Biblio

Export results:
Author Title Type [ Year(Asc)]
Filters: Author is Muñoz, Antonio  [Clear All Filters]
A. Muñoz, R. Rios, R. Roman, and J. Lopez, "A survey on the (in)security of Trusted Execution Environments",
Computers & Security, Elsevier, pp. 103-180, 2023. DOI (I.F.: 5.105)More..

Abstract

As the number of security and privacy attacks continue to grow around the world, there is an ever increasing need to protect our personal devices. As a matter of fact, more and more manufactures are relying on Trusted Execution Environments (TEEs) to shield their devices. In particular, ARM TrustZone (TZ) is being widely used in numerous embedded devices, especially smartphones, and this technology is the basis for secure solutions both in industry and academia. However, as shown in this paper, TEE is not bullet-proof and it has been successfully attacked numerous times and in very different ways. To raise awareness among potential stakeholders interested in this technology, this paper provides an extensive analysis and categorization of existing vulnerabilities in TEEs and highlights the design flaws that led to them. The presented vulnerabilities, which are not only extracted from existing literature but also from publicly available exploits and databases, are accompanied by some effective countermeasures to reduce the likelihood of new attacks. The paper ends with some appealing challenges and open issues.

Impact Factor: 5.105
Journal Citation Reports® Science Edition (Thomson Reuters, 2021)

PDF icon MUNOZ2023103180.pdf (2.08 MB)
M. Ruiz, et al., "AndroCIES: Automatización de la certificación de seguridad para aplicaciones Android",
XVII Reunión Española sobre Criptología y Seguridad de la Información (RECSI 2022), vol. 265, Ediciones Universidad Cantabria, pp. 192-197, 10/2022. More..

Abstract

El auge de las plataformas móviles está impulsando el desarrollo de un gran número de aplicaciones, muchas de las cuales salen al mercado sin las convenientes comprobaciones de seguridad. Recientemente, Google está apostando por hacer este problema más visible y concienciar a los usuarios de la necesidad de instalar aplicaciones verificadas por laboratorios independientes. Sin embargo, la certificación de aplicaciones suele ser una tarea ardua y no exenta de errores. Por ello, en este trabajo, presentamos la herramienta AndroCIES, que es capaz de automatizar en gran medida las evaluaciones necesarias para la certificación de aplicaciones móviles, reduciendo en torno a un 20% el tiempo empleado en este proceso.

PDF icon 2016.pdf (233.83 KB)
A. Muñoz, C. Fernandez-Gago, and R. Lopez-villa, "A Test Environment for Wireless Hacking in Domestic IoT Scenarios",
Mobile Networks and Applications, Springer, 2022/10/14. DOI (I.F.: 3.077)More..
Impact Factor: 3.077
Journal Citation Reports® Science Edition (Thomson Reuters, 2021)

PDF icon munoz2022.pdf (744.15 KB)
A. Muñoz, A. Farao, R. Casas, and C. Xenakis, "P2ISE: Preserving Project Integrity in CI/CD Based on Secure Elements",
Information, vol. 12, issue 9, no. 357, MDPI, 08/2021. More..
PDF icon anto2021.pdf (1.59 MB)
A. Muñoz, "ICITPM: Integrity validation of software in iterative Continuous Integration through the use of Trusted Platform Module (TPM)",
1st Workshop on Dependability and Safety Emerging Cloud and Fog Systems (DeSECSyS) - Colocated with ESORICS, Guildford (United Kingdom). September 2020., A. Farao Eds., Springer, pp. 147–165, 2020.
A. Muñoz, "A performance-oriented monitoring system for security properties in cloud computing applications",
The Computer Journal, J. González Eds., Oxford Academic, 2012.
J. Lopez, A. Mana, and A. Muñoz, "A Secure and Auto-configurable Environment for Mobile Agents in Ubiquitous Computing Scenarios",
Third International Conference on Ubiquitous Intelligence and Computing, LNCS 4159, no. 4159, Springer, pp. 977-987, August, 2006. More..

Abstract

The increased heterogeneity and dynamism of new computing paradigms and especially of ubiquitous computing models is boosting the need for auto-configurable systems. In these new scenarios, heterogeneity and dynamism are inherent properties and applications are built by aggregating distributed information and services that are not under the control of a single entity. Furthermore, the current trend towards distributed computing poses important problems related to the need to transmit large amounts of data between the distributed nodes of the computing system; the control over the information; and the flexibility to adapt to heterogeneous client requirements. These characteristics are difficult to manage by traditional computing models. For these reasons, the mobile agent paradigm is gaining momentum and the interest of researchers and industry in this paradigm is increasing. In this paper we present a solution to provide a secure and auto-configurable environment for mobile agents in ubiquitous computing scenarios. Our approach is based on two main building blocks: trusted platforms and profiles.

PDF icon JavierLopez2006.pdf (61.69 KB)
F. Sanchez-Cid, A. Muñoz, D. Serrano, and C. Fernandez-Gago, "Software Engineering Techniqes Applied to AmI: Security Patterns",
First International Conference on Ambient Intelligence Developments (AmID’06), Springer, pp. 108-123, September, 2006. DOI More..

Abstract

The realization of the Ambient Intelligence concept entails many important challenges, but the most important barriers to this realization is the lack of adequate support for security. In this paper we present a conceptual model of our solution for building secure systems for AmI environments, taking as basis the concept of Security and Dependability (S&D) Pattern as a precise representation of validated S&D solutions and mechanisms. The main elements embedded in our solution framework (S&D library, monitoring interface and S&D Manager) are presented both conceptually, and also using a simple example scenario based on an hospital AmI environment.

PDF icon Cid2006.pdf (210.37 KB)
A. Muñoz, J. A. Onieva, and J. Lopez, "Perfiles Seguros para Comercio Movil",
III Simposio Español de Comercio Electronico (SCE’05), Universitat de les Illes Balears, pp. 235-244, 2005. More..

Abstract

Los escenarios de comercio móvil existentes en la actualidad presentan muchas deficiencias. La mayoría de estos escenarios, como no podría ser de otra forma, tienen en cuenta aspectos relativos a la seguridad, prestando especial atención a las propiedades de Autenticación y Autorización. De entre los elementos esenciales que se utilizan para proporcionar estos servicios de seguridad, los perfiles son un elemento común que permiten la personalización de los servicios del usuario móvil. Sin embargo, los perfiles también precisan de una administración segura. En este trabajo presentamos unas consideraciones iniciales respecto a los distintos tipos de perfiles, sus niveles de seguridad para cada tipo, así como indicaciones para el almacenamiento de manera segura. Por lo tanto, analizaremos las distintas alternativas como medio de almacenamiento, discutiéndolas y prestando especial atención a las tarjetas inteligentes.

PDF icon AntonioMunoz2005a.pdf (97.73 KB)
A. Muñoz, J. A. Onieva, and J. Lopez, "On Secure Profiling",
1st International Workshop on Secure Ubiquitous Networks (SUN’05), IEEE Press, pp. 214-218, August, 2005. More..

Abstract

Ubiquitous environments have several drawbacks to be solved. Most of them are focused on security, and relevant ones are authorization and authentication. Amongst the essential elements to adequately provide solutions, we can find profiles. A profile can be defined as a repository to store structured data from users, networks, devices, applications, etc. As profiles are needed in ubiquitous environments, and these need of secure management as well, in this paper, we provide some initial guidance on the security storage of profiles and on security levels needed for each type of profile. Additionally, we review different alternatives to bear profiles, concluding that smartcards are the most suitable devices.

PDF icon AntonioMunoz2005.pdf (182.15 KB)
Modify or remove your filters and try again.