@inproceedings {nunez2017fallout, title = {The fallout of key compromise in a proxy-mediated key agreement protocol}, booktitle = {31st Annual IFIP WG 11.3 Conference on Data and Applications Security and Privacy (DBSec{\textquoteright}17)}, volume = {LNCS 10359}, year = {2017}, month = {07/2017}, pages = {453-472}, publisher = {Springer}, organization = {Springer}, address = {Philadelphia, USA}, abstract = {

In this paper, we analyze how key compromise affects the protocol by Nguyen et al. presented at ESORICS 2016, an authenticated key agreement protocol mediated by a proxy entity, restricted to only symmetric encryption primitives and intended for IoT environments. This protocol uses long-term encryption tokens as intermediate values during encryption and decryption procedures, which implies that these can be used to encrypt and decrypt messages without knowing the cor- responding secret keys. In our work, we show how key compromise (or even compromise of encryption tokens) allows to break forward secu- rity and leads to key compromise impersonation attacks. Moreover, we demonstrate that these problems cannot be solved even if the affected user revokes his compromised secret key and updates it to a new one. The conclusion is that this protocol cannot be used in IoT environments, where key compromise is a realistic risk.\ 

}, isbn = {978-3-319-61176-1}, doi = {10.1007/978-3-319-61176-1_25}, author = {David Nu{\~n}ez and Isaac Agudo and Javier Lopez} } @inproceedings {Ruben2017smog, title = {From Smog to Fog: A Security Perspective}, booktitle = {2nd IEEE International Conference on Fog and Edge Mobile Computing (FMEC 2017)}, year = {2017}, month = {06/2017}, pages = {56-61}, publisher = {IEEE Computer Society}, organization = {IEEE Computer Society}, address = {Valencia, Spain. 8-11 May 2017}, abstract = {

Cloud computing has some major limitations that hinder its application to some specific scenarios (e.g., Industrial IoT, and remote surgery) where there are particularly stringent requirements, such as extremely low latency. Fog computing is a specialization of the Cloud that promises to overcome the aforementioned limitations by bringing the Cloud closer to end-users. Despite its potential benefits, Fog Computing is still a developing paradigm which demands further research, especially on security and privacy aspects. This is precisely the focus of this paper: to make evident the urgent need for security mechanisms in Fog computing, as well as to present a research strategy with the necessary steps and processes that are being undertaken within the scope of the SMOG project, in order to enable a trustworthy and resilient Fog ecosystem.

}, isbn = {978-1-5386-2859-1}, doi = {10.1109/FMEC.2017.7946408}, author = {Ruben Rios and Rodrigo Roman and Jose A. Onieva and Javier Lopez} } @inproceedings {VicenteBenjumea2008ab, title = {Fair Traceable Multi-Group Signatures}, booktitle = {Financial Cryptography and Data Security (FC{\textquoteright}08)}, series = {LNCS}, volume = {5143}, year = {2008}, month = {January}, pages = {265-281}, publisher = {Springer}, organization = {Springer}, address = {Cozumel, Mexico}, abstract = {

This paper presents fair traceable multi-group signatures (FTMGS) which have enhanced capabilities compared to group and traceable signatures that are important in real world scenarios combining accountability and anonymity. The main goal of the primitive is to allow multi groups that are managed separately (managers are not even aware of the other ones), yet allowing users (in the spirit of the Identity 2.0 initiative) to manage what they reveal about their identity with respect to these groups by themselves. This new primitive incorporates the following additional features: (a) While considering multiple groups it discourages users from sharing their private membership keys through two orthogonal and complementary approaches. In fact, it merges functionality similar to credential systems with anonymous type of signing with revocation. (b) The group manager now mainly manages joining procedures, and new entities (called fairness authorities and consisting of various representatives, possibly) are involved in opening and revealing procedures. In many systems scenario assuring fairness in anonymity revocation is required.We specify the notion and implement it with a security proof of its properties (in the ROM).

}, author = {Vicente Benjumea and Seung G. Choi and Javier Lopez and Moti Yung} } @inproceedings {Roman2007c, title = {Featuring Trust and Reputation Management Systems for Constrained Hardware Devices}, booktitle = {1st International Conference on Autonomic Computing and Communication Systems (Autonomics{\textquoteright}07)}, year = {2007}, month = {October}, publisher = {ICST}, organization = {ICST}, address = {Rome (Italy)}, abstract = {

Research on trust management systems for wireless sensor networks is still at a very early stage and few works have done so far. It seems that for those works which deal with the topic general features of how these systems should be are not clearly identified. In this paper we try to identify the main features that a trust management system should have and justify their importance for future developments.

}, keywords = {Sensor Networks, Trust Management}, isbn = {978-963-9799-09-7}, author = {Rodrigo Roman and Carmen Fernandez-Gago and Javier Lopez} } @inproceedings {VicenteBenjumea2004, title = {A First Approach to Provide Anonymity in Attribute Certificates}, booktitle = {2004 International Workshop on Practice and Theory in Public Key Cryptography (PKC{\textquoteright}04)}, series = {LNCS}, volume = {2947}, year = {2004}, month = {March}, pages = {402-415}, publisher = {Springer}, organization = {Springer}, abstract = {

This paper focus on two security services for internet applications:authorization and anonymity. Traditional authorization solutionsare not very helpful for many of the Internet applications; however,attribute certificates proposed by ITU-T seems to be well suited andprovide adequate solution. On the other hand, special attention is paidto the fact that many of the operations and transactions that are part ofInternet applications can be easily recorded and collected. Consequently,anonymity has become a desirable feature to be added in many cases. Inthis work we propose a solution to enhance the X.509 attribute certificatein such a way that it becomes a conditionally anonymous attributecertificate. Moreover, we present a protocol to obtain such certificatesin a way that respects users\’ anonymity by using a fair blind signaturescheme. We also show how to use such certificates and describe a fewcases where problems could arise, identifying some open problems.

}, author = {Vicente Benjumea and Javier Lopez and Jose A. Montenegro and Jose M. Troya} } @inproceedings {1720, title = {A First Approach to Latin Electronic Notary Public Services}, booktitle = {IFIP Conference on Security \& Control of IT in Security}, year = {2001}, pages = {49-60}, author = {Jorge Davila and Javier Lopez and Rene Peralta and Jose maria troya} }