Biblio

Export results:
Author Title [ Type(Desc)] Year
Filters: First Letter Of Last Name is B  [Clear All Filters]
Book Chapter
R. Bars, J. Gomez, M. Mahdi, C. Alcaraz, and R. Roman, "Digital Home Networking: Standards",
Digital Home Networking, R. Carbou, E. Exposito, R. Roman, and M. Diaz Eds., no. 7130, John Wiley & Sons Inc., pp. 60-96, 2011.
F. Moyano, C. Fernandez-Gago, B. Baudry, and J. Lopez, "Engineering Trust-Awareness and Self-adaptability in Services and Systems",
Engineering Secure Future Internet Services and Systems, vol. LNCS 8431, no. 8431, Springer, pp. 180-209, 03/2014. DOI More..

Abstract

The Future Internet (FI) comprises scenarios where many heterogeneous and dynamic entities must interact to provide services (e.g., sensors, mobile devices and information systems in smart city scenarios). The dynamic conditions under which FI applications must execute call for self-adaptive software to cope with unforeseeable changes in the application environment. Models@run.time is a promising model-driven approach that supports the runtime adaptation of distributed, heterogeneous systems. Yet frameworks that accommodate this paradigm have limited support to address security concerns, hindering their usage in real scenarios. We address this challenge by enhancing models@run.time with the concepts of trust and reputation. Trust improves decision-making processes under risk and uncertainty and constitutes a distributed and flexible mechanism that does not entail heavyweight administration. This chapter introduces a trust and reputation framework that is integrated into a distributed component model that implements the models@run.time paradigm, thus allowing software components to include trust in their reasoning process. The framework is illustrated in a smart grid scenario.

PDF icon moyano14esfi.pdf (3.2 MB)
Conference Paper
D. Ferraris, D. Bastos, C. Fernandez-Gago, F. El-Moussa, and J. Lopez, "An Analysis of Trust in Smart Home Devices",
The 20th World Conference on Information Security Applications: WISA-Workshop 2019, Springer, 2019. More..

Abstract

In recent times, smart home devices like Amazon Echo and Google Home have reached mainstream popularity. These devices are intrinsically intrusive, being able to access user’s personal information. There are growing concerns about indiscriminate data collection and invasion of user privacy in smart home devices. Improper trust assumptions and security controls can lead to unauthorized access of the devices, which can have severe consequences (i.e. safety risks). In this paper, we analysed the behaviour of smart home devices with respect to trust relationships. We set up a smart home environment to evaluate how trust is built and managed. Then, we performed a number of interaction tests with different types of users (i.e. owner, guests). As a result, we were able to assess the effectiveness of the provided security controls and identify some relevant security issues. To address them, we defined a trust model and proposed a solution based on it for securing smart home devices.

PDF icon 1814.pdf (247.14 KB)
V. Benjumea, S. G. Choi, J. Lopez, and M. Yung, "Anonymity 2.0: X.509 Extensions Supporting Privacy-friendly Authentication",
Sixth International Workshop on Cryptology and Network Security (CANS’07), LNCS 4856, Springer, pp. 265-281, December, 2007. More..

Abstract

We present a semantic extension to X.509 certificates that allows incorporating new anonymity signature schemes into the X.509 framework. This fact entails advantages to both components. On the one hand, anonymous signature schemes benefit from all the protocols and infrastructure that the X.509 framework provides. On the other hand, the X.509 framework incorporates anonymity as a very interesting new feature. This semantic extension is part of a system that provides user’s controlled anonymous authorization under the X.509 framework. Additionally, the proposal directly fits themuch active Identity 2.0 effort,where anonymity is a major supplementary feature that increases the self-control of one’s identity and privacy which is at the center of the activity.

PDF icon VicenteBenjumea2007ba.pdf (363.03 KB)
C. Alcaraz, A. Balastegui, and J. Lopez, "Early Warning System for Cascading Effect Control in Energy Control Systems",
5th International conference on Critical Information Infrastructures Security (CRITIS’10), LNCS 6712, Springer, pp. 55-67, September, 2010. More..

Abstract

A way of controlling a cascading effect caused by a failure or a threat in a critical system is using intelligent mechanisms capable of predicting anomalous behaviours and also capable of reacting against them in advance. These mechanisms are known as Early Warning Systems (EWS) and this will be precisely the main topic of this paper. Specially, we present an EWS design based on a Wireless Sensor Network (using the ISA100.11a standard) that constantly supervise the application context. This EWS is also based on forensic techniques to provide dynamic learning capacities. As a result, this new approach will aid to provide a reliable control of incidences by offering a dynamic alarm management, identification of the most suitable field operator to attend an alarm, reporting of causes and responsible operators, and learning from new anomalous situations.

PDF icon Alcaraz2010b.pdf (5.6 MB)
F. Moyano, C. Fernandez-Gago, K. Beckers, and M. Heisel, "Engineering Trust- and Reputation-based Security Controls for Future Internet Systems",
The 30th ACM/SIGAPP Symposium On Applied Computing (SAC 2015), pp. 1344-1349, 08/2015. DOI More..
PDF icon moyano15SAC.pdf (284.13 KB)
F. Moyano, C. Fernandez-Gago, K. Beckers, and M. Heisel, "Enhancing Problem Frames with Trust and Reputation for Analyzing Smart Grid Security Requirements",
Smart Grid Security - Second International Workshop, J. Cuellar Eds., LNCS 8448, Springer, pp. 166-180, Aug, 2014. DOI More..
PDF icon moyano14smartgridsec.pdf (404.33 KB)
V. Benjumea, S. G. Choi, J. Lopez, and M. Yung, "Fair Traceable Multi-Group Signatures",
Financial Cryptography and Data Security (FC’08), LNCS 5143, Springer, pp. 265-281, January, 2008. More..

Abstract

This paper presents fair traceable multi-group signatures (FTMGS) which have enhanced capabilities compared to group and traceable signatures that are important in real world scenarios combining accountability and anonymity. The main goal of the primitive is to allow multi groups that are managed separately (managers are not even aware of the other ones), yet allowing users (in the spirit of the Identity 2.0 initiative) to manage what they reveal about their identity with respect to these groups by themselves. This new primitive incorporates the following additional features: (a) While considering multiple groups it discourages users from sharing their private membership keys through two orthogonal and complementary approaches. In fact, it merges functionality similar to credential systems with anonymous type of signing with revocation. (b) The group manager now mainly manages joining procedures, and new entities (called fairness authorities and consisting of various representatives, possibly) are involved in opening and revealing procedures. In many systems scenario assuring fairness in anonymity revocation is required.We specify the notion and implement it with a security proof of its properties (in the ROM).

PDF icon VicenteBenjumea2008ab.pdf (532.38 KB)
V. Benjumea, J. Lopez, J. A. Montenegro, and J. M. Troya, "A First Approach to Provide Anonymity in Attribute Certificates",
2004 International Workshop on Practice and Theory in Public Key Cryptography (PKC’04), LNCS 2947, Springer, pp. 402-415, March, 2004. More..

Abstract

This paper focus on two security services for internet applications:authorization and anonymity. Traditional authorization solutionsare not very helpful for many of the Internet applications; however,attribute certificates proposed by ITU-T seems to be well suited andprovide adequate solution. On the other hand, special attention is paidto the fact that many of the operations and transactions that are part ofInternet applications can be easily recorded and collected. Consequently,anonymity has become a desirable feature to be added in many cases. Inthis work we propose a solution to enhance the X.509 attribute certificatein such a way that it becomes a conditionally anonymous attributecertificate. Moreover, we present a protocol to obtain such certificatesin a way that respects users’ anonymity by using a fair blind signaturescheme. We also show how to use such certificates and describe a fewcases where problems could arise, identifying some open problems.

PDF icon VicenteBenjumea2004.pdf (183.42 KB)
N. Dai, et al., "OSAMI Commons: An open dynamic services platform for ambient intelligence",
IEEE 16th Conference on Emerging Technologies Factory Automation (ETFA 2011), IEEE, pp. 1-10, Sep 2011. DOI More..

Abstract

Today we live in an environment surrounded with networked converging devices. Human computer interactions are becoming personalized and a new concept of a global and cross-domain platform is emerging to exploit the full potential of the network in all business areas. In this convergence process, the software platform should be able to personalize itself dynamically in devices according to the context. OSAmI-Commons, an ITEA2 project for developing an open-source common approach to such a dynamic service-based platform, allows any type of device to connect and exchange information and services. OSAMI consortium is contributing to defining the foundations of a cross-platform open-services ecosystem. The sustainability of this platform is an objective beyond the project duration.

R. Rios, and J. Lopez, "Source Location Privacy Considerations in Wireless Sensor Networks",
4th International Symposium of Ubiquitous Computing and Ambient Intelligence (UCAmI’10), L. Fuentes, N. Gámez, and J. Bravo Eds., IBERGARCETA PUBLICACIONES, S.L., pp. 29 - 38, Sept., 2010. More..

Abstract

Wireless Sensor Networks are considered to be one of the cornerstones of Ambient Intelligence since they can be used in countless applications, where sensors are unobtrusively embedded into the environment to perform operations like monitoring, tracking and reporting. In such scenarios, privacy issues must be carefully considered since the mere observation of the network operation might reveal great amounts of private information to unauthorised parties. One of the problems that is gaining more attention in the realm of privacy, is the location privacy problem, which aims to prevent an attacker from obtaining the location of specific nodes of interest to him. In this paper we provide a general overview of the proposed solutions to counter this threat. Finally, we will also discuss some open challenges and future directions of research for a convenient management of privacy issues in smart environments.

PDF icon Rios2010.pdf (352.58 KB)
N. Libor, et al., "Strong Authentication of Humans and Machines in Policy Controlled Cloud Computing Environment Using Automatic Cyber Identity",
Information Security Solutions Europe 2012, N. Pohlmann, H. Reimer, and W. Schneider Eds., Springer Vieweg, pp. 195-206, 2012. DOI More..

Abstract

The paper describes the experience with integration of automatic cyber identity technology with policy controlled virtualisation environment. One identity technology has been used to enable strong authentication of users (human beings) as well as machines (host systems) to the virtualization management system. The real experimental evaluation has been done in PASSIVE project (Policy-Assessed system-level Security of Sensitive Information processing in Virtualised Environments - SEVENTH FRAMEWORK PROGRAMME THEME ICT-2009.1.4 INFORMATION AND COMMUNICATION TECHNOLOGIES - Small or medium-scale focused research project - Grant agreement no.: 257644).

F. Moyano, C. Fernandez-Gago, I. Agudo, and J. Lopez, "A Task Ordering Approach for Automatic Trust Establishment",
Proceedings of the 2012 International Symposium on Engineering Secure Software and Systems (ESSoS 2012), G. Barthe, B. Livshits, and R. Scandariato Eds., LNCS 7159, Springer, pp. 76–89, Feb 2012. DOI More..

Abstract

Trust has become essential in computer science as a way of assisting the process of decision-making, such as access control. In any system, several tasks may be performed, and each of these tasks might pose different associated trust values between the entities of the system. For instance, in a file system, reading and overwriting a file are two tasks that pose different trust values between the users who can carry out these tasks. In this paper, we propose a simple model for automatically establishing trust relationships between entities considering an established order among tasks.

PDF icon Moyano_ESSoS12.pdf (526.84 KB)
F. Moyano, B. Baudry, and J. Lopez, "Towards Trust-Aware and Self-Adaptive Systems",
7th IFIP WG 11.11 International Conference on Trust Management (IFIPTM 2013), C. Fernandez-Gago, I. Agudo, F. Martinelli, and S. Pearson Eds., AICT 401, Springer, pp. 255-262, Jun 2013. DOI More..

Abstract

The Future Internet (FI) comprises scenarios where many heterogeneous and dynamic entities must interact to provide services (e.g., sensors, mobile devices and information systems in smart city scenarios). The dynamic conditions under which FI applications must execute call for self-adaptive software to cope with unforeseeable changes in the application environment. Software engineering currently provides frameworks to develop reasoning engines that automatically take reconfiguration decisions and that support the runtime adaptation of distributed, heterogeneous applications. However, these frameworks have very limited support to address security concerns of these application, hindering their usage for FI scenarios. We address this challenge by enhancing self-adaptive systems with the concepts of trust and reputation. Trust will improve decision-making processes under risk and uncertainty, in turn improving security of self-adaptive FI applications. This paper presents an approach that includes a trust and reputation framework into a platform for adaptive, distributed component-based systems, thus providing software components with new abilities to include trust in their reasoning process.  

PDF icon moyano2013ifiptm.pdf (585.82 KB)
F. Moyano, K. Beckers, and C. Fernandez-Gago, "Trust-Aware Decision-Making Methodology for Cloud Sourcing",
26th International Conference on Advanced Information Systems Engineering (CAiSE 2014), M. Jarke, et al. Eds., LCNS 8484, Springer, pp. 136-149, 06/2014. DOI More..

Abstract

Cloud sourcing consists of outsourcing data, services and infrastructure to cloud providers. Even when this outsourcing model brings advantages to cloud customers, new threats also arise as sensitive data and critical IT services are beyond customers' control. When an organization considers moving to the cloud, IT decision makers must select a cloud provider and must decide which parts of the organization will be outsourced and to which extent. This paper proposes a methodology that allows decision makers to evaluate their trust in cloud providers. The methodology provides a systematic way to elicit knowledge about cloud providers, quantify their trust factors and aggregate them into trust values that can assist the decision-making process. The trust model that we propose is based on trust intervals, which allow capturing uncertainty during the evaluation, and we define an operator for aggregating these trust intervals. The methodology is applied to an eHealth scenario.

PDF icon moyano14caise.pdf (333.6 KB)
Conference Proceedings
J. Biskup, and J. Lopez Eds., "Computer Security - ESORICS 2007, 12th European Symposium On Research In Computer Security, Dresden, Germany, September 24-26, 2007, Proceedings",
ESORICS, vol. 4734, Springer, 2007. More..
J. Zhou, J. Lopez, R. H. Deng, and F. Bao Eds., "Information Security, 8th International Conference, ISC 2005, Singapore, September 20-23, 2005, Proceedings",
ISC, vol. 3650, Springer, 2005. More..
S. K. Katsikas, J. Lopez, M. Backes, S. Gritzalis, and B. Preneel Eds., "Information Security, 9th International Conference, ISC 2006, Samos Island, Greece, August 30 - September 2, 2006, Proceedings",
ISC, vol. 4176, Springer, 2006. More..
M. Aguilar-Igartua, C. Tripp Barba, and C. Alcaraz, "Proceedings of the 12th ACM Symposium on Performance Evaluation of Wireless Ad Hoc, Sensor, & Ubiquitous Networks, PE-WASUN 2015",
12th ACM Symposium on Performance Evaluation of Wireless Ad Hoc, Sensor, & Ubiquitous Networks, PE-WASUN 2015, ACM, 2015. More..
J. Cuellar, J. Lopez, G. Barthe, and A. Pretschner Eds., ""Security and Trust Management"",
6th International Workshop, STM 2010, Athens, Greece, September 23-24, 2010. Proceedings, vol. 6710, 2010. More..
Journal Article
R. Roman, et al., "Advanced Secure Multimedia Services for Digital Homes",
Information Systems Frontiers, vol. 14, Springer, pp. 527-540, July 2012. DOI (I.F.: 0.851)More..

Abstract

Our society is becoming increasingly more IT-oriented, and the images and sounds that reflect our daily life are being stored mainly in a digital form. This digital personal life can be part of the home multimedia contents, and users demand access and possibly share these contents (such as photographs, videos, and music) in an ubiquitous way: from any location and with any device. The purpose of this article is twofold. First, we introduce the Feel@Home system, whose main objective is to enable the previously mentioned vision of an ubiquitous digital personal life. Second, we describe the security architecture of Feel@Home, analyzing the security and privacy requirements that identify which threats and vulnerabilities must be considered, and deriving the security building blocks that can be used to protect both IMS-based and VPN-based solutions.

Impact Factor: 0.851
Journal Citation Reports® Science Edition (Thomson Reuters, 2012)

PDF icon Roman2010a.pdf (1.36 MB)
V. Benjumea, J. Lopez, and J. M. Troya, "Anonymity Analysis in Credentials-based Systems: A Formal Framework",
Computer Standards & Interfaces, vol. 30, no. 4, Elsevier, pp. 253-261, 2008. (I.F.: 1.074)More..

Abstract

  Anonymity has been formalized and some metrics have been defined in the scope of anonymizing communication channels. In this paper, such formalization has been extended to cope with anonymity in those scenarios where users must anonymously prove that they own certain privileges to perform remote transactions. In these types of scenarios, the authorization policy states the privileges required to perform a given remote transaction. The paper presents a framework to analyze the actual degree of anonymity reached in a given transaction and allows its comparison with an ideal anonymity degree as defined by the authorization policy, providinga tool to model, design and analyze anonymous systems in different scenarios.    

Impact Factor: 1.074
Journal Citation Reports® Science Edition (Thomson Reuters, 2008)

PDF icon VicenteBenjumea2008.pdf (248.09 KB)
V. Benjumea, J. Lopez, and J. M. Troya, "Anonymous Attribute Certificates based on Traceable Signatures",
Internet Research, vol. 16, no. 2, Elsevier, pp. 120-139, 2006. (I.F.: 0.607)More..

Abstract

  In Benjumea et. al (Benjumea, 2004) we introduced the concept of anonymousattribute certificates in order to integrate anonymity capabilities in the standardizedX.509 attribute certificates. That solution was based on the use of fair-blind signatures(Stadler, 1995), but did not explore further possibilities of constructing similar datastructures based on more advanced signature schemes. In this new work, we propose anew type of anonymous attribute certificates that is based on the more recently proposedtraceable signature scheme (Kiayias, 2004a), providing a new anonymous authorizationsolution with interesting features that were not covered in the aforementioned scheme.Thus, this new solution allows users to make use of their attribute certificates in ananonymous way, but under certain circumstances it allows to disclose the users’ identities,trace the transactions carried out by any specific user, or revoke any anonymousattribute certificate. An additional contribution of this work is that it pays special attentionto the preservation of the unlinkability property between transactions, makingimpossible the creation of anonymous user profiles.

Impact Factor: 0.607
Journal Citation Reports® Science Edition (Thomson Reuters, 2006)

PDF icon VicenteBenjumea2006a.pdf (320.1 KB)
Y.. Qiu, J.. Zhou, J.. Baek, and J. Lopez, "Authentication and Key Establishment in Dynamic Wireless Sensor Networks",
Sensors, vol. 10, pp. 3718-3731, 2010. More..
PDF icon 1694.pdf (325.85 KB)
C. Alcaraz, G. Bernieri, F. Pascucci, J. Lopez, and R. Setola, "Covert Channels-based Stealth Attacks in Industry 4.0",
IEEE Systems Journal., vol. 13, issue 4, IEEE, pp. 3980-3988, 12/2019. DOI (I.F.: 3.987)More..

Abstract

Industry 4.0 advent opens several cyber-threats scenarios originally designed for classic information technology, drawing the attention to the serious risks for the modern industrial control networks. To cope with this problem, in this paper we address the security issues related to covert channels applied to industrial networks, identifying the new vulnerability points when information technologies converge with operational technologies such as edge computing infrastructures. Specifically, we define two signaling strategies where we exploit the Modbus/TCP protocol as target to set up a covert channel. Once the threat channel is established, passive and active offensive attacks (i.e. data exfiltration and command an control, respectively) are further exploited by implementing and testing them on a real Industrial Internet of Things testbed. The experimental results highlight the potential damage of such specific threats, and the easy extrapolation of the attacks to other types of channels in order to show the new risks for Industry 4.0. Related to this, we discuss some countermeasures to offer an overview of possible mitigation and defense measures.
 

Impact Factor: 3.987
Journal Citation Reports® Science Edition (Thomson Reuters, 2019)

PDF icon alcaraz2019a.pdf (938.98 KB)
J. Lopez, R. Rios, F. Bao, and G. Wang, "Evolving privacy: From sensors to the Internet of Things",
Future Generation Computer Systems, vol. 75, Elsevier, pp. 46–57, 10/2017. DOI (I.F.: 4.639)More..

Abstract

The Internet of Things (IoT) envisions a world covered with billions of smart, interacting things capable of offering all sorts of services to near and remote entities. The benefits and comfort that the IoT will bring about are undeniable, however, these may come at the cost of an unprecedented loss of privacy. In this paper we look at the privacy problems of one of the key enablers of the IoT, namely wireless sensor networks, and analyse how these problems may evolve with the development of this complex paradigm. We also identify further challenges which are not directly associated with already existing privacy risks but will certainly have a major impact in our lives if not taken into serious consideration. 

Impact Factor: 4.639
Journal Citation Reports® Science Edition (Thomson Reuters, 2017)

PDF icon Lopez2017iotpriv.pdf (440.5 KB)
C. Alcaraz, G. Fernandez, R. Roman, A. Balastegui, and J. Lopez, "Gestión segura de redes SCADA",
Nuevas tendencias en gestión de redes, Novática, no. 196, CEPIS, pp. 20-25, December, 2008. More..

Abstract

En el momento que se introduce en el mercado nuevas tecnologías basadas en entornos distribuidos comienzan a surgir en paralelo nuevos problemas de seguridad en los sistemas SCADA (Supervisory Control and Data Acquisition), los cuales monitorizan y gestionan otras infraestructuras de gran complejidad y escala. Un fallo o una interrupción en uno de sus componentes podría suponer un impacto negativo sobre la funcionalidad de otras infraestructuras, por lo que se hace necesario realizar frecuentes análisis de seguridad para así mantener actualizado el conocimiento y proveer recomendaciones y/o soluciones para mitigar o evitar futuras ocurrencias, garantizando una gestión de red fiable y siempre disponible.

PDF icon Alcaraz2008a.pdf (329.92 KB)
C. Alcaraz, G. Fernandez, R. Roman, A. Balastegui, and J. Lopez, "Secure Management of SCADA Networks",
Novatica, New Trends in Network Management, vol. 9, no. 6, Cepis UPGRADE, pp. 22-28, December, 2008. More..

Abstract

When a Supervisory Control and Data Acquisition (SCADA) system monitors and manages other complex infrastructures through the use of distributed technologies, it becomes a critical infrastructure by itself: A failure or disruption in any of its components could implicate a serious impact on the performance of the other infrastructures. The connection with other systems makes a SCADA system more vulnerable against attacks, generating new security problems. As a result, it is essential to perform diverse security analysis frequently in order to keep an updated knowledge and to provide recommendations and/or solutions to mitigate or avoid anomalous events. This will facilitate the existence of a suitable, reliable, and available control network.

PDF icon Alcaraz2008b.pdf (325.52 KB)
J. L. Vivas, C. Fernandez-Gago, A. Benjumea, and J. Lopez, "A security framework for a workflow-based grid development platform.",
Computer Standards and Interfaces, vol. 32, no. 5-6, Elsevier, pp. 230-245, Oct 2010. DOI (I.F.: 0.868)More..

Abstract

This paper describes the security framework that is to be developed for the generic grid platform created for the project GREDIA. This platform is composed of several components that need to be secured. The platform uses the OGSA standards, so that the security framework will follow GSI, the portion of Globus that implements security. Thus, we will show the security features that GSI already provides and we will outline which others need to be created or enhanced.

Impact Factor: 0.868
Journal Citation Reports® Science Edition (Thomson Reuters, 2010)

PDF icon vivas2009.pdf (1.34 MB)
V. Benjumea, J. Lopez, and J. M. Troya, "Specification of a Framework for the Anonymous Use of Privileges",
Telematics and Informatics, vol. 23, no. 3, Elsevier, pp. 179-195, 2006. More..

Abstract

In this paper we have defined an open framework to support open distributed applications where anonymous transactions based on user privileges play an important role. The goal of the framework is to provide a basis to the application level, and is presented from an open and general perspective where many different implementation schemes can fit. Moreover, we have presented a set of requirements that implementation schemes must fulfill to conform a fully anonymous privilege system, which guarantees to supported applications that anonymity will be preserved in remote transactions. Finally, we present an application scenario using the services provided by the framework in order to better show the possibilities of what this type of systems offers.

PDF icon VicenteBenjumea2006.pdf (174.49 KB)
S.. Zeadally, A.. Pathan, C. Alcaraz, and M.. Badra, "Towards Privacy Protection in Smart Grid",
Wireless Personal Communications, vol. 73, Springer, pp. 23-50, Nov 2013, 2012. DOI (I.F.: 0.428)More..

Abstract

The smart grid is an electronically controlled electrical grid that connects power generation, transmission, distribution, and consumers using information communication technologies. One of the key characteristics of the smart grid is its support for bi-directional information flow between the consumer of electricity and the utility provider. This two-way interaction allows electricity to be generated in real-time based on consumers’ demands and power requests. As a result, consumer privacy becomes an important concern when collecting energy usage data with the deployment and adoption of smart grid technologies. To protect such sensitive information it is imperative that privacy protection mechanisms be used to protect the privacy of smart grid users. We present an analysis of recently proposed smart grid privacy solutions and identify their strengths and weaknesses in terms of their implementation complexity, efficiency, robustness, and simplicity.

 

Impact Factor: 0.428
Journal Citation Reports® Science Edition (Thomson Reuters, 2012)

PDF icon 1750.pdf (2 MB)
F. Flammini, et al., "Towards Trustworthy Autonomous Systems: Taxonomies and Future Perspectives",
IEEE Transactions on Emerging Topics in Computing, IEEE, 2022. DOI (I.F.: 6.595)More..

Abstract

The class of Trustworthy Autonomous Systems (TAS) includes cyber-physical systems leveraging on self-x technologies that make them capable to learn, adapt to changes, and reason under uncertainties in possibly critical applications and evolving environments. In the last decade, there has been a growing interest in enabling artificial intelligence technologies, such as advanced machine learning, new threats, such as adversarial attacks, and certification challenges, due to the lack of sufficient explainability. However, in order to be trustworthy, those systems also need to be dependable, secure, and resilient according to well-established taxonomies, methodologies, and tools. Therefore, several aspects need to be addressed for TAS, ranging from proper taxonomic classification to the identification of research opportunities and challenges. Given such a context, in this paper address relevant taxonomies and research perspectives in the field of TAS. We start from basic definitions and move towards future perspectives, regulations, and emerging technologies supporting development and operation of TAS.

Impact Factor: 6.595
Journal Citation Reports® Science Edition (Thomson Reuters, 2021)

PDF icon Flamini2022.pdf (356.81 KB)
F. Flammini, et al., "Towards Trustworthy Autonomous Systems: Taxonomies and Future Perspectives",
IEEE Transactions on Emerging Topics in Computing, IEEE, 2022. DOI (I.F.: 6.595)More..

Abstract

The class of Trustworthy Autonomous Systems (TAS) includes cyber-physical systems leveraging on self-x technologies that make them capable to learn, adapt to changes, and reason under uncertainties in possibly critical applications and evolving environments. In the last decade, there has been a growing interest in enabling artificial intelligence technologies, such as advanced machine learning, new threats, such as adversarial attacks, and certification challenges, due to the lack of sufficient explainability. However, in order to be trustworthy, those systems also need to be dependable, secure, and resilient according to well-established taxonomies, methodologies, and tools. Therefore, several aspects need to be addressed for TAS, ranging from proper taxonomic classification to the identification of research opportunities and challenges. Given such a context, in this paper address relevant taxonomies and research perspectives in the field of TAS. We start from basic definitions and move towards future perspectives, regulations, and emerging technologies supporting development and operation of TAS.

Impact Factor: 6.595
Journal Citation Reports® Science Edition (Thomson Reuters, 2021)

PDF icon Flamini2022.pdf (356.81 KB)
D. Ferraris, D. Bastos, C. Fernandez-Gago, and F. El-Moussa, "A Trust Model for Popular Smart Home Devices",
International Journal of Information Security, Springer, 2020. DOI (I.F.: 1.988)More..

Abstract

Nowadays, smart home devices like Amazon Echo and Google Home have reached mainstream popularity.
Being in the homes of users, these devices are intrinsically intrusive, being able to access details such as users' name, gender, home address, calendar appointments and others.
There are growing concerns about indiscriminate data collection and invasion of user privacy in smart home devices, but studies show that perceived benefits are exceeding perceived risks when it comes to consumers.
As a result, consumers are placing a lot of trust in these devices, sometimes without realizing it.
Improper trust assumptions and security controls can lead to unauthorized access and control of the devices, which can result in serious consequences.
In this paper, we explore the behaviour of devices such as Amazon Echo and Google Home in a smart home setting with respect to trust relationships and propose a trust model to improve these relationships among all the involved actors.
We have evaluated how trust was built and managed from the initial set up phase to the normal operation phase, during which we performed a number of interaction tests with different types of users (i.e. owner, guests).
As a result, we were able to assess the effectiveness of the provided security controls and identify potential relevant security issues.  In order to address the identified issues, we defined a trust model and propose a solution based on it for further securing smart home systems.

Impact Factor: 1.988
Journal Citation Reports® Science Edition (Thomson Reuters, 2020)

PDF icon ferraris2020.pdf (985.79 KB)