@inproceedings {2016, title = {AndroCIES: Automatizaci{\'o}n de la certificaci{\'o}n de seguridad para aplicaciones Android}, booktitle = {XVII Reuni{\'o}n Espa{\~n}ola sobre Criptolog{\'\i}a y Seguridad de la Informaci{\'o}n (RECSI 2022)}, volume = {265}, year = {2022}, month = {10/2022}, pages = {192-197}, publisher = {Ediciones Universidad Cantabria}, organization = {Ediciones Universidad Cantabria}, address = {Santander, Spain}, abstract = {

El auge de las plataformas m{\'o}viles est{\'a} impulsando el desarrollo de un gran n{\'u}mero de aplicaciones, muchas de las cuales salen al mercado sin las convenientes comprobaciones de seguridad. Recientemente, Google est{\'a} apostando por hacer este problema m{\'a}s visible y concienciar a los usuarios de la necesidad de instalar aplicaciones verificadas por laboratorios independientes. Sin embargo, la certificaci{\'o}n de aplicaciones suele ser una tarea ardua y no exenta de errores. Por ello, en este trabajo, presentamos la herramienta AndroCIES, que es capaz de automatizar en gran medida las evaluaciones necesarias para la certificaci{\'o}n de aplicaciones m{\'o}viles, reduciendo en torno a un 20\% el tiempo empleado en este proceso.

}, keywords = {an{\'a}lisis est{\'a}tico, aplicaciones, certificaci{\'o}n, seguridad}, author = {Manuel Ruiz and Ruben Rios and Rodrigo Roman and Mu{\~n}oz, Antonio and Juan Manuel Mart{\'\i}nez and Jorge Wallace} } @inproceedings {1979, title = {Privacidad Contextual en entornos Edge}, booktitle = {VII Jornadas Nacionales de Investigaci{\'o}n en Ciberseguridad (JNIC 2022)}, year = {2022}, month = {06/2022}, pages = {122-129}, address = {Bilbao, Spain}, abstract = {

La privacidad contextual se refiere a la protecci{\'o}n de toda aquella informaci{\'o}n que puede desprenderse de la interacci{\'o}n entre usuarios y/o servicios, exceptuando los datos que el propio usuario elige transmitir. La localizaci{\'o}n, el tiempo, los patrones de uso y los diferentes par{\'a}metros necesarios para realizar la comunicaci{\'o}n son algunos ejemplos. Este tipo de privacidad es extremadamente importante en la computaci{\'o}n edge debido al acercamiento de los recursos de la infraestructura a los usuarios. Por ello, el objetivo de este trabajo es ofrecer un an{\'a}lisis y clasificaci{\'o}n de las diferentes soluciones propuestas en la literatura respecto a la privacidad contextual en entornos edge, mostrando tanto las capacidades de los mecanismos actuales como los desaf{\'\i}os en este campo.

}, keywords = {Computaci{\'o}n edge, Privacidad, Privacidad contextual}, isbn = {978-84-88734-13-6 }, author = {Manuel Ruiz and Ruben Rios and Rodrigo Roman and Javier Lopez} } @inproceedings {1846, title = {Distributed Detection of APTs: Consensus vs. Clustering}, booktitle = {25th European Symposium on Research in Computer Security (ESORICS 2020)}, volume = {12308}, year = {2020}, month = {09/2020}, pages = {174-192}, keywords = {Advanced Persistent Threat, clustering, consensus, distributed detection, Opinion Dynamics, Traceability}, isbn = {978-3-030-58951-6}, doi = {https://doi.org/10.1007/978-3-030-58951-6_9}, author = {Juan E. Rubio and Cristina Alcaraz and Ruben Rios and Rodrigo Roman and Javier Lopez} } @inproceedings {1840, title = {Game Theory-Based Approach for Defense against APTs}, booktitle = {18th International Conference on Applied Cryptography and Network Security (ACNS{\textquoteright}20)}, volume = {12147}, year = {2020}, month = {10/2020}, pages = {297-320}, publisher = {Springer}, organization = {Springer}, isbn = {978-3-030-57878-7}, doi = {https://doi.org/10.1007/978-3-030-57878-7_15}, author = {Juan E. Rubio and Cristina Alcaraz and Javier Lopez} } @inproceedings {RubioESORICS2019, title = {Enhancing Security and Dependability of Industrial Networks with Opinion Dynamics}, booktitle = {European Symposium on Research in Computer Security (ESORICS2019)}, volume = {11736}, year = {2019}, month = {09/2019}, pages = {263-280}, doi = {https://doi.org/10.1007/978-3-030-29962-0_13}, author = {Juan E. Rubio and Mark Manulis and Cristina Alcaraz and Javier Lopez} } @inproceedings {1835, title = {Personalized Computer Security Tasks with Automatic Evaluation and Feedback}, booktitle = {International Conference on Information Systems Education and Research (AIS SIGED 2019)}, year = {2019}, month = {12/2019}, keywords = {autonomy, evaluation, feedback, learn by doing, Moodle, self-learning}, isbn = {978-1-7343123-0-0}, author = {Isaac Agudo and Ruben Rios and Ana Nieto} } @inproceedings {1815, title = {SealedGRID: A Secure Interconnection of Technologies for Smart Grid Applications}, booktitle = {14th International Conference on Critical Information Infrastructures Security (CRITIS 2019)}, volume = {11777}, year = {2019}, month = {12/2019}, pages = {169-175}, publisher = {Springer, Cham}, organization = {Springer, Cham}, abstract = {

In recent years, the Smart Grid has increasingly integrated cutting-edge technologies that generate several benefits for all the stakeholders involved, such as a more accurate billing system and enhanced Demand Response procedures. However, this modernization also brings with it diverse cyber security and privacy issues, which sets the necessity for developing a security platform specifically tailored to this scenario. In this paper, we present SealedGRID, which proposes a flexible architecture that provides security services at all levels by implementing Trusted Execution Environments on their devices, together with advanced authentication and authorization mechanisms, as well as privacy preserving techniques. These technologies are presented in depth and a final security analysis is conducted, which highlights the contributions of this project.

}, isbn = {978-3-030-37669-7}, doi = {https://doi.org/10.1007/978-3-030-37670-3_14}, author = {Aristeidis Farao and Juan E. Rubio and Cristina Alcaraz and Christoforos Ntantogian and Christos Xenakis and Javier Lopez} } @inproceedings {1692, title = {Addressing Security in OCPP: Protection Against Man-in-the-Middle Attacks}, booktitle = {9th IFIP International Conference on New Technologies, Mobility \& Security}, year = {2018}, author = {Juan E. Rubio and Cristina Alcaraz and Javier Lopez} } @inproceedings {1666, title = {Analysis of cybersecurity threats in Industry 4.0: the case of intrusion detection}, booktitle = {The 12th International Conference on Critical Information Infrastructures Security}, volume = {Lecture Notes in Computer Science, vol 10707}, year = {2018}, month = {08/2018}, pages = {119-130}, publisher = {Springer}, organization = {Springer}, author = {Juan E. Rubio and Rodrigo Roman and Javier Lopez} } @inproceedings {rios2018mob, title = {Location Proximity Attacks against Mobile Targets: Analytical Bounds and Attacker Strategies}, booktitle = {23rd European Symposium on Research in Computer Security (ESORICS 2018)}, series = {LNCS}, volume = {11099}, year = {2018}, pages = {373-392}, publisher = {Springer}, organization = {Springer}, address = {Barcelona}, abstract = {

Location privacy has mostly focused on scenarios where users remain static. However, investigating scenarios where the victims present a particular mobility pattern is more realistic. In this paper, we consider abstract attacks on services that provide location information on other users in the proximity. In that setting, we quantify the required effort of the attacker to localize a particular mobile victim. We prove upper and lower bounds for the effort of an optimal attacker. We experimentally show that a Linear Jump Strategy\ (LJS) practically achieves the upper bounds for almost uniform initial distributions of victims. To improve performance for less uniform distributions known to the attacker, we propose a Greedy Updating Attack Strategy\ (GUAS). Finally, we derive a realistic mobility model from a real-world dataset and discuss the performance of our strategies in that setting.

}, isbn = {978-3-319-98988-4}, doi = {10.1007/978-3-319-98989-1}, author = {Xueou Wang and Xiaolu Hou and Ruben Rios and Per Hallgren and Nils Ole Tippenhauer and Martin Ochoa} } @inproceedings {RubioRomanAlcarazZhang2018, title = {Tracking Advanced Persistent Threats in Critical Infrastructures through Opinion Dynamics}, booktitle = {European Symposium on Research in Computer Security (ESORICS 2018)}, volume = {11098}, year = {2018}, month = {08/2018}, pages = {555-574}, publisher = {Springer}, organization = {Springer}, address = {Barcelona, Spain}, abstract = {

Advanced persistent threats pose a serious issue for modern industrial environments, due to their targeted and complex attack vectors that are difficult to detect. This is especially severe in critical infrastructures that are accelerating the integration of IT technologies. It is then essential to further develop effective monitoring and response systems that ensure the continuity of business to face the arising set of cyber-security threats. In this paper, we study the practical applicability of a novel technique based on opinion dynamics, that permits to trace the attack throughout all its stages along the network by correlating different anomalies measured over time, thereby taking the persistence of threats and the criticality of resources into consideration. The resulting information is of essential importance to monitor the overall health of the control system and correspondingly deploy accurate response procedures.

}, keywords = {Advanced Persistent Threat, Detection, Opinion Dynamics, Traceability}, doi = {10.1007/978-3-319-99073-6_27}, url = {https://link.springer.com/chapter/10.1007/978-3-319-99073-6_27}, author = {Juan E. Rubio and Rodrigo Roman and Cristina Alcaraz and Yan Zhang} } @inproceedings {1662, title = {Analysis of Intrusion Detection Systems in Industrial Ecosystems}, booktitle = {14th International Conference on Security and Cryptography (SECRYPT 2017)}, volume = {6}, year = {2017}, pages = {116-128}, publisher = {SciTePress}, organization = {SciTePress}, isbn = {978-989-758-259-2}, doi = {10.5220/0006426301160128}, author = {Juan E. Rubio and Cristina Alcaraz and Rodrigo Roman and Javier Lopez} } @inproceedings {1654, title = {Digital Witness and Privacy in IoT: Anonymous Witnessing Approach}, booktitle = {16th IEEE International Conference On Trust, Security And Privacy In Computing And Communications (TrustCom 2017)}, year = {2017}, month = {08/2017}, pages = {642-649}, publisher = {IEEE}, organization = {IEEE}, address = {Sydney (Australia)}, abstract = {

The digital witness approach defines the collaboration between IoT devices - from wearables to vehicles - to provide digital evidence through a Digital Chain of Custody to an authorised entity. As one of the cores of the digital witness, binding credentials unequivocally identify the user behind the digital witness. The objective of this article is to perform a critical analysis of the digital witness approach from the perspective of privacy, and to propose solutions that help include some notions of privacy in the scheme (for those cases where it is possible). In addition, digital anonymous witnessing as a tradeoff mechanism between the original approach and privacy requirements is proposed. This is a clear challenge in this context given the restriction that the identities of the links in the digital chain of custody should be known.\ 

}, keywords = {Forensics, IEC Standards, ISO Standards, privacy}, isbn = {978-1-5090-4906-6}, issn = {2324-9013}, doi = {10.1109/Trustcom/BigDataSE/ICESS.2017.295}, author = {Ana Nieto and Ruben Rios and Javier Lopez} } @inproceedings {1653, title = {Estado y Evoluci{\'o}n de la Detecci{\'o}n de Intrusiones en los Sistemas Industriales}, booktitle = {III Jornadas Nacionales de Investigaci{\'o}n en Ciberseguridad (JNIC 2017)}, year = {2017}, abstract = {

Debido a la necesidad de proteger los sistemas\ industriales ante amenazas, se hace necesario comprender cual\ es el verdadero alcance de los mecanismos capaces de detectar\ potenciales anomal{\'\i}as e intrusiones. Es por tanto el objetivo de\ este art{\'\i}culo analizar el estado y la evoluci{\'o}n, tanto acad{\'e}mica\ como industrial, de los mecanismos de detecci{\'o}n de intrusiones\ en este campo, as{\'\i}\ como estudiar su aplicabilidad actual y futura.

}, author = {Cristina Alcaraz and Jes{\'u}s Rodriguez and Roman, Rodrigo and Juan E. Rubio} } @inproceedings {Ruben2017smog, title = {From Smog to Fog: A Security Perspective}, booktitle = {2nd IEEE International Conference on Fog and Edge Mobile Computing (FMEC 2017)}, year = {2017}, month = {06/2017}, pages = {56-61}, publisher = {IEEE Computer Society}, organization = {IEEE Computer Society}, address = {Valencia, Spain. 8-11 May 2017}, abstract = {

Cloud computing has some major limitations that hinder its application to some specific scenarios (e.g., Industrial IoT, and remote surgery) where there are particularly stringent requirements, such as extremely low latency. Fog computing is a specialization of the Cloud that promises to overcome the aforementioned limitations by bringing the Cloud closer to end-users. Despite its potential benefits, Fog Computing is still a developing paradigm which demands further research, especially on security and privacy aspects. This is precisely the focus of this paper: to make evident the urgent need for security mechanisms in Fog computing, as well as to present a research strategy with the necessary steps and processes that are being undertaken within the scope of the SMOG project, in order to enable a trustworthy and resilient Fog ecosystem.

}, isbn = {978-1-5386-2859-1}, doi = {10.1109/FMEC.2017.7946408}, author = {Ruben Rios and Rodrigo Roman and Jose A. Onieva and Javier Lopez} } @inproceedings {1652, title = {A Methodology for Privacy-Aware IoT-Forensics}, booktitle = {16th IEEE International Conference On Trust, Security And Privacy In Computing And Communications (TrustCom 2017)}, year = {2017}, month = {08/2017}, pages = {626-633}, publisher = {IEEE}, organization = {IEEE}, address = {Sydney (Australia)}, abstract = {

The Internet of Things (IoT) brings new challenges to digital forensics. Given the number and heterogeneity of devices in such scenarios, it bring extremely difficult to carry out investigations without the cooperation of individuals. Even if they are not directly involved in the offense, their devices can yield digital evidence that might provide useful clarification in an investigation. However, when providing such evidence they may leak sensitive personal information. This paper proposes PRoFIT; a new model for IoT-forensics that takes privacy into consideration by incorporating the requirements of ISO/IEC 29100:2011 throughout the investigation life cycle. PRoFIT is intended to lay the groundwork for the voluntary cooperation of individuals in cyber crime investigations.

}, keywords = {Adaptation models, Forensics, IEC Standards, Information management, ISO Standards, privacy, Software}, isbn = {978-1-5090-4906-6}, issn = {2324-9013}, doi = {10.1109/Trustcom/BigDataSE/ICESS.2017.293}, author = {Ana Nieto and Ruben Rios and Javier Lopez} } @inproceedings {RubioAlcarazLopez2017ESORICS, title = {Preventing Advanced Persistent Threats in Complex Control Networks}, booktitle = {European Symposium on Research in Computer Security}, volume = {10493}, year = {2017}, month = {09/2017}, pages = {402-418}, publisher = {22nd European Symposium on Research in Computer Security (ESORICS 2017)}, organization = {22nd European Symposium on Research in Computer Security (ESORICS 2017)}, author = {Juan E. Rubio and Cristina Alcaraz and Javier Lopez} } @inproceedings {1655, title = {PRoFIT: modelo forense-IoT con integraci{\'o}n de requisitos de privacidad}, booktitle = {XIII Jornadas de Ingenier{\'\i}a Telem{\'a}tica (JITEL 2017)}, volume = {Libro de actas}, year = {2017}, month = {01/2018}, pages = {302-309}, publisher = {Editorial Universitat Polit{\`e}cnica de Val{\`e}ncia}, organization = {Editorial Universitat Polit{\`e}cnica de Val{\`e}ncia}, address = {Valencia}, isbn = {978-84-9048-595-8}, doi = {http://dx.doi.org/10.4995/JITEL2017.2017.7061}, url = {http://jlloret.webs.upv.es/jitel2017/files/ACTASJITEL2017.pdf}, author = {Ana Nieto and Ruben Rios and Javier Lopez} } @inproceedings {Rios2017query, title = {Query Privacy in Sensing-as-a-Service Platforms}, booktitle = {32nd International Conference on ICT Systems Security and Privacy Protection (IFIP SEC 2017)}, series = {IFIP Advances in Information and Communication Technology (AICT)}, volume = {502}, year = {2017}, month = {05/2017}, pages = {141{\textendash}154}, publisher = {Springer}, organization = {Springer}, address = {Roma, Italy}, abstract = {

The Internet of Things (IoT) promises to revolutionize the way we interact with the physical world. Even though this paradigm is still far from being completely realized, there already exist Sensing-as-a-Service (S2aaS) platforms that allow users to query for IoT data. While this model offers tremendous benefits, it also entails increasingly challenging privacy issues. In this paper, we concentrate on the protection of user privacy when querying sensing devices through a semi-trusted S2aaS platform. In particular, we build on techniques inspired by proxy re-encryption and k-anonymity to tackle two intertwined problems, namely query privacy and query confidentiality. The feasibility of our solution is validated both analytically and empirically.\ 

}, doi = {10.1007/978-3-319-58469-0_10}, author = {Ruben Rios and David Nu{\~n}ez and Javier Lopez}, editor = {Sabrina De Capitani di Vimercati and Fabio Martinelli} } @inproceedings {1648, title = {Requisitos y soluciones de privacidad para la testificaci{\'o}n digital}, booktitle = {III Jornadas Nacionales de Investigaci{\'o}n en Ciberseguridad (JNIC 2017)}, volume = {Actas del JNIC 2017}, year = {2017}, pages = {51-58}, publisher = { Servicio de Publicaciones de la URJC}, organization = { Servicio de Publicaciones de la URJC}, address = {Madrid (Spain)}, isbn = {978-84-608-4659-8}, url = {https://eciencia.urjc.es/handle/10115/14540}, author = {Ana Nieto and Ruben Rios} } @inproceedings {1600, title = {Selecting Privacy Solutions to Prioritise Control in Smart Metering Systems}, booktitle = {The 11th International Conference on Critical Information Infrastructures Security}, volume = {10242}, year = {2017}, pages = {176-188}, abstract = {

The introduction of the Smart Grid brings with it several benefits to society, because its bi-directional communication allows both users and utilities to have better control over energy usage. However, it also has some privacy issues with respect to the privacy of the customers when analysing their consumption data. In this paper we review the main privacy-preserving techniques that have been proposed and compare their efficiency, to accurately select the most appropriate ones for undertaking control operations. Both privacy and performance are essential for the rapid adoption of Smart Grid technologies.

}, keywords = {and Metering, Control, Data privacy, Smart Grid}, author = {Juan E. Rubio and Cristina Alcaraz and Javier Lopez} } @inproceedings {1582, title = {Arquitectura funcional para la cadena de custodia digital en objetos de la IoT}, booktitle = {XIV Reuni{\'o}n Espa{\~n}ola sobre Criptolog{\'\i}a y Seguridad de la Informaci{\'o}n}, year = {2016}, month = {10/2016}, pages = {168-173}, abstract = {
En la Internet de los Objetos (IoT, por sus siglas en ingl{\'e}s), los ataques pueden ser perpetrados desde dispositivos que enmascaran su rastro ayud{\'a}ndose de la densidad de objetos y usuarios. Actualmente la idea de que los dispositivos de usuario almacenan evidencias que pueden ser muy valiosas para frenar ataques es bien conocida. Sin embargo, la colaboraci{\'o}n de {\'e}stos para denunciar posibles abusos telem{\'a}ticos a{\'u}n est{\'a} por definir. Los testigos digitales son dispositivos concebidos para definir la participaci{\'o}n de dispositivos de usuario en una cadena de custodia digital. La idea es que las evidencias se generan, almacenan y transfieren siguiendo los requisitos marcados por las normas actuales (p.ej. UNE 71505), pero respetando las restricciones en recursos de los dispositivos. En este art{\'\i}culo proponemos una arquitectura funcional para la implementaci{\'o}n del concepto de testigo digital en dispositivos heterog{\'e}neos de la IoT.
}, keywords = {Cadena de custodia digital, Identidad de las cosas, Testigo digital}, isbn = {978-84-608-9470-4}, author = {Ana Nieto and Rodrigo Roman and Javier Lopez} } @inproceedings {Rios2016a, title = {Evoluci{\'o}n y nuevos desafios de privacidad en la Internet de las Cosas}, booktitle = {XIV Reuni{\'o}n Espa{\~n}ola sobre Criptolog{\'\i}a y Seguridad de la Informaci{\'o}n}, year = {2016}, month = {10/2016}, pages = {209-213}, address = {Mah{\'o}n, Menorca, Islas Baleares}, abstract = {

La Internet de las Cosas (en ingl{\'e}s, Internet of Things\ (IoT)) es una evoluci{\'o}n de la Internet tal y como lo conocemos. Esta nueva versi{\'o}n de Internet incorpora objetos de la vida cotidiana, rompiendo as{\'\i} barrera de los digital y extendi{\'e}ndose al mundo f{\'\i}sico. Estos objetos interactuar{\'a}n entre s{\'\i} y con otras entidades tanto de manera local como remota, y estar{\'a}n dotados de cierta capacidad computacional y sensores para que sean conscientes de lo que ocurre en su entorno. Esto traer{\'a} consigo un sinf{\'\i}n de posibilidades y nuevos servicios, pero tambi{\'e}n dar{\'a} lugar a nuevos y mayores riesgos de privacidad para los ciudadanos. En este art{\'\i}culo, estudiamos los problemas de privacidad actuales de una de las tecnolog{\'\i}as claves para el desarrollo de este prometedor paradigma, las redes de sensores, y analizamos como pueden evolucionar y surgir nuevos riesgos de privacidad al ser completamente integradas en la Internet.

}, keywords = {Challenges, Internet of Things, privacy, Sensors}, author = {Ruben Rios and Javier Lopez} } @inproceedings {rios2016b, title = {Privacy-Aware Trust Negotiation}, booktitle = {12th International Workshop on Security and Trust Management (STM)}, volume = {LNCS 9871}, year = {2016}, month = {09/2016}, pages = {98-105}, publisher = {Springer}, organization = {Springer}, address = {Heraklion, Crete, Greece}, abstract = {

Software engineering and information security have traditionally followed divergent paths but lately some efforts have been made to consider security from the early phases of the Software Development Life Cycle (SDLC). This paper follows this line and concentrates on the incorporation of trust negotiations during the requirements engineering phase. More precisely, we provide an extension to the SI* modelling language, which is further formalised using answer set programming specifications to support the automatic verification of the model and the detection of privacy conflicts caused by trust negotiations.

}, keywords = {Goal-Oriented Modelling, privacy, Requirements Engineering, Secure Software Engineering, Trust}, isbn = {978-3-319-46597-5}, issn = {0302-9743}, doi = {10.1007/978-3-319-46598-2 7}, url = {http://link.springer.com/chapter/10.1007/978-3-319-46598-2_7}, author = {Ruben Rios and Carmen Fernandez-Gago and Javier Lopez} } @inproceedings {1578, title = {Testigo digital: delegaci{\'o}n vinculante de evidencias electr{\'o}nicas para escenarios IoT}, booktitle = {II Jornadas Nacionales de Investigaci{\'o}n en Ciberseguridad (JNIC 2016)}, year = {2016}, month = {06/2016}, pages = {109-116}, abstract = {

En un mundo en el que los usuarios dependen cada vez m{\'a}s de sus dispositivos, {\'e}stos almacenan gran cantidad de datos y son una fuente muy valiosa de informaci{\'o}n sobre su entorno. Sin embargo, la heterogeneidad y la densidad de los objetos conectados, caracter{\'\i}sticas propias de la Internet de las Cosas (IoT), sirven de velo para ocultar conductas maliciosas que afectan a estos dispositivos, sin que quede rastro de tales acciones. En este art{\'\i}culo definimos el concepto de testigo digital: funcionalidad que permitir{\'a} a los dispositivos personales y otros objetos colaborar para implementar una cadena de custodia digital en la IoT. El fin perseguido es ofrecer soluciones que mitiguen los efectos de la ciberdelincuencia, ampar{\'a}ndose en la colaboraci{\'o}n de los dispositivos con arquitecturas de seguridad embebidas para alertar de conductas maliciosas, y dejar constancia de {\'e}stas.

}, keywords = {computaci{\'o}n forense, elemento seguro, Evidencia electr{\'o}nica, IoT, no-repudio}, isbn = {978-84-608-8070-7}, url = {http://ucys.ugr.es/jnic2016/docs/ActasJNIC2016.pdf}, author = {Ana Nieto and Rodrigo Roman and Javier Lopez} } @inproceedings {onieva2014, title = {An{\'a}lisis y Desarrollo de un Canal Encubierto en una Red de Sensores}, booktitle = { XIII Reuni{\'o}n Espa{\~n}ola sobre Criptolog{\'\i}a y Seguridad de la Informaci{\'o}n (RECSI 2014)}, year = {2014}, month = {09/2014}, pages = {333-338}, publisher = {Universidad de Alicante}, organization = {Universidad de Alicante}, address = {Alicante, Spain}, abstract = {

Continuamente aparecen nuevos estudios as{\'\i} como nuevos desarrollos de canales encubiertos. Como veremos, existen m{\'a}s de cien dise{\~n}os distintos para redes de ordenadores, pero no hemos encontrado en la literatura ning{\'u}n an{\'a}lisis, dise{\~n}o e implementaci{\'o}n de canales encubiertos sobre redes de sensores. En este art{\'\i}culo presentamos los resultados del dise{\~n}o e implementaci{\'o}n de un canal multitasa basado en los tiempos de monitorizaci{\'o}n sobre una red de sensores. En este proceso se han establecido las principales propiedades necesarias y, en base a ellas, se desarrolla e implementa el canal encubierto. Se describe el proceso de desarrollo y se analiza su detectabilidad.

}, keywords = {Covert channels, Information Security, Information Warfare, Intrusion Detection, Network Security, Wireless Sensor Network}, isbn = {978-84-9717-323-0}, author = {Jose A. Onieva and Ruben Rios and Bernardo Palenciano} } @inproceedings {Lopez2014prl, title = {Preserving Receiver-Location Privacy in Wireless Sensor Networks}, booktitle = {Information Security Practice and Experience (ISPEC 2014)}, volume = {8434}, year = {2014}, month = {05/2014}, pages = {15-27}, publisher = {Springer}, organization = {Springer}, address = {Fuzhou, China}, abstract = {

Wireless sensor networks (WSNs) are exposed to many different types of attacks. Among these, the most devastating attack is to compromise or destroy the base station since all communications are addressed exclusively to it. Moreover, this feature can be exploited by a passive adversary to determine the location of this critical device. This receiver-location privacy problem can be reduced by hindering traffic analysis but the adversary may still obtain location information by capturing a subset of sensor nodes in the field. This paper addresses, for the first time, these two problems together in a single solution

}, keywords = {Location Privacy, node capture, traffic analysis, wireless sensor networks}, isbn = {978-3-319-06319-5}, issn = {0302-9743}, doi = {10.1007/978-3-319-06320-1_3}, url = {http://link.springer.com/chapter/10.1007/978-3-319-06320-1_3$\#$}, author = {Javier Lopez and Ruben Rios and Jorge Cuellar} } @inproceedings {moyano14caise, title = {Trust-Aware Decision-Making Methodology for Cloud Sourcing}, booktitle = {26th International Conference on Advanced Information Systems Engineering (CAiSE 2014)}, series = {LCNS}, volume = {8484}, year = {2014}, month = {06/2014}, pages = {136-149}, publisher = {Springer}, organization = {Springer}, address = {Thessaloniki}, abstract = {

Cloud sourcing consists of outsourcing data, services and infrastructure to cloud providers. Even when this outsourcing model brings advantages to cloud customers, new threats also arise as sensitive data and critical IT services are beyond customers{\textquoteright} control. When an organization considers moving to the cloud, IT decision makers must select a cloud provider and must decide which parts of the organization will be outsourced and to which extent. This paper proposes a methodology that allows decision makers to evaluate their trust in cloud providers. The methodology provides a systematic way to elicit knowledge about cloud providers, quantify their trust factors and aggregate them into trust values that can assist the decision-making process. The trust model that we propose is based on trust intervals, which allow capturing uncertainty during the evaluation, and we define an operator for aggregating these trust intervals. The methodology is applied to an eHealth scenario.

}, keywords = {Cloud Computing, decision making, domain knowledge elicitation, security, Trust}, isbn = {978-3-319-07880-9}, issn = {0302-9743}, doi = {10.1007/978-3-319-07881-6}, author = {Francisco Moyano and Kristian Beckers and Carmen Fernandez-Gago}, editor = {Matthias Jarke and John Mylopoulos and Christoph Quix and Colette Rolland and Yannis Manolopoulos and Haralambos Mouratidis and Jennifer Horkoff} } @inproceedings {rios2013b, title = {Ocultaci{\'o}n de la estaci{\'o}n base en redes inal{\'a}mbricas de sensores}, booktitle = {XI Jornadas de Ingenier{\'\i}a Telem{\'a}tica (JITEL 2013)}, year = {2013}, month = {Oct 2013}, pages = {481-486}, publisher = {Asociaci{\'o}n de Telem{\'a}tica}, organization = {Asociaci{\'o}n de Telem{\'a}tica}, address = {Granada}, abstract = {

La estaci{\'o}n base es el elemento m{\'a}s importante en un red de sensores y, por tanto, es necesario evitar que un atacante pueda hacerse con el control de este valioso dispositivo. Para ello, el atacante puede valerse tanto de t{\'e}cnicas de an{\'a}lisis de tr{\'a}fico como de la captura de nodos. En este trabajo presentamos un esquema que consta de dos fases, la primera est{\'a} dedicada a homogeneizar los patrones de tr{\'a}fico y la segunda encargada de perturbar las tablas de rutas de los nodos. Ambas fases permiten mantener a la estaci{\'o}n base fuera del alcance del atacante con un coste computacional insignificante y un consumo energ{\'e}tico moderado. La validez de nuestro esquema ha sido validada anal{\'\i}ticamente y a trav{\'e}s de numerosas simulaciones.

}, isbn = {978-84-616-5597-7}, author = {Ruben Rios and Jorge Cuellar and Javier Lopez}, editor = {Jes{\'u}s E. D{\'\i}az Verdejo and Jorge Navarro Ortiz and Juan J. Ramos Mu{\~n}oz} } @inproceedings {Rios2012b, title = {Adecuaci{\'o}n de soluciones de anonimato al problema de la privacidad de localizaci{\'o}n en WSN}, booktitle = {XII Reuni{\'o}n Espa{\~n}ola sobre Criptolog{\'\i}a y Seguridad de la Informaci{\'o}n (RECSI 2012)}, year = {2012}, month = {Sep 2012}, pages = {309-314}, address = {Donostia-San Sebasti{\'a}n}, abstract = {

Los patrones de tr{\'a}fico caracter{\'\i}sticos de las redes inal{\'a}mbricas de sensores (WSNs) dan lugar al problema de la privacidad de localizaci{\'o}n. De manera similar, el tr{\'a}fico de los usuarios en Internet revela informaci{\'o}n sensible que puede ser protegida mediante sistemas de comunicaci{\'o}n an{\'o}nima (ACS). Por ello, este trabajo analiza la posibilidad de adaptar las soluciones de anonimato tradicionales al problema particular de las redes de sensores. Hasta el momento estas soluciones hab{\'\i}an sido rechazadas sin un an{\'a}lisis riguroso, argumentando simplemente que eran demasiado exigentes computacionalmente para los nodos sensores. Nuestros resultados demuestran que, en general, algunos ACS no cumplen los requisitos de privacidad necesarios en WSNs mientras que otros, que si los cumplen, se valen de una cantidad de recursos que superan la capacidad de los sensores.

}, isbn = {978-84-615-9933-2}, author = {Ruben Rios and Javier Lopez}, editor = {U. Zurutuza and R. Uribeetxeberria and I. Arenaza-Nu{\~n}o} } @inproceedings {Rios2012, title = {HIDE_DHCP: Covert Communications Through Network Configuration Messages}, booktitle = {Proceedings of the 27th IFIP TC 11 International Information Security and Privacy Conference (SEC 2012)}, series = {IFIP AICT}, volume = {376}, year = {2012}, month = {June 2012}, pages = {162-173}, publisher = {Springer Boston}, organization = {Springer Boston}, address = {Heraklion, Crete, Greece}, abstract = {

Covert channels are a form of hidden communication that may violate the integrity of systems. Since their birth in multilevel security systems in the early 70{\textquoteright}s they have evolved considerably, such that new solutions have appeared for computer networks mainly due to vague protocols specifications. We analyze a protocol extensively used today, the Dynamic Host Configuration Protocol (DHCP), in search of new forms of covert communication. From this analysis we observe several features that can be effectively exploited for subliminal data transmission. This results in the implementation of HIDE_DHCP, which integrates three covert channels that accommodate to different stealthiness and bandwidth requirements

}, keywords = {Covert channels, Network Security, System Information Security}, isbn = {978-3-642-30435-4}, issn = {1868-4238}, doi = {http://dx.doi.org/10.1007/978-3-642-30436-1_14}, author = {Ruben Rios and Jose A. Onieva and Javier Lopez}, editor = {Dimitris Gritzalis and Steve Furnell and Marianthi Theoharidou} } @inproceedings {Cuellar2012, title = {Indistinguishable Regions in Geographic Privacy}, booktitle = {Proceedings of the 27th Annual ACM Symposium on Applied Computing (SAC 2012)}, year = {2012}, month = {26-30 March 2012}, pages = {1463-1469}, publisher = {ACM}, organization = {ACM}, address = {Riva del Garda (Trento), Italy}, abstract = {

The ubiquity of positioning devices poses a natural security challenge: users want to take advantage of location-related services as well as social sharing of their position but at the same time have security concerns about how much information should be shared about their exact position. This paper discusses different location-privacy problems, their formalization and the novel notion of indistinguishability regions that allows one to proof that a given obfuscation function provides a good trade-off between location sharing and privacy.

}, keywords = {indistinguishability, Location Privacy, obfuscation}, isbn = {978-1-4503-0857-1}, doi = {10.1145/2245276.2232010}, author = {Jorge Cuellar and Martin Ochoa and Ruben Rios}, editor = {Sascha Ossowski and Paola Lecca} } @inproceedings {Rios2012d, title = {Robust Probabilistic Fake Packet Injection for Receiver-Location Privacy in WSN}, booktitle = {17th European Symposium on Research in Computer Security (ESORICS 2012)}, series = {LNCS}, volume = {7459}, year = {2012}, month = {Sep 2012}, pages = {163-180}, publisher = {Springer}, organization = {Springer}, address = {Pisa, Italy}, abstract = {

The singular communication model in wireless sensor networks (WSNs) originate pronounced traffic patterns that allow a local observer to deduce the location of the base station, which must be kept secret for both strategical and security reasons. In this work we present a new receiver-location privacy solution called HISP (Homogenous Injection for Sink Privacy). Our scheme is based on the idea of hiding the flow of real traffic by carefully injecting fake traffic to homogenize the transmissions from a node to its neighbors. This process is guided by a lightweight probabilistic approach ensuring that the adversary cannot decide with sufficient precision in which direction to move while maintaining a moderate amount of fake traffic. Our system is both validated analytically and experimentally through simulations.

}, isbn = {978-3-642-33167-1}, issn = {0302-9743}, doi = {10.1007/978-3-642-33167-1_10}, author = {Ruben Rios and Jorge Cuellar and Javier Lopez}, editor = {Sara Foresti and Moti Yung and Fabio Martinelli} } @inproceedings {Najera_STM11, title = {Secure architecure for the integration of RFID and sensors in personal networks}, booktitle = {7th International Workshop on Security and Trust Management (STM{\textquoteright}11)}, series = {LNCS}, volume = {7170}, year = {2012}, pages = {207-222}, publisher = {Springer}, organization = {Springer}, address = {Copenhagen, Denmark}, abstract = {

The secure integration of RFID technology into the personal network paradigm, as a context-aware technology which complements body sensor networks, would provide notable benefits to applications and potential services of the PN. RFID security as an independent technology is reaching an adequate maturity level thanks to research in recent years; however, its integration into the PN model, interaction with other network resources, remote users and service providers requires a specific security analysis and a PN architecture prepared to support these resource-constrained pervasive technologies. This paper provides such PN architecture and analysis. Aspects such as the management of personal tags as members of the PN, the authentication and secure communication of PN nodes and remote users with the context-aware technologies, and the enforcement of security and privacy policies are discussed in the architecture.

}, isbn = {978-3-642-29962-9}, doi = {10.1007/978-3-642-29963-6_15}, author = {Pablo Najera and Rodrigo Roman and Javier Lopez} } @inproceedings {neumann2012strong, title = {Strong Authentication of Humans and Machines in Policy Controlled Cloud Computing Environment Using Automatic Cyber Identity}, booktitle = {Information Security Solutions Europe 2012}, year = {2012}, month = {2012}, pages = {195-206}, publisher = {Springer Vieweg}, organization = {Springer Vieweg}, address = {Brussels, Belgium}, abstract = {

The paper describes the experience with integration of automatic cyber identity technology with policy controlled virtualisation environment. One identity technology has been used to enable strong authentication of users (human beings) as well as machines (host systems) to the virtualization management system. The real experimental evaluation has been done in PASSIVE project (Policy-Assessed system-level Security of Sensitive Information processing in Virtualised Environments - SEVENTH FRAMEWORK PROGRAMME THEME ICT-2009.1.4 INFORMATION AND COMMUNICATION TECHNOLOGIES - Small or medium-scale focused research project - Grant agreement no.: 257644).

}, isbn = {978-3-658-00332-6}, doi = {10.1007/978-3-658-00333-3_19}, author = {Neumann Libor and Tomas Halman and Rotek Pavel and Alexander Boettcher and Julian Stecklina and Michal Sojka and David Nu{\~n}ez and Isaac Agudo}, editor = {Norbert Pohlmann and Helmut Reimer and Wolfgang Schneider} } @inproceedings {Clarke:2012, title = {Trust \& Security RTD in the Internet of Things: Opportunities for International Cooperation}, booktitle = {Proceedings of the First International Conference on Security of Internet of Things}, series = {SecurIT {\textquoteright}12}, year = {2012}, pages = {172{\textendash}178}, publisher = {ACM}, organization = {ACM}, address = {New York, NY, USA}, abstract = {

While there has been considerable progress in the research and technological development (RTD) of the Internet of Things (IoT), there is still considerable RTD required by international communities for the trust, privacy and security research challenges arising from the constitution of the IoT architectures, infrastructures, communications, devices, objects, applications and services. In this paper, we present an thorough analysis of the ongoing and future RTD work, specifically in Europe, regarding trust, privacy and security of the Internet of Things with a view towards enabling international cooperation efforts around the globe to solve these major research challenges.

}, keywords = {international cooperation (INCO), Internet of Things, privacy, research and technological development (RTD), security, Trust}, isbn = {978-1-4503-1822-8}, doi = {10.1145/2490428.2490452}, url = {http://doi.acm.org/10.1145/2490428.2490452}, author = {Clarke, James and Roman, Rodrigo and Sharma, Abhishek and Lopez, Javier and Suri, Neeraj} } @inproceedings {Najera_JITEL11, title = {Acceso seguro a nodos RFID en una arquitectura de red personal}, booktitle = {X Jornadas de Ingenier{\'\i}a Telem{\'a}tica (JITEL 2011)}, year = {2011}, month = {09/2011}, pages = {104 - 111}, publisher = {Universidad de Cantabria}, organization = {Universidad de Cantabria}, address = {Santander, Spain}, abstract = {

El paradigma de red personal (PN) permitir\á la interacci\ón y colaboraci\ón del creciente abanico de dispositivos personales. Con tal fin la PN ha de integrar en su seno m\últiples tecnolog\ías heterog\éneas con diversas capacidades computacionales y de comunicaci\ón de forma segura. En particular, la incorporaci\ón de la tecnolog\ía RFID en objetos personales conlleva m\últiples riesgos de seguridad y privacidad que han suscitado un elevado inter\és de la comunidad investigadora en los \últimos a\ños. M\ás all\á de su seguridad de forma aislada, su integraci\ón en la PN y la interacci\ón de \ésta con redes de \área extensa como Internet of Things requieren una arquitectura de red personal adecuada para tal contexto. Este art\ículo proporciona los fundamentos de tal arquitectura segura incluyendo el an\álisis de aspectos como la incorporaci\ón e inicializaci\ón de las restringidas etiquetas RFID en la red personal, la autenticaci\ón tanto de miembros de la PN como de usuarios y servicios remotos en su acceso a las tecnolog\ías de contexto, el control de las pol\íticas de privacidad y el establecimiento de canales seguros de comunicaci\ón supervisados.

}, keywords = {arquitectura software, red personal, Seguridad RFID}, isbn = {978-84-694-5948-5}, author = {Pablo Najera and Rodrigo Roman and Javier Lopez}, editor = {Klaus Hackbarth and Ram{\'o}n Ag{\"u}ero and Roberto Sanz} } @inproceedings {1642, title = {Analysis of Secure Mobile Grid Systems: A systematic approach}, booktitle = {XVI Jornadas de Ingenier{\'\i}a del Software y Bases de Datos (JISBD 2011)}, year = {2011}, month = {2011}, pages = {487-491}, publisher = {Servizo de publicaci{\'o}ns da Universidade da Coru{\~n}a}, organization = {Servizo de publicaci{\'o}ns da Universidade da Coru{\~n}a}, address = {A Coru{\~n}a, Spain}, abstract = {

Developing software through systematic processes is becoming more and more important due to the growing complexity of software development. It is important that the development process used integrates security aspects from the first stages at the same level as other functional and non-functional requirements. The identification of security aspects in the first stages ensures a more robust development and permits the security requirements to be perfectly coupled with the design and the rest of the system\’s requirements. Systems which are based on Grid Computing are a kind of systems that have clear differentiating features in which security is a highly important aspect. Generic development processes are sometimes used to develop Grid specific systems without taking into consideration either the subjacent technological environment or the special features and particularities of these specific systems. In fact, the majority of existing Grid applications have been built without a systematic development process and are based on ad hoc developments.

}, isbn = {978-84-9749-486-1}, author = {David G. Rosado and E. Fernandez-Medina and M. Pattini and Javier Lopez} } @inproceedings {agudo2011cryptography, title = {Cryptography Goes to the Cloud}, booktitle = {1st International Workshop on Security and Trust for Applications in Virtualised Environments (STAVE 2011)}, series = {Communications in Computer and Information Science}, volume = {187}, year = {2011}, month = {June}, pages = {190-197}, publisher = {Springer}, organization = {Springer}, abstract = {

In this paper we identify some areas where cryptography can help a rapid adoption of cloud computing. Although secure storage has already captured the attention of many cloud providers, offering a higher level of protection for their customer{\textquoteright}s data, we think that more advanced techniques such as searchable encryption and secure outsourced computation will become popular in the near future, opening the doors of the Cloud to customers with higher security requirements.

}, isbn = {978-3-642-22364-8}, doi = {10.1007/978-3-642-22365-5_23}, author = {Isaac Agudo and David Nu{\~n}ez and Gabriele Giammatteo and Panagiotis Rizomiliotis and Costas Lambrinoudakis}, editor = {Changhoon Lee and Jean-Marc Seigneur and James J. Park and Roland R. Wagner} } @inproceedings {Roman11SK, title = {SenseKey - Simplifying the Selection of Key Management Schemes for Sensor Networks}, booktitle = {5th International Symposium on Security and Multimodality in Pervasive Environments (SMPE{\textquoteright}11)}, year = {2011}, month = {March}, publisher = {IEEE}, organization = {IEEE}, address = {Singapore}, abstract = {

Key Management Schemes (KMS) are a very important security mechanism for Wireless Sensor Networks (WSN), as they are used to manage the credentials (i.e. secret keys) that are needed by the security primitives. There is a large number of available KMS protocols in the literature, but it is not clear what should network designers do to choose the most suitable protocol for the needs of their applications. In this paper, we consider that given a certain set of application requirements, the network designer can check which properties comply with those requirements and select the KMS protocols that contains those particular properties. Therefore, we study the relationship between requirements and properties, and we provide a web tool, the SenseKey tool, that can be used to automatically obtain an optimal set of KMS protocols.

}, doi = {10.1109/WAINA.2011.78}, url = {http://www.ftrai.org/smpe2011/}, author = {Rodrigo Roman and Javier Lopez and Cristina Alcaraz and Hsiao Hwa Chen} } @inproceedings {Leon11, title = {Towards a Cooperative Intrusion Detection System for Cognitive Radio Networks}, booktitle = {Workshop on Wireless Cooperative Network Security (WCNS{\textquoteright}11)}, series = {LNCS}, year = {2011}, month = {May}, publisher = {Springer}, organization = {Springer}, abstract = {

Cognitive Radio Networks (CRNs) arise as a promising solution to the scarcity of spectrum. By means of cooperation and smart decisions influenced by previous knowledge, CRNs are able to detect and profit from the best spectrum opportunities without interfering primary licensed users. However, besides the well-known attacks to wireless networks, new attacks threat this type of networks. In this paper we analyze these threats and propose a set of intrusion detection modules targeted to detect them. Provided method will allow a CRN to identify attack sources and types of attacks, and to properly react against them.

}, doi = {10.1007/978-3-642-23041-7_22}, url = {http://www.networking2011.org/workshops/WCNS.html}, author = {Olga Leon and Rodrigo Roman and Juan Hernandez Serrano} } @inproceedings {Alcaraz2010, title = {Acceso seguro a redes de sensores en SCADA a trav{\'e}s de Internet}, booktitle = {XI Reuni{\'o}n Espa{\~n}ola sobre Criptolog{\'\i}a y Seguridad de la Informaci{\'o}n (RECSI 2010)}, year = {2010}, month = {September}, pages = {337-342}, address = {Tarragona (Spain)}, abstract = {

Las Infraestructuras Cr\íticas (ICs) son monitorizadas por sistemas altamente complejos, conocidos como sistemas SCADA (Sistemas de Control y Adquisici\ón de Datos), cuyo principal soporte se encuentra en las subestaciones, las cuales miden de primera instancia el estado real de tales ICs. Para mejorar este control, la industria est\á actualmente demandando la integraci\ón en el modelo tradicional de dos avances tecnol\ógicos: Internet y las redes de sensores inal\ámbricas. Sin embargo, su incorporaci\ón requiere analizar los requisitos de seguridad que surgen en dicho contexto, as\í como diversos aspectos correlacionados (ej. mantenimiento, rendimiento, seguridad y optimizaci\ón) y, en base a estos, la estrategia de integraci\ón m\ás adecuada para satisfacer dichos requisitos. Este art\ículo proporciona dicho an\álisis en profundidad con el fin de ofrecer un modelo de integraci\ón seguro adecuado para entornos cr\íticos.

}, keywords = {el Internet, Internet of Things, Redes Mesh Inal{\'a}mbrica de Sensores, Sistemas Cr{\'\i}ticos de Control, Sistemas SCADA}, isbn = {978-84-693-3304-4}, url = {http://crises-deim.urv.cat/recsi2010/}, author = {Cristina Alcaraz and Rodrigo Roman and Pablo Najera and Javier Lopez} } @inproceedings {Rios2010a, title = {Implementaci{\'o}n de un esquema de localizaci{\'o}n privada y segura para interiores}, booktitle = {IX Jornadas de Ingenier{\'\i}a Telem{\'a}tica (JITEL{\textquoteright}10)}, year = {2010}, month = {Sept.}, pages = {237 - 244}, address = {Valladolid (Spain)}, abstract = {

Las aplicaciones basadas en localizaci\ón proporcionan a los usuarios servicios personalizados dependiendo de su ubicaci\ón. Las estimaciones prev\én que estos servicios se extender\án enormemente en los pr\óximos a\ños reportando grandes beneficios tanto a la industria como a los usuarios finales. Sin embargo, para que estos avances sean posibles se hace necesario analizar en profundidad las distintas implicaciones de seguridad y privacidad que la utilizaci\ón de tales servicios pueden traer consigo a los usuarios. En este trabajo proponemos un sistema de localizaci\ón que da soporte a la provisi\ón de servicios basados en localizaci\ón para entornos indoor y que se fundamenta en la tecnolog\ía de redes de sensores inal\ámbricos. En este esquema hemos tenido en cuenta diversos aspectos de seguridad y privacidad, prestando especial atenci\ón a la limitaci\ón extrema de recursos caracter\ística de las redes de sensores. Finalmente hemos desarrollado una prueba de concepto para comprobar la viabilidad de nuestro esquema dentro del \ámbito del proyecto OSAmI.

}, isbn = {978-84-693-5398-1}, author = {Ruben Rios and Isaac Agudo and Jose L. Gonzalez}, editor = {Yannis Dimitriadis and Mar{\'\i}a Jes{\'u}s Verd{\'u} P{\'e}rez} } @inproceedings {Rios2010, title = {Source Location Privacy Considerations in Wireless Sensor Networks}, booktitle = {4th International Symposium of Ubiquitous Computing and Ambient Intelligence (UCAmI{\textquoteright}10)}, year = {2010}, month = {Sept.}, pages = {29 - 38}, publisher = {IBERGARCETA PUBLICACIONES, S.L.}, organization = {IBERGARCETA PUBLICACIONES, S.L.}, address = {Valencia (Spain)}, abstract = {

Wireless Sensor Networks are considered to be one of the cornerstones of Ambient Intelligence since they can be used in countless applications, where sensors are unobtrusively embedded into the environment to perform operations like monitoring, tracking and reporting. In such scenarios, privacy issues must be carefully considered since the mere observation of the network operation might reveal great amounts of private information to unauthorised parties. One of the problems that is gaining more attention in the realm of privacy, is the location privacy problem, which aims to prevent an attacker from obtaining the location of specific nodes of interest to him. In this paper we provide a general overview of the proposed solutions to counter this threat. Finally, we will also discuss some open challenges and future directions of research for a convenient management of privacy issues in smart environments.

}, isbn = {978-84-92812-61-5}, author = {Ruben Rios and Javier Lopez}, editor = {Lidia Fuentes and Nadia G{\'a}mez and Jos{\'e} Bravo} } @inproceedings {rosado2010c, title = {A Study of Security Approaches for the Development of Mobile Grid Systems}, booktitle = {5th International Conference on Software and Data Technologies (ICSOFT{\textquoteright}10)}, volume = {1}, year = {2010}, month = {july}, pages = {133-138}, publisher = {Springer}, organization = {Springer}, address = {Athens, Greece}, abstract = {

Mobile Grid systems allow us to build highly complex information systems with various and remarkable features (interoperability between multiple security domains, cross-domain authentication and authorization, dynamic, heterogeneous and limited mobile devices, etc), which demand secure development methodologies to build quality software, offering methods, techniques and tools that facilitate the work of the entire team involved in software development. These methodologies should be supported by Grid security architectures that define the main security aspects to be considered, and by solutions to the problem of how to integrate mobile devices within Grid systems. Some approaches regarding secure development methodologies of Grid security architectures and of the integration of mobile devices in the Grid have been found in literature, and these are analyzed and studied in this paper, offering a comparison framework of all the approaches related to security in Mobile Grid environments.

}, isbn = {978-989-8425-22-5}, author = {David G. Rosado and Eduardo Fernandez-Medina and Javier Lopez} } @inproceedings {calcaraz10, title = {Wireless Sensor Networks and the Internet of Things: Do We Need a Complete Integration?}, booktitle = {1st International Workshop on the Security of the Internet of Things (SecIoT{\textquoteright}10)}, year = {2010}, month = {December}, pages = {xxxx}, publisher = {IEEE}, organization = {IEEE}, address = {Tokyo (Japan)}, abstract = {

Wireless sensor networks (WSN) behave as a digital skin, providing a virtual layer where the information about the physical world can be accessed by any computational system. As a result, they are an invaluable resource for realizing the vision of the Internet of Things (IoT). However, it is necessary to consider whether the devices of a WSN should be completely integrated into the Internet or not. In this paper, we tackle this question from the perspective of security. While we will mention the different security challenges that may arise in such integration process, we will focus on the issues that take place at the network level.

}, issn = {xxxx}, author = {Cristina Alcaraz and Pablo Najera and Javier Lopez and Rodrigo Roman} } @inproceedings {Alcaraz2009, title = {Adaptive Dispatching of Incidences Based on Reputation for SCADA Systems}, booktitle = {6th International Conference on Trust, Privacy and Security in Digital Business (TrustBus{\textquoteright}09)}, series = {LNCS}, year = {2009}, month = {September}, pages = {86-94}, publisher = {Springer-Verlag}, organization = {Springer-Verlag}, address = {Linz, Austria}, abstract = {

SCADA systems represent a challenging scenario where the management of critical alarms is crucial. Their response to these alarms should be efficient and fast in order to mitigate or contain undesired effects. This work presents a mechanism, the Adaptive Assignment Manager (AAM) that will aid to react to incidences in a more efficient way by dynamically assigning alarms to the most suitable human operator. The mechanism uses various inputs for identifying the operators such as their availability, workload and reputation. In fact, we also define a reputation component that stores the reputation of the human operators and uses feedback from past experiences.

}, keywords = {Critical Control Systems, Reputation, Supervisory Control and Data Acquisition Systems}, isbn = {978-3-642-03747-4}, doi = {10.1007/978-3-642-03748-1_9}, author = {Cristina Alcaraz and Isaac Agudo and Carmen Fernandez-Gago and Rodrigo Roman and Gerardo Fernandez and Javier Lopez} } @inproceedings {Lopez2009, title = {Analysis of Security Threats, Requirements, Technologies and Standards in Wireless Sensor Networks}, booktitle = {Foundations of Security Analysis and Design 2009}, series = {LNCS}, volume = {5705}, year = {2009}, month = {August}, pages = {289-338}, publisher = {Springer Berlin/Heidelberg}, organization = {Springer Berlin/Heidelberg}, address = {Bertinoro (Italy)}, abstract = {

As sensor networks are more and more being implemented in real world settings, it is necessary to analyze how the different requirements of these real-world applications can influence the security mechanisms. This paper offers both an overview and an analysis of the relationship between the different security threats, requirements, applications, and security technologies. Besides, it also overviews some of the existing sensor network standards, analyzing their security mechanisms.

}, isbn = {978-3-642-03828-0}, issn = {0302-9743 (Print) 1611-3349 (Online)}, doi = {10.1007/978-3-642-03829-7_10}, url = {http://www.springerlink.com/content/u8h4882831k474n6/}, author = {Javier Lopez and Rodrigo Roman and Cristina Alcaraz} } @inproceedings {rosado2009f, title = {Applying a UML Extension to build Use Cases diagrams in a secure mobile Grid application}, booktitle = {5th International Workshop on Foundations and Practices of UML}, series = {LNCS}, volume = {5833}, year = {2009}, pages = {126-136}, publisher = {Springer Berlin Heidelberg}, organization = {Springer Berlin Heidelberg}, address = {Gramado, Brasil}, abstract = {

Systems based on Grid computing have not traditionally beendeveloped through suitable methodologies and have not taken into accountsecurity requirements throughout their development, offering technical securitysolutions only during the implementation stages. We are creating a developmentmethodology for the construction of information systems based on GridComputing, which is highly dependent on mobile devices, in which securityplays a highly important role. One of the activities in this methodology is therequirements analysis which is use-case driven. In this paper, we build use casediagrams for a real mobile Grid application by using a UML-extension, calledGridUCSec-Profile, through which it is possible to represent specific mobileGrid features and security aspects for use case diagrams, thus obtainingdiagrams for secure mobile Grid environments.

}, isbn = {978-3-642-04946-0}, author = {David G. Rosado and Eduardo Fernandez-Medina and Javier Lopez} } @inproceedings {roman2009, title = {Do Wireless Sensor Networks Need to be Completely Integrated into the Internet?}, booktitle = {3rd CompanionAble Workshop - Future Internet of People, Things and Services (IoPTS) eco-Systems}, year = {2009}, month = {December}, pages = {xxxx}, publisher = {xxxx}, organization = {xxxx}, address = {Brussels (Belgium)}, abstract = {

Wireless sensor networks are considered as an integral part of the Internet of Things paradigm. Not only they provide a virtual presence to elements of the real world, but also allow any computationalsystem to know about the physical state of those elements thanks to the use of embedded sensors. In order to belong to the Internet of Things, the elements of a sensor network can implement Internet protocols and services such as the TCP/IP stack and web services. Still, a question that must be raised at this point of time is whether all sensor network applications should be completely integrated into the Internet or not. The purpose of this paper is to analyze this question, reviewing the challenges and security requirements of Internet-enabled sensor networks.

}, issn = {xxxx}, author = {Rodrigo Roman and Javier Lopez and Cristina Alcaraz} } @inproceedings {rosado2009e, title = {Extensi{\'o}n UML para Casos de Uso Reutilizables en entornos Grid M{\'o}viles Seguros}, booktitle = {XIV Jornadas de Ingenier{\'\i}a del Software y Bases de Datos (JISBD 2009)}, year = {2009}, month = {September}, pages = {331-342}, publisher = {Antonio Vallecillo and Goiuria Sagardui (Eds.)}, organization = {Antonio Vallecillo and Goiuria Sagardui (Eds.)}, address = {San Sebasti{\'a}n, Espa{\~n}a}, abstract = {

Los sistemas Grid nos permiten construir sistemas complejos concaracter{\'\i}sticas diferenciadoras (interoperabilidad entre m{\'u}ltiples dominios deseguridad, autenticaci{\'o}n y autorizaci{\'o}n a trav{\'e}s de dominios, sistema din{\'a}micoy heterog{\'e}neo, etc.). Con el desarrollo de la tecnolog{\'\i}a wireless y losdispositivos m{\'o}viles, el Grid llega a ser el candidato perfecto para que losusuarios m{\'o}viles puedan realizar trabajos complejos, a la vez que a{\~n}aden nuevacapacidad computacional al Grid. Estamos construyendo un proceso completode desarrollo para sistemas Grid m{\'o}viles seguros, y una de las actividades es elan{\'a}lisis de requisitos, que est{\'a} basado en casos de uso reutilizables. En esteart{\'\i}culo, presentaremos una extensi{\'o}n UML para casos de uso de seguridad yGrid, los cuales capturan el comportamiento de este tipo de sistemas. Estaextensi{\'o}n UML est{\'a} siendo aplicado a un caso real para construir diagramas decasos de uso de la aplicaci{\'o}n, incorporando los aspectos de seguridadnecesarios.

}, isbn = {978-84-692-4211-7}, author = {David G. Rosado and Eduardo Fernandez-Medina and Javier Lopez} } @inproceedings {rosado2009d, title = {Hacia una Arquitectura de Servicios de Seguridad para entornos Grid m{\'o}viles}, booktitle = {V Congreso Iberoamericano de Seguridad Inform{\'a}tica (CIBSI{\textquoteright}09)}, year = {2009}, pages = {409-423}, publisher = {Universidad de la Rep{\'u}blica, Uruguay}, organization = {Universidad de la Rep{\'u}blica, Uruguay}, address = {Montevideo, Uruguay}, abstract = {

Grid m{\'o}vil incluye las caracter{\'\i}sticas de los sistemas Grid junto conlas peculiaridades de la computaci{\'o}n m{\'o}vil, a{\~n}adiendo la propiedad de soportarusuarios y recursos m{\'o}viles de forma homog{\'e}nea, transparente, segura yeficiente. La seguridad de estos sistemas, debido a su naturaleza abierta ydistribuida, es un tema de gran inter{\'e}s. Una arquitectura de seguridad basada enSOA proporciona una arquitectura distribuida dise{\~n}ada para interoperabilidadde servicios, f{\'a}cil integraci{\'o}n, y acceso seguro, simple y extensible. Por tanto,una arquitectura orientada a servicios de seguridad es construida para entornosGrid m{\'o}viles, ofreciendo servicios de seguridad a usuarios m{\'o}viles quienesusan servicios Grid y recursos para ejecutar sus trabajos y tareas. Estaarquitectura es integrada con otras arquitecturas existentes proporcionandomayor seguridad y permitiendo que los usuarios m{\'o}viles puedan acceder aservicios Grid existentes ofreciendo nuevos y necesarios servicios de seguridadpara Grid m{\'o}viles. Hemos definido un conjunto de servicios de seguridad, quejunto a protocolos, pol{\'\i}ticas y est{\'a}ndares de seguridad forman una arquitecturade seguridad orientada a servicios para entornos Grid m{\'o}viles. Esta arquitecturaes abierta, escalable, din{\'a}mica, interoperable y flexible.

}, isbn = {978-9974-0-0593-8}, author = {David G. Rosado and Eduardo Fernandez-Medina and Javier Lopez} } @inproceedings {rosado2009b, title = {Reusable Security Use Cases for Mobile Grid environments}, booktitle = {Workshop on Software Engineering for Secure Systems}, year = {2009}, pages = {1-8}, publisher = {IEEE}, organization = {IEEE}, address = {Vancouver, Canada}, abstract = {

Due to the growing complexity of softwaredevelopment, developing software through systematicprocesses is becoming more and more important.Likewise, it is important that the development processused integrates security aspects from the first stages atthe same level as other functional and non-functionalrequirements. In the last years, GRID technology hasshown to be the most important one and it allows us tobuild very complex information systems with differentand remarkable features (interoperability betweenmultiple security domains, cross-domainauthentication and authorization, dynamic,heterogeneous and limited mobile devices, etc).Traditionally, systems based on GRID Computing havenot been developed through adequate methodologiesand have not taken into account security requirementsthroughout their development, only offering securitytechnical solutions at the implementation stages. Thispaper shows part of a development methodology thatwe are elaborating for the construction of informationsystems based on Grid Computing highly dependent onmobile devices where security plays a very importantrole. Specifically, in this paper, we will present theanalysis phase, managed by reusable use casesthrough which we can define the requirements andneeds of these systems obtaining an analysis modelthat can be used as input to the following phase of themethodology, the design phase of mobile Grid systems.

}, isbn = {978-1-4244-3725-2}, author = {David G. Rosado and Eduardo Fernandez-Medina and Javier Lopez} } @inproceedings {rosado2009a, title = {Reutilizaci{\'o}n de Casos de Uso en el Desarrollo de Sistemas Grid seguros}, booktitle = {XII Conferencia Iberoamericana de Ingenier{\'\i}a de Requisitos y Ambientes de Software (IDEAS{\textquoteright}09)}, year = {2009}, pages = {388-393}, publisher = {University of Colombia}, organization = {University of Colombia}, address = {Medell{\'\i}n, Colombia}, abstract = {

El desarrollo software debe estar basado en un proceso sistem{\'a}tico y estructurado donde se definan los m{\'e}todos y t{\'e}cnicas a utilizar en todo su ciclo de vida, ayudando as{\'\i} a obtener un producto de calidad. Es igualmente importante que el proceso sistem{\'a}tico considere aspectos de seguridad desde las primeras etapas, integr{\'a}ndola como un elemento m{\'a}s en el ciclo de desarrollo. En este art{\'\i}culo mostramos la metodolog{\'\i}a de desarrollo sistem{\'a}tico que sirve de gu{\'\i}a para el desarrollo de cualquier sistema Grid con dispositivos m{\'o}viles, considerando la seguridad durante todas las fases de desarrollo, lo que nos permitir{\'a} obtener como resultado sistemas Grid seguros, robustos y escalables. Este art{\'\i}culo presenta la fase de an{\'a}lisis, dirigida por casos de uso reutilizables, mediante los cuales se definen los requisitos y necesidades de estos sistemas, y es aplicada a un caso de estudio real de un Grid para el acceso de contenidos multimedia en un contexto period{\'\i}stico.

}, isbn = {978-958-44-5028-9}, author = {David G. Rosado and Eduardo Fernandez-Medina and Javier Lopez} } @inproceedings {Benito2009, title = {SMEPP: A Secure Middleware for Embedded P2P}, booktitle = {ICT Mobile and Wireless Communications Summit (ICT-MobileSummit{\textquoteright}09)}, year = {2009}, month = {June}, address = {Santander (Spain)}, abstract = {

The increasing presence of embedded devices with internet access capabilities constitutes a new challenge in software development. These devices are now cooperating in a distributed manner towards what has been called as \"Internet of Things\". In this new scenario the client-server model is sometimes not adequate and dynamic ad-hoc networks are more common than before. However, security poses as a hard issue as these systems are extremely vulnerable. In this paper, we introduce SMEPP project, which aims at developing a middleware designed for P2P systems with a special focus on embedded devices and security. SMEPP is designed to be deployed in a wide range of devices. It tries to ease the development of applications hiding platforms details and other aspects such as scalability, adaptability and interoperability. A full implementation of this middleware is already available that incorporates security features specially designed for low-resource devices. Moreover, we describe two business applications being developed using this middleware in the context of \"Digital Home\" and \"Environmental Monitoring in Industrial Environments\".

}, isbn = {978-1-905824-12-0}, author = {Rafael J. Caro and David Garrido and Pierre Plaza and Rodrigo Roman and Nuria Sanz and Jose L. Serrano} } @inproceedings {Alcaraz2008, title = {An{\'a}lisis de la Aplicabilidad de las Redes de Sensores para la Protecci{\'o}n de Infraestructuras de Informaci{\'o}n Cr{\'\i}ticas}, booktitle = {VI Jornadas de Ingenier{\'\i}a Telem{\'a}tica (JITEL{\textquoteright}08)}, year = {2008}, month = {September}, pages = {437}, address = {Alcal{\'a} de Henares (Spain)}, abstract = {

Las infraestructuras cr\íticas, como el sector energ\ético, la banca, el transporte, y muchas otras, son un pilar esencial para en bienestar de la sociedad y la econom\ía de un pa\ís. Estas infraestructuras dependen a su vez de ciertas infraestructuras de informaci\ón, las cuales permiten su correcto funcionamiento. La tarea de proteger esas infraestructuras (de informaci\ón) cr\íticas es compleja y multidimensional, con una gran cantidad de desaf\íos por resolver. Precisamente, las redes de sensores pueden ser de gran ayuda para esta tarea, debido a suscapacidades de control distribuidas y a su habilidad de funcionar en situaciones extremas. Este art\ículo analiza la utilidad de las redes de sensores en este contexto, describiendo tanto sus capacidades como sus posibles roles y mecanismos de integraci\ón para la protecci\ón de infraestructuras (de informaci\ón) cr\íticas.

}, isbn = {978-84-612-5474-3}, url = {http://www.telematica.ws/jitel/2008/default.htm}, author = {Cristina Alcaraz and Rodrigo Roman and Javier Lopez} } @inproceedings {Rios2008, title = {Clasificaci{\'o}n de canales encubiertos. Un nuevo canal: Covert_DHCP}, booktitle = {X Reuni{\'o}n Espa{\~n}ola de Criptolog{\'\i}a y Seguridad de la Informaci{\'o}n (RECSI{\textquoteright}08)}, year = {2008}, month = {Sept.}, pages = {325-336}, address = {Salamanca (Spain)}, abstract = {

Los canales encubiertos son una forma de comunicaci\ón oculta que puede vulnerar la integridad de los sistemas. Desde sus inicios en sistemas de seguridad multinivel a principios de los a\ños 70 han evolucionado considerablemente, apareciendo soluciones para redes de computadores debido a la especificaci\ón de algunos protocolos. Por este motivo, se hace un estudio sobre las t\écnicas que se han utilizado para crear los canales, as\í como sobre las distintos obst\áculos que han tratado de mermar su actividad. Asimismo, se presenta una nueva clasificaci\ón que trata de albergar la mayor cantidad de canales encubiertos existentes en la actualidad. Por \último, se analiza un protocolo ampliamente extendido en la actualidad, DHCP, en busca de posibilidades de albergar informaci\ón encubierta. A partir de este an\álisis se implementan distintas versiones de un canal encubierto haciendo uso de este protocolo.

}, keywords = {Canales encubiertos, control de accesos y detecci{\'o}n de intrusos, seguridad en redes, seguridad en sistemas de informaci{\'o}n}, isbn = {978-84-691-5158-7}, author = {Ruben Rios and Jose A. Onieva}, editor = {Luis Hern{\'a}ndez Encinas and Angel Martin del Rey} } @inproceedings {rosado2008a, title = {Engineering Process Based On Grid Use Cases For Mobile Grid Systems}, booktitle = {Third International Conference on Software and Data Technologies (ICSOFT{\textquoteright}08)}, year = {2008}, pages = {146-151}, publisher = {Springer}, organization = {Springer}, address = {Porto, Portugal}, abstract = {

The interest to incorporate mobile devices into Grid systems has arisen with two main purposes. The firstone is to enrich users of these devices while the other is that of enriching the own Grid infrastructure.Security of these systems, due to their distributed and open nature, is considered a topic of great interest. Aformal approach to security in the software life cycle is essential to protect corporate resources. However,little attention has been paid to this aspect of software development. Due to its criticality, security should beintegrated as a formal approach into the software life cycle. We are developing a methodology ofdevelopment for secure mobile Grid computing based systems that helps to design and build secure Gridsystems with support for mobile devices directed by use cases and security use cases and focused onservice-oriented security architecture. In this paper, we will present one of the first steps of ourmethodology consisting of analyzing security requirements of mobile grid systems. This analysis will allowus to obtain a set of security requirements that our methodology must cover and implement.

}, isbn = {978-3-642-05200-2}, issn = {1865-0929}, author = {David G. Rosado and Eduardo Fernandez-Medina and Javier Lopez and Mario Piattini} } @inproceedings {Galindo2008a, title = {An Evaluation of the Energy Cost of Authenticated Key Agreement in Wireless Sensor Networks}, booktitle = {X Reuni{\'o}n Espa{\~n}ola sobre Criptolog{\'\i}a y Seguridad de la Informaci{\'o}n (RECSI{\textquoteright}08)}, year = {2008}, month = {September}, pages = {231-236}, address = {Salamanca (Spain)}, abstract = {

Wireless sensors are battery-powered devices which are highly constrained in terms of computational capabilities, memory, and communication bandwidth. While battery life is their main limitation, they require considerable energy to communicate data. Due to this, the energy saving of computationally inexpensive security primitives (like those using symmetric key cryptography) can be nullified by the bigger amount of data they require to be sent. In this work we study the energy cost of key agreement protocols between peers in a network using public key cryptography techniques. Our concern is to reduce the amount of data to be exchanged. Our main news is that a computationally very demanding security primitive, such as identity-based authenticated key exchange, can present energy-wise a better performance than traditional public key based key exchange in realistic scenarios such as Underwater Wireless Sensor Networks. Such a result is not to be expected in wired networks.

}, author = {David Galindo and Rodrigo Roman and Javier Lopez} } @inproceedings {Roman2008b, title = {KeyLED - Transmitting Sensitive Data over out-of-band Channels in Wireless Sensor Networks}, booktitle = {5th IEEE International Conference on Mobile Ad Hoc and Sensor Systems (MASS{\textquoteright}08)}, year = {2008}, month = {September}, pages = {796-801}, publisher = {IEEE}, organization = {IEEE}, address = {Atlanta (USA)}, abstract = {

An out-of-band (OoB) channel can be defined as an extra channel, different from the main wireless channel, that has additional security properties. They are specially suitable for protecting spontaneous interactions and exchanging sensitive data between previously unknown devices. Due to the vulnerable nature of wireless sensor networks (WSN), these kind of channels might be useful for protecting certain sensor network operations. In this paper we analyze the applicability of out-of-band channels to wireless sensor networks, and specify why an optical channel should be a good candidate for implementing an extra channel in sensor nodes. Also, we analyze how the existing security threats may affect this type of channel. Finally, the suitability and usability of optical channels for sensor networks is demonstrated by means of a prototype.

}, keywords = {Out-of-Band Channel, security, wireless sensor networks}, isbn = {978-1-4244-2574-7}, doi = {10.1109/MAHSS.2008.4660128}, author = {Rodrigo Roman and Javier Lopez} } @inproceedings {Galindo2008aa, title = {A Killer Application for Pairings: Authenticated Key Establishment in Underwater Wireless Sensor Networks}, booktitle = {Proceedings of the 7th International Conference on Cryptology and Network Security (CANS{\textquoteright}08)}, series = {LNCS}, volume = {5339}, year = {2008}, month = {December}, pages = {120-132}, publisher = {Springer}, organization = {Springer}, address = {Hong Kong (China)}, abstract = {

Wireless sensors are low power devices which are highly constrained in terms of computational capabilities, memory, and communication bandwidth. While battery life is their main limitation, they require considerable energy to communicate data. The latter is specially dramatic in underwater wireless sensor networks (UWSN), where the acoustic transmission mechanisms are less reliable and more energy-demanding. Saving in communication is thus the primary concern in underwater wireless sensors. With this constraint in mind, we argue that non-interactive identity-based key agreement built on pairings provides the best solution for key distribution in large UWSN when compared to the state of the art. At first glance this claim is surprising, since pairing computation is very demanding. Still, pairing-based non-interactive key establishment requires minimal communication and at the same time enjoys excellent properties when used for key distribution.

}, keywords = {identity-based key agreement, key distribution, pairings, underwater wireless sensor networks}, isbn = {978-3-540-89640-1}, issn = {0302-9743 (Print) 1611-3349 (Online)}, doi = {10.1007/978-3-540-89641-8_9}, url = {http://www.springerlink.com/content/g26h0115ngt12331/}, author = {David Galindo and Rodrigo Roman and Javier Lopez} } @inproceedings {Benito2008, title = {Middleware Seguro EP2P: un Desaf{\'\i}o para las Redes Sociales}, booktitle = {XVIII Jornadas Telecom I+D}, year = {2008}, month = {October}, address = {Bilbao (Spain)}, abstract = {

Los sistemas distribuidos en dispositivos embebidos representan un nuevo reto en el desarrollo de software. Estos sistemas han supuesto una importante revoluci{\'o}n en el paradigma de la computaci{\'o}n distribuida donde se intenta fragmentar un problema grande en m{\'u}ltiples problemas m{\'a}s peque{\~n}os. El nuevo escenario tiende entonces hacia sistemas en los cuales todos los elementos de la red se consideran iguales y los mecanismos de comunicaci{\'o}n est{\~a}n basados en redes ad-hoc que se forman din{\'a}micamente. De esta forma cualquier usuario de la red (en realidad cualquier elemento, hasta el m{\'a}s simple dispositivo) adquiere valor, a mayor colaboraci{\'o}n, mayor {\'e}xito del sistema. Sin embargo, desde el punto de vista de la seguridad, estos sistemas son extremadamente vulnerables. En este art{\'\i}culo se presenta SMEPP, un middleware dise{\~n}ado especialmente para sistemas P2P incluyendo aspectos de seguridad. SMEPP est{\'a} dise{\~n}ado para poder ser ejecutado en un amplio rango de dispositivos (desde redes de sensores hasta PC), y trata de facilitar el desarrollo de aplicaciones ocultando los detalles de la plataforma y otros aspectos tales como escalabilidad, adaptabilidad e interoperabilidad. Adem{\'a}s el art{\'\i}culo presenta dos aplicaciones de alto nivel que utilizando este middleware pasan a ser m{\'a}s personales, m{\'a}s sociales y m{\'a}s baratas, haciendo que todos los usuarios de la red cobren mayor importancia.

}, author = {Rafael J. Caro and David Garrido and Pierre Plaza and Rodrigo Roman and Nuria Sanz and Jose L. Serrano} } @inproceedings {rosado2008, title = {PSecGCM: Process for the development of Secure Grid Computing based Systems with Mobile devices}, booktitle = {International Conference on Availability, Reliability and Security (ARES{\textquoteright}08)}, year = {2008}, pages = {136-143}, publisher = {IEEE Computer Society}, organization = {IEEE Computer Society}, address = {A Grid computing system is defined as a platform that supports distributed system applications which require fast access to a large quantity of distributed resources in a coordinated manner. With the development of wireless technology and mobile devices,}, abstract = {

A Grid computing system is defined as a platformthat supports distributed system applications which require fastaccess to a large quantity of distributed resources in acoordinated manner. With the development of wirelesstechnology and mobile devices, the Grid becomes the perfectcandidate so that mobile users can make complex works that addnew computational capacity to the Grid. Security of thesesystems, due to their distributed and open nature, receives greatinterest. The growing size and profile of the grid requirecomprehensive security solutions as they are critical to thesuccess of the endeavour. A formal approach to security in thesoftware life cycle is essential to protect corporate resources.However, little thought has been given to this aspect of softwaredevelopment. Due to its criticality, security should be integratedas a formal approach in the software life cycle. A methodology ofdevelopment for secure mobile Grid computing based systems isdefined, that is to say, an engineering process that defines thesteps to follow so that starting from the necessities to solve, wecan design and construct a secure Grid system with support formobile devices that is able to solve and cover these necessities.

}, issn = {978-0-7695-3102-1}, author = {David G. Rosado and Eduardo Fernandez-Medina and Javier Lopez and Mario Piattini} } @inproceedings {Alcaraz2007, title = {An{\'a}lisis de primitivas criptogr{\'a}ficas para redes de sensores}, booktitle = {VI Jornadas de Ingenier{\'\i}a Telem{\'a}tica (JITEL{\textquoteright}07)}, year = {2007}, month = {September}, pages = {401-408}, address = {M{\'a}laga (Spain)}, abstract = {

Security in wireless sensor networks is very limited due to highly-constrained hardware of sensor nodes. To protect services is necessary to use secure foundations, known as security primitives, like part of a protocol. Theses primitives must assure at least confidentiality in the communication channel, authentication of the peers involved in an information exchange, and integrity of the messages. There are many primitives such as symmetric encryption, hash functions and public key cryptography, but not all of them can be supported by sensor nodes since require high resource levels, for example memory. This paper contains a deep analysis of available and suitable security primitives for sensor nodes, as well as an analysis of hardware and software implementations. Besides, it has been developed an experiment with two implementations, and it has been created a new and improved version using the optimizations of each.

}, isbn = {978-84-690-6670-6}, url = {http://www.telematica.ws/jitel/2007/}, author = {Cristina Alcaraz and Rodrigo Roman and Javier Lopez} } @inproceedings {Roman2007b, title = {Applicability of Public Key Infrastructures in Wireless Sensor Networks}, booktitle = {European PKI Workshop: Theory and Practice (EuroPKI{\textquoteright}07)}, series = {LNCS}, volume = {4582}, year = {2007}, month = {June}, pages = {313-320}, publisher = {Springer}, organization = {Springer}, address = {Mallorca (Spain)}, abstract = {

Wireless Sensor Networks (WSN) are becoming a key technology in the support of pervasive and ubiquitous services. The previous notion of PKC is too expensive for WSN has changed partially due to the existence of new hardware and software prototypes based on Elliptic Curve Cryptography and other PKC primitives. Then, it is necessary to analyze whether it is both feasible and convenient to have a Public Key Infrastructure for sensor networks that would allow the creation of PKC-based services like Digital Signatures.

}, keywords = {Public Key Cryptography, Public Key Infrastructure, wireless sensor networks}, isbn = {978-3-540-73407-9}, issn = {0302-9743 (Print) 1611-3349 (Online)}, doi = {10.1007/978-3-540-73408-6_22}, url = {http://www.springerlink.com/content/q4l10ww348010131/}, author = {Rodrigo Roman and Cristina Alcaraz} } @inproceedings {Roman2007c, title = {Featuring Trust and Reputation Management Systems for Constrained Hardware Devices}, booktitle = {1st International Conference on Autonomic Computing and Communication Systems (Autonomics{\textquoteright}07)}, year = {2007}, month = {October}, publisher = {ICST}, organization = {ICST}, address = {Rome (Italy)}, abstract = {

Research on trust management systems for wireless sensor networks is still at a very early stage and few works have done so far. It seems that for those works which deal with the topic general features of how these systems should be are not clearly identified. In this paper we try to identify the main features that a trust management system should have and justify their importance for future developments.

}, keywords = {Sensor Networks, Trust Management}, isbn = {978-963-9799-09-7}, author = {Rodrigo Roman and Carmen Fernandez-Gago and Javier Lopez} } @inproceedings {Rosado2007, title = {Hacia un Proceso sistem{\'a}tico para el desarrollo de sistemas Grid Seguros con Dispositivos M{\'o}viles}, booktitle = {IV Congreso Iberoamericano de Seguridad Inform{\'a}tica (CIBSI{\textquoteright}07)}, year = {2007}, pages = {111-124}, publisher = {Sebasti{\'a}n Ca{\~n}{\'o}n, M.A.}, organization = {Sebasti{\'a}n Ca{\~n}{\'o}n, M.A.}, address = {Mar del Plata, Argentina}, isbn = {978-950-623-043-2}, author = {David G. Rosado and Eduardo Fernandez-Medina and Javier Lopez and Mario Piattini} } @inproceedings {M.MagdalenaPayerasCapella2007, title = {Incompatibilidades entre Propiedades de los Protocolos de Intercambio Equitativo de Valores}, booktitle = {VI Jornadas de Ingenier{\'\i}a Telem{\'a}tica (JITEL{\textquoteright}07)}, year = {2007}, pages = {605-608}, publisher = {Universidad de Malaga}, organization = {Universidad de Malaga}, abstract = {

Sets of ideal properties are defined for different kinds of protocols designed for e-commerce applications. These sets are used as a start point in the design and then as a tool to evaluate the quality of the protocols. This is the case of fair exchange protocols and their application to electronic contract signing and certified electronic mail. However, in this area does not exist an agreement about which properties are ideal. Instead we can find properties described by different authors to his convenience. We illustrate the contradictions that appear between some of these properties.

}, author = {Magdalena Payeras and Josep L. Ferrer Gomila and Lloren Huguet Rotger and Jose A. Onieva} } @inproceedings {FernandezGago2007, title = {A Survey on the Applicability of Trust Management Systems for Wireless Sensor Networks}, booktitle = {3rd International Workshop on Security, Privacy and Trust in Pervasive and Ubiquitous Computing (SecPerU{\textquoteright}07)}, year = {2007}, pages = {25-30}, publisher = {IEEE Computer Society}, organization = {IEEE Computer Society}, address = {Istanbul (Turkey)}, abstract = {

Trust plays an important role in human life environments and virtual organizations. In the context of a network, trust may help its elements to decide whether another member of the same network is being uncooperative or malicious. Trust becomes quite important in self-configurable and autonomous systems, such as wireless sensor networks (WSN). However, very little effort has been done in the field of trust management in WSN. On the other hand, some efforts have been made in quite related fields such as Ad-hoc and P2P networks. In this paper we give an overview of existing trust management solutions, mainly those developed for Ad-Hoc and P2P networks and, more importantly, investigate their suitability to WSN. We also provide some guidelines to aid the development of trust management systems for WSN according to the nature of these networks.

}, doi = {10.1109/SECPERU.2007.3}, author = {Carmen Fernandez-Gago and Rodrigo Roman and Javier Lopez} } @inproceedings {Roman2006, title = {Applying Intrusion Detection Systems to Wireless Sensor Networks}, booktitle = {IEEE Consumer Communications \& Networking Conference (CCNC 2006)}, year = {2006}, month = {January}, pages = {640-644}, publisher = {IEEE}, organization = {IEEE}, address = {Las Vegas (USA)}, abstract = {

The research of Intrusion Detection Systems (IDS) is a mature area in wired networks, and has also attracted many attentions in wireless ad hoc networks recently. Nevertheless, there is no previous work reported in the literature about IDS architectures in wireless sensor networks. In this paper, we discuss the general guidelines for applying IDS to static sensor networks, and introduce a novel technique to optimally watch over the communications of the sensors{\textquoteright} neighborhood on certain scenarios.

}, isbn = {1-4244-0085-6}, doi = {10.1109/CCNC.2006.1593102}, author = {Rodrigo Roman and Jianying Zhou and Javier Lopez} } @inproceedings {Alcaraz2006, title = {Applying Key Infrastructures for Sensor Networks in {CIP/CIIP} Scenarios}, booktitle = {1st International Workshop on Critical Information Infrastructures Security (CRITIS{\textquoteright}06)}, series = {LNCS}, volume = {4347}, year = {2006}, pages = {166-178}, publisher = {Springer Berlin / Heidelberg}, organization = {Springer Berlin / Heidelberg}, abstract = {

It is commonly agreed that Wireless Sensor Networks (WSN) is one of the technologies that better fulfills features like the ones required by Critical (Information) Infrastructures. However, a sensor network is highly vulnerable against any external or internal attacks, thus network designers must know which are the tools that they can use in order to avoid such problems. In this paper we describe in detail a procedure (the KMS Guidelines), developed under our CRISIS project, that allows network designers to choose a certain Key Management System, or at least to know which protocol need to improve in order to satisfy the network requirements.

}, keywords = {Critical Information Infrastructures, Key Infrastructures, Key Management, Sensor Networks}, issn = {0302-9743 (Print) 1611-3349 (Online)}, doi = {10.1007/11962977_14}, url = {http://www.springerlink.com/content/2458827107n14870/}, author = {Cristina Alcaraz and Rodrigo Roman} } @inproceedings {JoseA.Onieva2006a, title = {Extension de una plataforma DRM basada en OMA con servicios de No Repudio}, booktitle = {IX Reunion Espa{\~n}ola sobre Criptologia y Seguridad de la Informacion (RECSI{\textquoteright}06)}, year = {2006}, pages = {129-141}, publisher = {UOC S.L.}, organization = {UOC S.L.}, abstract = {

Digital Rights Management (DRM) es un t\érmino general para cualesquiera de las soluciones que permite a un vendedor de contenido en forma electr\ónica controlar el material y restringir su uso de distintas maneras. Estas soluciones son posibles, por un lado gracias a t\écnicas de la Seguridad de la Informaci\ón, principalmente cifrado de datos, y por otro a la distribuci\ón, de manera independiente, de contenido y derechos digitales. Esto permite que los consumidores puedan acceder libremente al contenido, pero s\ólo aquellos que adquieran el derecho digital apropiado (RO) podr\án procesarlo. Como servicio de seguridad considerado en diversas capas del marco de seguridad definido por la recomendaci\ón ITU X.805, casi todas las aplicaciones necesitan considerar la propiedad de no repudio en las etapas iniciales de su dise\ño. Desafortunadamente, esto no ha sido as\í en general, y m\ás concretamente en especificaciones DRM; debido a consideraciones en la pr\áctica y al tipo de contenido a distribuir. Analizamos este servicio para un marco de DRM y proporcionamos una soluci\ón que permita que la adquisici\ón de derechos digitales sea un operaci\ón que no pueda repudiarse.

}, keywords = {aplicaciones moviles, comercio electronico seguro, digital rights management, no repudio}, author = {Jose A. Onieva and Javier Lopez and Rodrigo Roman and Jianying Zhou} } @inproceedings {JavierLopez2006a, title = {Service-Oriented Security Architecture for CII based on Sensor Networks}, booktitle = {2nd International Workshop on Security Privacy and Trust in Pervasive and Ubiquitous Computing (SecPerU{\textquoteright}06)}, year = {2006}, month = {June}, pages = {1-6}, publisher = {IEEE Press}, organization = {IEEE Press}, address = {Lyon, France}, abstract = {

The extraordinary growth of the Information Society is originating a high dependency on ICT. This provokes that those strongly interrelated technological infrastructures, as well as the information systems that underpin them, become highly critical, since their disruption would lead to high economical, material and, sometimes, human loss. As a consequence, the protection of these Critical Information Infrastructures is becoming a major objective for governments and companies. In this paper, we give an overview of the main challenges and open research issues on Critical Information Infrastructure security, and introduce an on-going research project that, using wireless sensor networks as an underlying technology, is dealing with those problems. Our research project focuses on the development of protection, control, evaluation, maintenance and verification mechanisms, integrated into a secure service-oriented architecture.

}, author = {Javier Lopez and Jose A. Montenegro and Rodrigo Roman} } @inproceedings {R.Roman2005, title = {An{\'a}lisis de Seguridad en Redes Inal{\'a}mbricas de Sensores}, booktitle = {V Jornadas de Ingener{\'\i}a Telem{\'a}tica (JITEL{\textquoteright}05)}, year = {2005}, month = {Septiembre}, pages = {335-343}, address = {Vigo (Spain)}, abstract = {

The design and development of security infrastructures and protocols for Wireless Sensor Networks is a difficult task, due to several factors like the constraints of the sensor nodes and the public nature of the communication channels. The intrinsic features of these networks create numerous security problems. In this paper, we analyze and put into perspective those problems.

}, author = {Rodrigo Roman and Javier Lopez and Jianying Zhou} } @inproceedings {Roman2005b, title = {Aplicaci{\'o}n de Sistemas de Detecci{\'o}n de Intrusiones en Redes de Sensores}, booktitle = {Simposio sobre Computaci{\'o}n Ubicua e Inteligencia Ambiental (UCAmI{\textquoteright}05)}, year = {2005}, month = {September}, pages = {113-120}, address = {Granada (Spain)}, abstract = {

Los sistemas de detecci{\'o}n de intrusiones (IDS) son una herramienta imprescindible de seguridad a la hora de proteger una red. Recientemente se han investigado y desarrollado arquitecturas de IDS para redes inal{\'a}mbricas, en concreto para redes "Ad Hoc". No obstante, no existe un trabajo previo que desarrolle una arquitectura de IDS para una red de sensores. En este art{\'\i}culo, analizamos porque los sistemas IDS de redes "Ad Hoc" no pueden aplicarse a redes de sensores, e introducimos una arquitectura de IDS para redes de sensores que incorpora una nueva t{\'e}cnica para vigilar las comunicaciones de la red en ciertos escenarios.

}, author = {Rodrigo Roman and Javier Lopez and Jianying Zhou} } @inproceedings {Roman2005c, title = {Especificaci{\'o}n de Sistemas Electr{\'o}nicos de Microdonaciones}, booktitle = {III Simposio Espa{\~n}ol de Comercio Electr{\'o}nico}, year = {2005}, month = {June}, pages = {95-104}, address = {Palma (Spain)}, abstract = {

Los sistemas electr{\'o}nicos de pago permiten que un comprador adquiera a un vendedor una serie de productos y servicios de forma virtual. Sin embargo, estos sistemas no tienen en cuenta el escenario en el que un comprador se convierte en donante, accediendo al servicio de forma gratuita. En este art{\'\i}culo se presenta el concepto y caracter{\'\i}sticas de las microdonaciones, o la donaci{\'o}n de cantidades tan peque{\~n}as como un c{\'e}ntimo de euro en el contexto del comercio electr{\'o}nico. Tambi{\'e}n se muestra como la microdonaci{\'o}n es algo necesario en el contexto actual de Internet, y como es posible su implementaci{\'o}n bas{\'a}ndose en sistemas de micropago.

}, author = {Rodrigo Roman and Javier Lopez} } @inproceedings {Onieva2005, title = {Extending an OMA-based DRM Framework with Non-Repudiation Services}, booktitle = {5th Symposium on Signal Processing and Information Technology (ISSPIT{\textquoteright}05)}, year = {2005}, pages = {472-477}, publisher = {IEEE}, organization = {IEEE}, abstract = {

Digital Rights Management (DRM) is an umbrella term for any of several arrangements which allows a vendor of content in electronic form to control the material and restrict its usage in various ways that can be specified by the vendor. These arrangements are provided through security techniques, mainly encryption, and the distribution, in a detached manner, of content and rights. This allows free access to the content by the consumers, but only those carrying the proper Right Object (RO) will be able to process such content. As a security service considered in different layers of the security framework defined by ITU X.805, almost all applications need to consider non-repudiation in the very beginning of their design. Unfortunately this has not been done so far in DRM specifications due to practical issues and the type of content distributed. We analyze this service for the a DRM framework and provide a solution which allows the right objects acquisition to be undeniable.

}, keywords = {digital rights management, Mobile applications, Non-repudiation, Secure electronic commerce}, author = {Jose A. Onieva and Jianying Zhou and Javier Lopez and Rodrigo Roman} } @inproceedings {Roman2005a, title = {Protecci{\'o}n contra el Spam Utilizando Desaf{\'\i}os a Priori}, booktitle = {V Jornadas de Ingenier{\'\i}a Telem{\'a}tica (JITEL{\textquoteright}05)}, year = {2005}, month = {September}, pages = {375-382}, address = {Vigo (Spain)}, abstract = {

Spam is considered to be one of the biggest problems in messaging systems. In the area of email Spam, A high number of anti-spam schemes have been proposed and deployed, but the problem has yet been well addressed. In this paper, we introduce a new scheme, called pre-challenge scheme, which avoids problems that exists in other schemes such as delay of service and denial of service. Some new mechanisms are employed to reach a good balance between security against Spam and convenience to email users. In addition, our scheme can be used for protecting other types of messaging systems, such as Instant Messaging (IM) and Blogs, against Spam.

}, author = {Rodrigo Roman and Javier Lopez and Jianying Zhou} } @inproceedings {Roman2005d, title = {Protection Against Spam using Pre-Challenges}, booktitle = {20th IFIP International Information Security Conference (IFIP-SEC{\textquoteright}05)}, year = {2005}, month = {May}, pages = {281-294}, publisher = {Springer}, organization = {Springer}, address = {Chiba (Japan)}, abstract = {

Spam turns out to be an increasingly serious problem to email users. A number of anti-spam schemes have been proposed and deployed, but the problem has yet been well addressed. One of those schemes is challenge-response, in which a challenge is imposed on an email sender. However, such a scheme introduces new problems for the users, e.g., delay of service and denial of service attacks. In this paper, we introduce a pre-challenge scheme that avoids those problems. It assumes each user has a challenge that is defined by the user himself/herself and associated with his/her email address, in such a way that an email sender can simultaneously retrieve a new receiver{\textquoteright}s email address and challenge before sending an email in the first contact. Some new mechanisms are employed to reach a good balance between security against spam and convenience to email users.

}, isbn = {0-387-25658-X}, author = {Rodrigo Roman and Jianying Zhou and Javier Lopez}, editor = {Ry{\^o}ichi Sasaki and Sihan Qing and Eiji Okamoto and Hiroshi Yoshiura} } @inproceedings {Roman2005e, title = {On the Security of Wireless Sensor Networks}, booktitle = {Computational Science and Its Applications (ICCSA{\textquoteright}05)}, series = {LNCS}, volume = {3482}, year = {2005}, month = {May}, pages = {681-690}, publisher = {Springer}, organization = {Springer}, address = {Singapore}, abstract = {

Wireless Sensor Networks are extremely vulnerable against any kind of internal or external attacks, due to several factors such as resource-constrained nodes and lack of tamper-resistant packages. As a result, security must be an important factor to have in mind when designing the infrastructure and protocols of sensor networks. In this paper we survey the state-of-the-art security issues in sensor networks and highlight the open areas of research.security issues in sensor networks and highlight the open areas of research.

}, isbn = {978-3-540-25862-9}, issn = {0302-9743 (Print) 1611-3349 (Online)}, doi = {10.1007/11424857_75}, url = {http://www.springerlink.com/content/pvnd4eu8b7acgtpe/}, author = {Rodrigo Roman and Jianying Zhou and Javier Lopez} } @inproceedings {EijiOkamoto2003, title = {Certificate Retrieval and Validation in Online Systems}, booktitle = {Symposium on Cryptography and Information Security (SCIS{\textquoteright}03)}, year = {2003}, month = {January}, pages = {25-30}, address = {Hamamatsu, Japan}, abstract = {

In order to more effectively deal with certificate management issues in PKIs, there is growing interest in supplementing offline X.509 PKI models with online services. An analysis of the security requirements of online models will be presented. Proposed online and delegated processing models will be evaluated in relation to these requirements.

}, author = {Eiji Okamoto and Javier Lopez and Ed Dawson and Juan M. Gonzalez-Nieto and Selwyn Russell and Jason Smith} } @inproceedings {JavierLopez2002c, title = {Design of a VPN Software Solution Integrating TCP and UDP Services}, booktitle = {International Conference on Infrastructure Security (InfraSec{\textquoteright}02)}, series = {LNCS}, volume = {2437}, year = {2002}, month = {October}, pages = {325-337}, publisher = {Springer-Verlag}, organization = {Springer-Verlag}, address = {Bristol, U.K.}, abstract = {

The main aims of Virtual Private Network (VPN) are to isolate a distributed network from outsiders, as well as to protect the confidentiality and integrity of sensitive information traversing a non-trusted network such as the Internet. However, some problems arise when security is considered as the unique problem because VPN users suffer from restrictions in their access to the network. They are not free to use traditional Internet services such as electronic mail exchange with non-VPN users, and to access Web and FTP servers external to the organization. This paper presents a new solution that allows the open use of traditional network services running over TCP and UDP layers, while maintaining strong security features. The new scheme works at the TCP/IP transport layer and does not require the addition of new hardware because it is a totally software solution. As a consequence, the application is totally portable. Moreover, and because of its implementation at the transport layer, there is no need to modify any traditional communication applications previously installed in the network system.

}, author = {Javier Lopez and Jose A. Montenegro and Rodrigo Roman and Jorge Davila} } @inproceedings {SelwynRussell2002, title = {Improving Performance in Global PKI using Virtual Certificates and Synthetic Certificates}, booktitle = {Symposium on Cryptography and Information Security (SCIS{\textquoteright}02)}, year = {2002}, month = {January}, pages = {1149-1154}, abstract = {

A digital certificate may be used to inform the world of the public key of its owner. To guard against impersonations and fraud, the receiver needs to perform a series of checks. When a hierarchy of certificates is involved, and when there are large volumes of messages between two parties, as is frequent in commerce, the repeated validation of the same chain of certificates consume significant resources. This paper presents new concepts of virtual certificate and synthetic certificate which can be used to speed up repetitive processing of a chain with improved efficiency.

}, author = {Selwyn Russell and Eiji Okamoto and Ed Dawson and Javier Lopez} } @inproceedings {1736, title = {Online Public Key Infrastructure}, booktitle = {VII Reuni{\'o}n Espa{\~n}ola sobre Criptolog{\'\i}a y Seguridad de la Informaci{\'o}n (VII RECSI)}, year = {2002}, month = {Sep 2002}, pages = {123-135}, address = {Oviedo (Spain)}, isbn = {84-699-8930-8}, author = {W. Caelli and K. Chen and E. Dawson and M. Henricksen and Javier Lopez and E. Okamoto and S. Russell and J. Smith} } @inproceedings {JorgeDavila2001, title = {Introducci{\'o}n de Aplicaciones UDP en Redes Privadas Virtuales}, booktitle = {III Jornadas de Ingenier{\'\i}a Telem{\'a}tica (JITEL{\textquoteright}01)}, year = {2001}, month = {Septiembre}, pages = {397-404}, address = {Barcelona (Spain)}, abstract = {

Virtual Private Network (VPN) solutions mainly focus on security aspects. However, when security is considered the unique problem, some collateral ones arise. VPN users suffer from restrictions in their access to the network. They are not free to use traditional Internet services such as electronic mail exchange and audio/video conference with non-VPN users, and to access Web and Ftp servers external to the organization. In this paper we present a new solution, located at the TCP/IP transport layer and oriented to UDP applications that, while maintaining strong security features, allows the open use of traditional network services. The solution does not require the addition of new hardware because it is an exclusively software solution. As a consequence, the application is totally portable.

}, author = {Jorge Davila and Javier Lopez and Rodrigo Roman} } @inproceedings {JavierLopez1999d, title = {Problem{\'a}tica de Seguridad para el Comercio Electr{\'o}nico en el Sector Tur{\'\i}stico}, booktitle = {I Congreso Nacional Turismo y Tecnolog{\'\i}a de la Informaci{\'o}n y las Comunicaciones (TURITEC{\textquoteright}99)}, year = {1999}, month = {Septiembre}, pages = {99-110}, abstract = {

Uno de los servicios que cada d\ía cobra m\ás importancia y que promete un cambio radical para las empresas es el comercio electr\ónico en Internet, pero tradicionalmente las empresas relacionadas con el turismo s\ólo han empleado la red para darse a conocer y ofertar sus productos. La raz\ón esencial es la desconfianza que existe sobre la seguridad de las transacciones llevadas a cabo en la red. La criptograf\ía de clave p\ública proporciona servicios adecuados para garantizar la seguridad de esas transacciones. Pero en la actualidad, algunos de esos servicios est\án menos desarrollados que otros; un ejemplo de ellos es el servicio de No-Repudio. En este art\ículo se estudian distintas formas de ofrecer servicios de no-repudio y se analizan sus ventajas y desventajas en funci\ón de las necesidades del entorno en que se utilicen.

}, author = {Javier Lopez and Javier Areitio and Felipe Rosello} } @inproceedings {JavierLopez1996a, title = {Comparaci{\'o}n de la Condici{\'o}n de Parikh con algunas Condiciones de los Lenguajes de Contexto Libre}, booktitle = {II Jornadas de Inform{\'a}tica y Autom{\'a}tica}, year = {1996}, month = {Julio}, pages = {305-314}, address = {Almu{\~n}ecar, Espa}, abstract = {

In this paper we first compare Parikh\’s condition to various pumping conditions - Bar-Hillel\’s pumping lemma, Ogden\’s condition and Bader-Moura\’s condition; secondly, to interchange condition; and finally, to Sokolowski\’s and Grant\’s conditions. In order to carry out these comparisons we present some properties of Parikh\’s languages. The main result is the orthogonality of the previously mentioned conditions and Parikh\’s condition.

}, author = {Javier Lopez and Gonzalo Ramos and Rafael Morales} } @inproceedings {GonzaloRamos1996, title = {ID3f+A. Algoritmo de Aprendizaje Inductivo Borroso con Divisi{\'o}n Intervalar Autom{\'a}tica de los Atributos}, booktitle = {VI Congreso Espa{\~n}ol Sobre Tecnolog{\'\i}as y L{\'o}gica Fuzzy (ESTYLF{\textquoteright}96)}, year = {1996}, month = {Septiembre}, pages = {225-230}, abstract = {

Uno de los campos m\ás prometedores dentro del estudio de la ambig\üedad es el del aprendizaje, tanto por su importancia consusntacial como por su relaci\ón con la Inteligencia Artificial. Esta relaci\ón se hace evidente cuando intentamos resolver, desde una perspectiva borrosa, el problema de la adquisici\ón autom\ática del conocimiento en sistemas expertos. El algoritmo ID3, el m\ás relevante de los utilizados para la inducci\ón de \árboles de decisi\ón, no es utilizable tal cual con un concepto borroso del concepto de pertenencia. Adem\ás se muestra ineficiente cuando no existe un experto humano que defina correctamente los subrangos de actuaci\ón para los atributos que junto a las clases expresan las relaciones entre situaciones que este algoritmo de aprendizaje intenta descubrir. Proponemos como soluci\ón un nuevo algoritmo, el ID3f+A, que posee la capacidad de tratamiento borroso del concepto de pertenencia, gracias a una modificaci\ón del concepto de entrop\ía, y adem\ás realiza la divisi\ón intervalar autom\ática de los atributos, merced al control del proceso inductivo por medio de la utilizaci\ón de experiencias de control.

}, author = {Gonzalo Ramos and Javier Lopez} }