seguro formado por diferentes entidades gen\éricas con el objetivo de permitir que los clientes realicen sus compras y transacciones bancarias con un nivel de seguridad escalable; y en segundo lugar, implantar en la pr\áctica un prototipo de grado de escalabilidad reducido como modelo emp\írico.

}, author = {Javier Areitio and Lorenzo Mart{\'\i}nez and Javier Lopez and Jose A. Montenegro} } @inproceedings {AntonioMana2001, title = {Ticketing Gen{\'e}rico y Seguro Sobre GSM}, booktitle = {Simposio en Inform{\'a}tica y Telecomunicaciones 2001 (SIT{\textquoteright}01)}, year = {2001}, month = {Septiembre}, pages = {297-305}, address = {La Coru{\~n}a, Espa}, abstract = {
La confianza en el comercio electr\ónico se ha reforzado, sin duda, gracias a la difusi\ón de las tarjetas inteligentes. Estos elementos clave, que mejoran en gran medida la seguridad de los sistemas inform\áticos, tienen usos que van desde la simple identificaci\ón del usuario hasta complejos mecanismos de pago. Dentro del comercio electr\ónico, uno de los servicios de valor a\ñadido m\ás interesantes para cualquier usuario es el de ticketing. La seguridad de este sistema puede beneficiarse del uso de las tarjetas inteligentes en los procesos de venta, almacenamiento y uso de los tickets electr\ónicos. Uno de los puntos cr\íticos para conseguir una amplia aceptaci\ón de este servicio ser\á su capacidad de llegar a la gran mayor\ía de usuarios. En esta l\ínea, parece apropiado pensar en los tel\éfonos m\óviles como la mejor plataforma sobre la que implantar el sistema. Este trabajo presenta los resultados del proyecto GSM-ticket, en el que se introducen, por una parte, un esquema de tickets electr\ónicos seguros, eficientes y f\áciles de usar, y por otra el conjunto de servicios adicionales de venta, pago y distribuci\ón junto con sus protocolos correspondientes.
}, author = {Antonio Mana and Javier Lopez and Jesus Martinez and Sonia Matamoros} } @inproceedings {JavierLopez2000, title = {Aspectos de Implementaci{\'o}n de una Infraestructura de Clave P{\'u}blica Distribuida}, booktitle = {Simposio Espa{\~n}ol de Inform{\'a}tica Distribuida (SEID{\textquoteright}00)}, year = {2000}, month = {Septiembre}, pages = {313-320}, address = {Orense, Espa}, abstract = {

La seguridad es uno de los aspectos m\ás conflictivos del uso de Internet. La falta de una pol\ítica de seguridad global est\á frenando el desarrollo de Internet en \áreas tan interesantes y prometedoras como el comercio electr\ónico o la interacci\ón con las administraciones p\úblicas. Las t\écnicas criptogr\áficas actuales proporcionan un alto grado de confidencialidad; no obstante, es dif\ícil garantizar la identificaci\ón segura de los usuarios y, adem\ás, la gesti\ón de las claves de los mismos es poco eficiente y presenta graves problemas de escalabilidad. Este trabajo describe las caracter\ísticas de implementaci\ón de una soluci\ón a ambos problemas basada en una Infraestructura de Clave P\ública (PKI) que proporciona una administraci\ón simple y eficiente de las claves de los usuarios y posibilita la autenticaci\ón segura de los mismos.

}, author = {Javier Lopez and Antonio Mana and Jose A. Montenegro and Juan J. Ortega and Jose M. Troya} } @inproceedings {1721, title = {Development of Secure Internet Applications for Governmental Environments}, booktitle = {IEEE International Workshop on Electronic Government (in DEXA{\textquoteright}00)}, year = {2000}, pages = {362-365}, publisher = {IEEE Press}, organization = {IEEE Press}, isbn = {0-7695-0680-1}, author = {Jorge Davila and Javier Lopez and Antonio Mana and Juan J. Ortega and Jose maria troya} } @inproceedings {JavierLopez2000a, title = {Distributed Storage and Revocation in Digital Certificate Databases}, booktitle = {11th International Conference on Database and Expert Systems Applications (DEXA{\textquoteright}00)}, series = {LNCS}, volume = {1873}, year = {2000}, month = {September}, pages = {929-938}, publisher = {Springer}, organization = {Springer}, address = {London, U.K.}, abstract = {

Public-key cryptography is fast becoming the foundation for those applications that require security and authentication in open networks. But the widespread use of a global public-key cryptosystem requires that public-key certificates are always available and up-to-date. Problems associated to digital certificates management, like storage, retrieval, maintenance, and, specially, revocation, require special procedures that ensure reliable features because of the critical significance of inaccuracies. Most of the existing systems use a Certificate Revocation List, a repository of certificates that have been revoked before their expiration date. The need to access CRLs in order to check certificate revocations becomes a performance handicap. Furthermore, they introduce a source of vulnerability in the whole security infrastructure, as it is impossible to produce a new CRL each time a revocation takes place. This paper introduces an alternative for the storage of digital certificates that avoids the use of CRLs. The system is designed to provide a distributed management of digital certificates by using Certification Authorities that, while being part of a whole Public-Key Infrastructure, operate over local certificates databases. Communication protocols between local databases have been designed to minimize network traffic without a lack of security and efficiency.

}, author = {Javier Lopez and Antonio Mana and Juan J. Ortega and Jose M. Troya} } @inproceedings {JavierLopez1999c, title = {Cert{\textquoteright}eM: Certification System Based on Electronic Mail Service Structure}, booktitle = {Secure Networking (CQRE{\textquoteright}99)}, series = {LNCS}, volume = {1740}, year = {1999}, month = {December}, pages = {109-118}, publisher = {Springer}, organization = {Springer}, abstract = {

Public-Key Infrastructures are considered the basis of the protocols and tools needed to guarantee the security demanded for new Internet applications like electronic commerce, government-citizen relationships and digital distribution. This paper introduces a new infrastructure design, Cert{\textquoteright}eM, a key management and certification system that is based on the structure of the electronic mail service and on the principle of near-certification. Cert{\textquoteright}eM provides secure means to identify users and distribute their public-key certificates, enhances the efficiency of revocation procedures, and avoids scalability and synchronization problems. The system, developed and tested at the University of Malaga, was recently selected by RedIRIS, the National Research and Academic Network in Spain, to provide the public key service for its secure electronic mail.

}, author = {Javier Lopez and Antonio Mana and Juan J. Ortega} } @inproceedings {JavierLopez1999a, title = {A Public Key Infrastructure for User Identification}, booktitle = {IFIP Working Conference on User Identification and Privacy Protection}, year = {1999}, month = {June}, pages = {209-227}, address = {Stockholm, Sweden}, abstract = {

While there is wide agreement on the immense potential of Internet, its growth and performance are adversely affected by security issues. Despite its impressive size, scope and reach, the Internet has not yet become a common vehicle for many of these new possibilities. Progress in fields as electronic commerce and government-citizen relationships have been limited by the open design of the network itself. Today, Public-Key Infrastructures are the basis of the protocols and tools needed to guarantee the security demanded in those fields. Trust management and user identification are also important issues that remain unresolved. This paper introduces a key management and user identification system, named Cert\’eM, that is based on the electronic mail service. Cert{\textquoteright}eM provides important advantages over existing Public-Key Infrastructures and user identification proposals.

}, author = {Javier Lopez and Antonio Mana and Juan J. Ortega} } @inproceedings {JavierLopez1999b, title = {An User Authentication Infrastructure for Extranet Applications}, booktitle = {IEEE International Carnahan Conference on Security Technology}, year = {1999}, month = {October}, pages = {354-362}, publisher = {IEEE Press}, organization = {IEEE Press}, address = {Madrid, Spain}, abstract = {

An Extranet is used to connect businesses with their suppliers, customers or other businesses that share common goals in a way that automates their administrative interactions using Internet technology. The security of the communications over Internet is considered an essential feature. To guarantee secure operation the aid of some user authentication infrastructure is needed. This paper introduces a Public Key Infrastructure (PKI) and user identification scheme to be used in extranet applications. The flexibility of the system allows it to fit the usual hierarchical organization structure.

}, author = {Javier Lopez and Antonio Mana and Juan J. Ortega} } @inproceedings {JavierLopez1998a, title = {Automatic Conversion of Scanned Maps to a Vector Based 3D Representation}, booktitle = {International Conference on Imaging Science, Systems, and Technology (CISST{\textquoteright}98)}, year = {1998}, month = {July}, address = {Las Vegas, USA}, author = {Javier Lopez and Javier Lopez and Juan A. Manceras and Antonio Mana} } @inproceedings {JavierLopez1999, title = {Neural Networks Applied to the Estimation of Object Orientation}, booktitle = {International Conference on Imaging Science, Systems, and Technology (CISST{\textquoteright}98)}, year = {1998}, month = {July}, pages = {418-424}, address = {Las Vegas, USA}, abstract = {
We present in this paper a first approach to the use of artificial neural as a tool to determine the orientation of\ objects moving on a conveyor belt in a car assembly line.\ The capability of neural networks to generalise is a key element in the calculation of an object\’s orientation. In this sense, a neural network with Competitive Hebbian Learning can identify the angle of a part never used in its training process. The equilibrium between exactitude and processing time is also studied.
}, author = {Javier Lopez and Javier Lopez and Juan A. Manceras and Antonio Mana} } @inproceedings {AntonioMana1998, title = {Secure Examinations Through The Internet}, booktitle = {IFIP World Computer Congress}, year = {1998}, month = {August}, pages = {695-708}, abstract = {

The objective of the present work is to present a solution to the problem of simultaneously examining groups of students in different computer laboratories while each student uses a computer with Internet access. The system presented focus on security and ease of use, being, at the same time, transparent to the users (students) and providing added services to the main objective of simultaneous examinations in several rooms with just one teacher.

}, author = {Antonio Mana and Francisco Villalba and Javier Lopez} } @inproceedings {1740, title = {Aproximacion de Funciones mediante Redes Neuronales}, year = {1997}, month = {Sep 1997}, pages = {209-215}, isbn = {84-89654-03-4}, author = {Lucia Pino and Javier Lopez and Francisco Lopez and Carlos Maraval} } @inproceedings {AntonioMana1997, title = {Incremento de la Seguridad del Estandar de Cifrado de Datos basado en la Combinaci{\'o}n de Datos y Clave}, booktitle = {III Jornadas de Inform{\'a}tica y Autom{\'a}tica}, year = {1997}, month = {Julio}, pages = {423-432}, address = {El Puerto de Santa Mar{\'\i}a, Espa}, abstract = {

A pesar del gran esfuerzo investigador llevado a cabo, el ataque al DES ha sido infructuoso desde que a mediados de los setenta fue adoptado como est\ándar por el U. S. National Bureau of Standards. El criptoan\álisis diferencial constituye la base de las primeras t\écnicas capaces de acabar con tal invulnerabilidad. Las t\écnicas de criptoan\álisis basadas en modelos de fallos y su adaptaci\ón a DES, el criptoan\álisis de fallos diferencial, son dos de esas t\écnicas que han conseguido recientemente romper sistemas DES (aunque el ataque est\á limitado a ciertos casos especiales, en particular implementaciones hardware). En este art\ículo se presenta un punto d\ébil de DES sobre el cual puede aumentarse la seguridad y se propone una modificaci\ón de la estructura interna de DES con objeto de mejorar su resistencia ante el criptoan\álisis diferencial y por ende de los ataques derivados de este. La modificaci\ón introducida no supone un coste adicional elevado

}, author = {Antonio Mana and Javier Lopez and Lucia Pino and Juan J. Ortega and Carlos Maraval} } @inproceedings {FranciscoLopez1997, title = {Neural Networks for Systems Security}, booktitle = {5th European Congress of Intelligent Techniques and Soft Computing (EUFIT{\textquoteright}97)}, year = {1997}, month = {August}, pages = {410-413}, address = {Germany}, abstract = {
This paper is a first approach in the use of Neural Networks for security. We apply it for electronic mail private systems in Local Area Networks. Some of these systems use public keys directories which must be protected suitably. This task is very complicated because all users in the systems must be able to change their public keys in those directories. We see the advantage of using Neural Networks versus other classical methods to resolve this problem.
}, author = {Francisco Lopez and Javier Lopez and Lucia Pino and Carlos Maraval} } @inproceedings {1741, title = {Sistema Jer{\'a}rquico de Administraci{\'o}n de Claves P{\'u}blicas para el Correo Electr{\'o}nico}, booktitle = {I Jornadas de Ingenier{\'\i}a Telem{\'a}tica (JITEL{\textquoteright}97)}, year = {1997}, month = {Sep 1997}, pages = {295-302}, address = {Bilbao (Spain)}, isbn = {84-89654-04-2}, author = {Lucia Pino and Antonio Mana and Juan J. Ortega and Javier Lopez} } @inproceedings {1723, title = {A Tool for Functions Approximation by Neural Networks}, booktitle = {5th European Congress of Intelligent Techniques and Soft Computing (EUFIT {\textquoteright}97)}, year = {1997}, pages = {557-564}, address = {Aachen (Germany)}, author = {L Pino and Javier Lopez and Francisco Lopez and Carlos Maraval} } @inproceedings {JavierLopez1996a, title = {Comparaci{\'o}n de la Condici{\'o}n de Parikh con algunas Condiciones de los Lenguajes de Contexto Libre}, booktitle = {II Jornadas de Inform{\'a}tica y Autom{\'a}tica}, year = {1996}, month = {Julio}, pages = {305-314}, address = {Almu{\~n}ecar, Espa}, abstract = {

In this paper we first compare Parikh\’s condition to various pumping conditions - Bar-Hillel\’s pumping lemma, Ogden\’s condition and Bader-Moura\’s condition; secondly, to interchange condition; and finally, to Sokolowski\’s and Grant\’s conditions. In order to carry out these comparisons we present some properties of Parikh\’s languages. The main result is the orthogonality of the previously mentioned conditions and Parikh\’s condition.

}, author = {Javier Lopez and Gonzalo Ramos and Rafael Morales} } @inproceedings {JavierLopez1996, title = {Generaci{\'o}n de N{\'u}meros Primos mediante Tests de Primalidad Probabil{\'\i}stas}, booktitle = {IV Reuni{\'o}n Espa{\~n}ola de Criptolog{\'\i}a (IV REC)}, year = {1996}, month = {Septiembre}, pages = {27-33}, address = {Valladolid, Espa}, abstract = {
Nowadays cryptography is present in nearly every aspect of our everyday life, in particular public-key cryptosystems. Some of them have a mathematical foundation of number theory working with big integer numbers. Factoring these numbers is more complex and time-consuming than generating and testing prime numbers; this is the main reason for the strenght of some public key cryptosystems. This paper presents three different probabilistic methods for testing big prime numbers in a reasonable amount of time. A comparison of their efficiency to test prime numbers is also introduced.
}, author = {Javier Lopez and Francisco Ona and Lucia Pino and Carlos Maraval} } @inproceedings {FranciscoLopez1995, title = {Image Compression Based on Competitive Hebbian Learning Neural Networks}, booktitle = {Brain Processes, Theories and Models International Conference}, year = {1995}, month = {October}, pages = {478-482}, address = {Las Palmas, Spain}, author = {Francisco Lopez and Javier Lopez and Carlos Maraval} } @inproceedings {JavierLopez1995, title = {Seguridad de Directorios en Criptosistemas de Clave P{\'u}blica mediante Redes Neuronales en Sistemas de Comunicaciones}, booktitle = {X Symposium Nacional de la Uni{\'o}n Cient{\'\i}fica Internacional de Radio (URSI{\textquoteright}95)}, year = {1995}, month = {Septiembre}, pages = {147-150}, address = {Valladolid, Espa}, author = {Javier Lopez and Francisco Ona and Lucia Pino and Carlos Maraval} } @inproceedings {JavierLopez1994, title = {Sistema de Cifrado de Correo Electr{\'o}nico en Red de Area Local}, booktitle = {III Reuni{\'o}n Espa{\~n}ola de Criptolog{\'\i}a (III REC)}, year = {1994}, month = {Noviembre}, pages = {133-138}, address = {Barcelona, Espa}, author = {Javier Lopez and Carlos Maraval} }