@inproceedings {rios2018mob, title = {Location Proximity Attacks against Mobile Targets: Analytical Bounds and Attacker Strategies}, booktitle = {23rd European Symposium on Research in Computer Security (ESORICS 2018)}, series = {LNCS}, volume = {11099}, year = {2018}, pages = {373-392}, publisher = {Springer}, organization = {Springer}, address = {Barcelona}, abstract = {

Location privacy has mostly focused on scenarios where users remain static. However, investigating scenarios where the victims present a particular mobility pattern is more realistic. In this paper, we consider abstract attacks on services that provide location information on other users in the proximity. In that setting, we quantify the required effort of the attacker to localize a particular mobile victim. We prove upper and lower bounds for the effort of an optimal attacker. We experimentally show that a Linear Jump Strategy\ (LJS) practically achieves the upper bounds for almost uniform initial distributions of victims. To improve performance for less uniform distributions known to the attacker, we propose a Greedy Updating Attack Strategy\ (GUAS). Finally, we derive a realistic mobility model from a real-world dataset and discuss the performance of our strategies in that setting.

}, isbn = {978-3-319-98988-4}, doi = {10.1007/978-3-319-98989-1}, author = {Xueou Wang and Xiaolu Hou and Ruben Rios and Per Hallgren and Nils Ole Tippenhauer and Martin Ochoa} } @inproceedings {1516, title = {Tools for Cloud Accountability: A4Cloud Tutorial}, booktitle = {9th IFIP Summer School on Privacy and Identity Management for the Future Internet in the Age of Globalisation}, volume = {457}, year = {2015}, pages = {219-236}, publisher = {Springer IFIP AICT}, organization = {Springer IFIP AICT}, address = {Patras (Greece)}, abstract = {

Cloud computing is becoming a key IT infrastructure technology being adopted progressively by companies and users. Still, there are issues and uncertainties surrounding its adoption, such as security and how users data is dealt with that require attention from developers, researchers, providers and users. The A4Cloud project tries to help solving the problem of accountability in the cloud by providing tools that support the process of achieving accountability. This paper presents the contents of the first A4Cloud tutorial. These contents include basic concepts and tools developed within the project. In particular, we will review how metrics can aid the accountability process and some of the tools that the A4Cloud project will produce such as the Data Track Tool (DTT) and the Cloud Offering Advisory Tool (COAT).

}, isbn = {978-3-319-18620-7}, issn = {978-3-319-18621-4}, doi = {10.1007/978-3-319-18621-4_15}, author = {Carmen Fernandez-Gago and Vasilis Tountopoulos and Simone Fischer-H{\"u}bner and Rehab Alnemr and David Nu{\~n}ez and Julio Angulo and Tobias Pulls and Theo Koulouris} } @inproceedings {1637, title = {An Intelligent and Adaptive Live Simulator: A new Concept for Cybersecurity Training}, booktitle = {9th Future Security Conference}, year = {2014}, address = {Berlin}, abstract = {

The rapid rate of change in technology and the increasing sophistication of cyber attacks require any organization to have a continuous preparation. However, the resource and time intensive nature of cybersecurity education and training renders traditional approaches highly inefficient. Simulators have attracted the attention in the last years as a potential solution for cybersecurity training. However, in spite of the advances achieved, there is still an urgent need to address some open challenges. In this paper we present a novel simulator that solves some these challenges. First, we analyse the main properties that any cybersecurity training solution should comprise, and evaluate to what extent training simulators can meet them. Next, we introduce the functional architecture and innovative features of the simulator, of which a functional prototype has already been released. Finally, we demonstrate how these capabilities are put into practice in training courses already available in the simulator.

}, keywords = {Cyberdefence, Cybersecurity, Education, Simulation, Training}, author = {Jorge L. Hern{\'a}ndez-Ardieta and David Santos and Pascual Parra and Juan E. Tapiador and Pedro Peris-L{\'o}pez and Javier Lopez and Gerardo Fernandez} } @inproceedings {Rios2012, title = {HIDE_DHCP: Covert Communications Through Network Configuration Messages}, booktitle = {Proceedings of the 27th IFIP TC 11 International Information Security and Privacy Conference (SEC 2012)}, series = {IFIP AICT}, volume = {376}, year = {2012}, month = {June 2012}, pages = {162-173}, publisher = {Springer Boston}, organization = {Springer Boston}, address = {Heraklion, Crete, Greece}, abstract = {

Covert channels are a form of hidden communication that may violate the integrity of systems. Since their birth in multilevel security systems in the early 70{\textquoteright}s they have evolved considerably, such that new solutions have appeared for computer networks mainly due to vague protocols specifications. We analyze a protocol extensively used today, the Dynamic Host Configuration Protocol (DHCP), in search of new forms of covert communication. From this analysis we observe several features that can be effectively exploited for subliminal data transmission. This results in the implementation of HIDE_DHCP, which integrates three covert channels that accommodate to different stealthiness and bandwidth requirements

}, keywords = {Covert channels, Network Security, System Information Security}, isbn = {978-3-642-30435-4}, issn = {1868-4238}, doi = {http://dx.doi.org/10.1007/978-3-642-30436-1_14}, author = {Ruben Rios and Jose A. Onieva and Javier Lopez}, editor = {Dimitris Gritzalis and Steve Furnell and Marianthi Theoharidou} } @inproceedings {6059235, title = {OSAMI Commons: An open dynamic services platform for ambient intelligence}, booktitle = {IEEE 16th Conference on Emerging Technologies Factory Automation (ETFA 2011)}, year = {2011}, month = {Sep 2011}, pages = {1-10}, publisher = {IEEE}, organization = {IEEE}, address = {Toulouse, France}, abstract = {

Today we live in an environment surrounded with networked converging devices. Human computer interactions are becoming personalized and a new concept of a global and cross-domain platform is emerging to exploit the full potential of the network in all business areas. In this convergence process, the software platform should be able to personalize itself dynamically in devices according to the context. OSAmI-Commons, an ITEA2 project for developing an open-source common approach to such a dynamic service-based platform, allows any type of device to connect and exchange information and services. OSAMI consortium is contributing to defining the foundations of a cross-platform open-services ecosystem. The sustainability of this platform is an objective beyond the project duration.

}, isbn = {978-1-4577-0016-3}, issn = {1946-0740}, doi = {10.1109/ETFA.2011.6059235}, author = {Naci Dai and Jesus Bermejo and Felix Cuadrado Latasa and Alejandra Ruiz L{\'o}pez and Isaac Agudo and Elmar Zeeb and Jan Krueger and Oliver Dohndorf and Wolfgang Thronicke and Christoph Fiehe and Anna Litvina} } @inproceedings {VicenteBenjumea2004, title = {A First Approach to Provide Anonymity in Attribute Certificates}, booktitle = {2004 International Workshop on Practice and Theory in Public Key Cryptography (PKC{\textquoteright}04)}, series = {LNCS}, volume = {2947}, year = {2004}, month = {March}, pages = {402-415}, publisher = {Springer}, organization = {Springer}, abstract = {

This paper focus on two security services for internet applications:authorization and anonymity. Traditional authorization solutionsare not very helpful for many of the Internet applications; however,attribute certificates proposed by ITU-T seems to be well suited andprovide adequate solution. On the other hand, special attention is paidto the fact that many of the operations and transactions that are part ofInternet applications can be easily recorded and collected. Consequently,anonymity has become a desirable feature to be added in many cases. Inthis work we propose a solution to enhance the X.509 attribute certificatein such a way that it becomes a conditionally anonymous attributecertificate. Moreover, we present a protocol to obtain such certificatesin a way that respects users\’ anonymity by using a fair blind signaturescheme. We also show how to use such certificates and describe a fewcases where problems could arise, identifying some open problems.

}, author = {Vicente Benjumea and Javier Lopez and Jose A. Montenegro and Jose M. Troya} } @inproceedings {JavierLopez2003b, title = {Applying SDL to Formal Analysis of Security Systems}, booktitle = {11th International SDL Forum (SDL{\textquoteright}03)}, series = {LNCS}, volume = {2708}, year = {2003}, month = {July}, pages = {300-317}, publisher = {Springer-Verlag}, organization = {Springer-Verlag}, address = {Stuttgart, Germany}, abstract = {

Nowadays, it is widely accepted that critical systems have to be formally analysed in order to achieve well-known formal method benefits. In order to study the security of communication systems, we have developed a methodology for the application of the formal analysis techniques commonly used in communication protocols to the analysis of cryptographic ones. In particular, we have extended the design and analysis phases with security properties. Our proposal uses a specification notation based on MSC, which can be automatically translated into a generic SDL specification. This SDL system can then be used for the analysis of the desired security properties, by using an observer process schema. Apart from our main goal of providing a notation for describing the formal specification of security systems, our proposal also brings additional benefits, such as the study of the possible attacks to the system, and the possibility of re-using the specifications produced to describe and analyse more complex systems.

}, author = {Javier Lopez and Juan J. Ortega and Jose M. Troya} } @inproceedings {1719, title = {Applying the Semantic Web Layers to Access Control}, booktitle = {IEEE International Workshop on Web Semantics (WebS{\textquoteright}03)}, year = {2003}, pages = {622-626}, publisher = {IEEE Press}, organization = {IEEE Press}, isbn = {0-7695-1993-8}, author = {Javier Lopez and Antonio Mana and Jose maria troya and Marienma Yague} } @inproceedings {javierlopez2003, title = {High-level Specification of Security Systems}, booktitle = {IEEE Globecom 2003 - Communications Security Track}, year = {2003}, month = {December}, pages = {1506-1510}, publisher = {IEEE Press}, organization = {IEEE Press}, address = {San Francisco}, abstract = {

In order to study the security systems, we have developed a methodology for the application to the analysis of cryptographic protocols of the formal analysis techniques commonly used in communication protocols. In particular, we have extended the design and analysis phases with security properties. Our proposal uses a specification notation based on HMSC/MSC, which can be automatically translated into a generic SDL specification.

}, isbn = {0-7803-7974-8}, author = {Javier Lopez and Juan J. Ortega and Jose M. Troya and Jose L. Vivas} } @inproceedings {javierlopez2003a, title = {How to Specify Security Services: A Practical Approach}, booktitle = {7th IFIP Conference on Multimedia and Communications Security (CMS{\textquoteright}03)}, series = {LNCS}, volume = {2828}, year = {2003}, month = {October}, pages = {158-171}, publisher = {Springer-Verlag}, organization = {Springer-Verlag}, address = {Torino, Italy}, abstract = {

Security services are essential for ensuring secure communications. Typically no consideration is given to security requirements during the initial stages of system development. Security is only added latter as an afterthought in function of other factors such as the environment into which the system is to be inserted, legal requirements, and other kinds of constraints. In this work we introduce a methodology for the specification of security requirements intended to assist developers in the design, analysis, and implementation phases of protocol development. The methodology consists of an extension of the ITU-T standard requirements language MSC and HMSC, called SRSL, defined as a high level language for the specification of security protocols. In order to illustrate it and evaluate its power, we apply the new methodology to a real world example, the integration of an electronic notary system into a web-based multi-users service platform.

}, isbn = {3-540-20185-8}, author = {Javier Lopez and Juan J. Ortega and Jose M. Troya and Jose L. Vivas} } @inproceedings {JavierLopez2002j, title = {Access Control Infrastructure for Digital Objects}, booktitle = {International Conference on Information and Communications Security (ICICS{\textquoteright}02)}, series = {LNCS}, volume = {2513}, year = {2002}, month = {December}, pages = {399-410}, publisher = {Springer-Verlag}, organization = {Springer-Verlag}, address = {Singapore}, abstract = {

Distributed systems usually contain objects with heterogeneous security requirements that pose important challenges on the underlying security mechanisms and especially in access control systems. Access control in distributed systems often relies on centralized security administration. Existing solutions for distributed access control do not provide the flexibility and manageability required. This paper presents the XML-based Secure Content Distribution (XSCD) infrastructure is based on the production of self-protected software objects that convey contents (software or data) and can be distributed without further security measures because they embed the access control enforcement mechanism. It also provides means for integrating Privilege Management Infrastructures (PMIs). Semantic information is used in the dynamic instantiation and semantic validation of policies. XSCD is scalable, facilitates the administration of the access control system, guarantees the secure distribution of the contents, enables semantic integration and interoperability of heterogeneous sources, solves the \“originator retained control\” issue and allows activities (such as payment) to be bound to the access to objects.

}, author = {Javier Lopez and Antonio Mana and Ernesto Pimentel and Jose M. Troya and Mariemma I. Yague} } @inproceedings {JavierLopez2002f, title = {Designing Software Tools for the Use of Secure Electronic Forms}, booktitle = {3rd ACIS Int. Conf. on Software Engineering, Artificial Intelligence Networking and Parallel/Distributed Computing (SNPD{\textquoteright}02)}, year = {2002}, month = {Junio}, pages = {157-163}, address = {Madrid, Spain)}, abstract = {

Interaction of organizations and their clients by using the Internet can produce meaningful benefits in the accessibility, efficiency and availability of documents, regardless of time and location. However, some types of problems hinder a higher degree of communication. This paper presents some of the results of a Research Project that focuses on the influence of typical open networks risks in electronic interactions and on the need of creating software tools to manage electronic versions of the paper-based forms, as this is the traditional way of interaction through the Web.

}, author = {Javier Lopez and Antonio Mana and Jose A. Montenegro and Juan J. Ortega and Jose M. Troya} } @inproceedings {JavierLopez2002h, title = {Observaciones sobre las t{\'e}cnicas de an{\'a}lisis formal de protocolos de seguridad}, booktitle = {VII Reuni{\'o}n Espa{\~n}ola sobre Criptolog{\'\i}a y Seguridad de la Informaci{\'o}n (VII RECSI)}, year = {2002}, month = {Septiembre}, pages = {471-483}, address = {Oviedo, Espa}, abstract = {

La aplicaci\ón de los m\étodos formales para el dise\ño y an\álisis de sistemas cr\íticos est\á ampliamente aceptada en el desarrollo de estos sistemas. Los protocolos de seguridad abordan el objetivo de garantizar servicios y derechos como el de la confidencialidad de los datos personales o el de garantizar la identidad de acceso a un sistema. Por lo tanto, ya que un protocolo de seguridad es un sistema cr\ítico, es necesario utilizar m\étodosformales para su dise\ño y an\álisis. Debido a las caracter\ísticas especiales que presentan este tipo de protocolos, se deben utilizar m\étodos que no son los tradicionales utilizados para los protocolos de comunicaciones, sino que deben utilizarse otros espec\íficos. En este art\ículo vamos a hacer un estudio de las principales propiedades de seguridad que poseen los protocolos criptogr\áficos y de la manera de aplicar los m\étodos formales en su dise\ño y an\álisis.

}, author = {Javier Lopez and Sonia Matamoros and Juan J. Ortega and Jose M. Troya} } @inproceedings {JavierLopez2002i, title = {Perspectiva Composicional para el Dise{\~n}o y la Implementaci{\'o}n de una PKI}, booktitle = {I Congreso Internacional Sociedad de la Informaci{\'o}n}, year = {2002}, pages = {423-428}, address = {Las Palmas, Espa}, abstract = {
The important role of Public Key Infrastructures (PKIs) inside the general scope of Internet communication, and more precisely, inside electronic commerce, has driven us to the revision of actual procedures followed in the development of software of these elements that provide security and trust to the digital certification environment. In this work we introduce the actual results of a joint research project of the Security Group of the University of Malaga and the Department of Technology Innovation of Banesto regarding a PKI implementation. The originality of this work is that we have paid attention not only to functional aspects of the infrastructure, but also to the programming techniques used. Basically, we have developed a solution in which implementation has been guided by the increase in the study of software architectures and those paradigms that have emerged in parallel, as component orientation, software frameworks, and design patterns. The correct use of these techniques provide a different point of view that allows the development of every PKI building block in a modular and independent way.
}, author = {Javier Lopez and Jose A. Montenegro and Jose M. Troya} } @inproceedings {JavierLopez2002b, title = {Protocol Engineering Applied to Formal Analysis of Security Systems}, booktitle = {International Conference on Infrastructure Security (InfraSec{\textquoteright}02)}, series = {LNCS}, volume = {2437}, year = {2002}, month = {October}, pages = {246-259}, publisher = {Springer-Verlag}, organization = {Springer-Verlag}, address = {Bristol, U.K.}, abstract = {

Every communication system requiring security properties is certainly critical. In order to study the security of communication systems, we have developed a methodology for the application of the formal analysis techniques of communication protocols to the analysis of cryptographic ones. We have extended the design and analysis phases with security properties. Our methodology uses a specification technique based on the HMSC/MSC requirement languages, and translates it into a generic schema for the SDL specification language, which is used for the analysis. Thus, the technique allows the specification of security protocols using a standard formal language and uses Object-Orientation for reusability purposes. The final goal is not only the formal specification of a security system, but to examine the possible attacks, and later use the specification in more complex systems.

}, author = {Javier Lopez and Juan J. Ortega and Jose M. Troya} } @inproceedings {JavierLopez2002g, title = {Towards a Trustful and Flexible Environment for Secure Communications with Public Administrations}, booktitle = {First International Conference on Electronic Government (EGOV{\textquoteright}02)}, series = {LNCS}, volume = {2456}, year = {2002}, month = {September}, pages = {211-214}, publisher = {Springer}, organization = {Springer}, address = {Aix-en-Provence, France)}, abstract = {

Interaction of citizens and private organizations with Public Administrations can produce meaningful benefits in the accessibility, efficiency and availability of documents, regardless of time, location and quantity. Although there are some experiences in the field of e-government there are still some technological and legal difficulties that avoid a higher rate of communications with Public Administrations through Internet, not only from citizens, but also from private companies. We have studied two of the technological problems, the need to work in a trustful environment and the creation of tools to manage electronic versions of the paper-based forms.

}, author = {Javier Lopez and Antonio Mana and Jose A. Montenegro and Juan J. Ortega and Jose M. Troya} } @inproceedings {JavierLopez2002a, title = {Verification of Authentication Protocols using SDL-method}, booktitle = {First International Workshop on Security in Information Systems (SIS{\textquoteright}02)}, year = {2002}, month = {April}, pages = {61-71}, address = {Ciudad Real, Spain}, abstract = {

Authentication between protocol agents is widely studied in the cryptographic protocol analysis area. It is essential in a virtual environment to rely on protocol parties{\textquoteright} identity. In the academic literature there are many protocols that provide the authentication property. We present in this paper a new mechanism to verify authentication using SDL, general purpose specification language. We have defined a generic schema in SDL that allow us to specify a security system and check system behavior when a malicious agent ( the intruder ) is present. We have used the EKE authentication protocol to illustrate how the mechanism works.

}, author = {Javier Lopez and Juan J. Ortega and Jose M. Troya} } @inproceedings {1720, title = {A First Approach to Latin Electronic Notary Public Services}, booktitle = {IFIP Conference on Security \& Control of IT in Security}, year = {2001}, pages = {49-60}, author = {Jorge Davila and Javier Lopez and Rene Peralta and Jose maria troya} } @inproceedings {JavierLopez2000, title = {Aspectos de Implementaci{\'o}n de una Infraestructura de Clave P{\'u}blica Distribuida}, booktitle = {Simposio Espa{\~n}ol de Inform{\'a}tica Distribuida (SEID{\textquoteright}00)}, year = {2000}, month = {Septiembre}, pages = {313-320}, address = {Orense, Espa}, abstract = {

La seguridad es uno de los aspectos m\ás conflictivos del uso de Internet. La falta de una pol\ítica de seguridad global est\á frenando el desarrollo de Internet en \áreas tan interesantes y prometedoras como el comercio electr\ónico o la interacci\ón con las administraciones p\úblicas. Las t\écnicas criptogr\áficas actuales proporcionan un alto grado de confidencialidad; no obstante, es dif\ícil garantizar la identificaci\ón segura de los usuarios y, adem\ás, la gesti\ón de las claves de los mismos es poco eficiente y presenta graves problemas de escalabilidad. Este trabajo describe las caracter\ísticas de implementaci\ón de una soluci\ón a ambos problemas basada en una Infraestructura de Clave P\ública (PKI) que proporciona una administraci\ón simple y eficiente de las claves de los usuarios y posibilita la autenticaci\ón segura de los mismos.

}, author = {Javier Lopez and Antonio Mana and Jose A. Montenegro and Juan J. Ortega and Jose M. Troya} } @inproceedings {1721, title = {Development of Secure Internet Applications for Governmental Environments}, booktitle = {IEEE International Workshop on Electronic Government (in DEXA{\textquoteright}00)}, year = {2000}, pages = {362-365}, publisher = {IEEE Press}, organization = {IEEE Press}, isbn = {0-7695-0680-1}, author = {Jorge Davila and Javier Lopez and Antonio Mana and Juan J. Ortega and Jose maria troya} } @inproceedings {JavierLopez2000a, title = {Distributed Storage and Revocation in Digital Certificate Databases}, booktitle = {11th International Conference on Database and Expert Systems Applications (DEXA{\textquoteright}00)}, series = {LNCS}, volume = {1873}, year = {2000}, month = {September}, pages = {929-938}, publisher = {Springer}, organization = {Springer}, address = {London, U.K.}, abstract = {

Public-key cryptography is fast becoming the foundation for those applications that require security and authentication in open networks. But the widespread use of a global public-key cryptosystem requires that public-key certificates are always available and up-to-date. Problems associated to digital certificates management, like storage, retrieval, maintenance, and, specially, revocation, require special procedures that ensure reliable features because of the critical significance of inaccuracies. Most of the existing systems use a Certificate Revocation List, a repository of certificates that have been revoked before their expiration date. The need to access CRLs in order to check certificate revocations becomes a performance handicap. Furthermore, they introduce a source of vulnerability in the whole security infrastructure, as it is impossible to produce a new CRL each time a revocation takes place. This paper introduces an alternative for the storage of digital certificates that avoids the use of CRLs. The system is designed to provide a distributed management of digital certificates by using Certification Authorities that, while being part of a whole Public-Key Infrastructure, operate over local certificates databases. Communication protocols between local databases have been designed to minimize network traffic without a lack of security and efficiency.

}, author = {Javier Lopez and Antonio Mana and Juan J. Ortega and Jose M. Troya} } @inproceedings {1722, title = {Internet Secure Communications Between Citizens and Public Administrations}, booktitle = {IFIP Conference on Advances in Electronic Government}, year = {2000}, pages = {109-120}, author = {Jorge Davila and Lidia Fuentes and Javier Lopez and Jose maria troya and Antonio Vallecillo} }