Computer Science Department, University of Malaga
Campus de Teatinos s/n,29071 - Malaga (Spain)
Phone: (+34) 952136315 / 951952913 Fax: (+34) 952131397
- Applied crypto for Connected Car and Blockchain scenarios: Analysis of current security problems ,and proposal of new solutions, in Blockchain and Connected Car scenarios, in particular with regard to Privacy, Authentication and Confidentiality.
- Digital Identity: New requirements for interoperable identity scheme in the Future Internet. Exploring the possiblities of wearable devices as identity enablers.
- Authentication, Authorization and Delegation: Definition and implementation of privacy frienly autentication mechanisms.
- Ph.D. in Computer Science (with European Doctorate mention), University of Malaga (July 2008).
- MSc. in Mathematics, University of Malaga (July 2002).
- BSc. in Computer Science, UNED, Spain (August 2007).
- MOTAM: Methods to Optimize Road Transport through Mobile Applications
- DEPHISIT: Experimental Hybrid Platform for Intelligent Transport Systems
- Crypto4BC: Advanced Cryptography for Blockchain Applications
- Mikhail Egorov, MacLane Scott Wilkison, David Núñez and Isaac Agudo, "High-performance access management and data protection for distributed messaging applications", filled in 2018-05-08, granted in 2020-02-25
- Mikhail Egorov, MacLane Scott Wilkison, David Núñez and Isaac Agudo, "Method and system for secure delegated access to encrypted data in big data computing clusters", filled in 2018-05-08, granted in 2020-03-03
- David Núñez, Isaac Agudo, Mikhail Egorov and MacLane Scott Wilkison, "Method and system for switching public keys in ciphertexts", filled in 2017-11-29, pending
- Mikhail Egorov, MacLane Scott Wilkison, David Núñez and Isaac Agudo, "Encryption for distributed storage and processing", filled in 2017-11-09, pending
- "The fallout of key compromise in a proxy-mediated key agreement protocol",
31st Annual IFIP WG 11.3 Conference on Data and Applications Security and Privacy (DBSec'17), vol. LNCS 10359, Springer, pp. 453-472, 07/2017. DOI
In this paper, we analyze how key compromise affects the protocol by Nguyen et al. presented at ESORICS 2016, an authenticated key agreement protocol mediated by a proxy entity, restricted to only symmetric encryption primitives and intended for IoT environments. This protocol uses long-term encryption tokens as intermediate values during encryption and decryption procedures, which implies that these can be used to encrypt and decrypt messages without knowing the cor- responding secret keys. In our work, we show how key compromise (or even compromise of encryption tokens) allows to break forward secu- rity and leads to key compromise impersonation attacks. Moreover, we demonstrate that these problems cannot be solved even if the affected user revokes his compromised secret key and updates it to a new one. The conclusion is that this protocol cannot be used in IoT environments, where key compromise is a realistic risk.
- "Proxy Re-Encryption: Analysis of Constructions and its Application to Secure Access Delegation",
Journal of Network and Computer Applications, vol. 87, Elsevier, pp. 193-209, 06/2017. DOI (I.F.: 3.991)
This paper analyzes the secure access delegation problem, which occurs naturally in the cloud, and postulate that Proxy Re-Encryption is a feasible cryptographic solution, both from the functional and efficiency perspectives. Proxy re-encryption is a special type of public-key encryption that permits a proxy to transform ciphertexts from one public key to another, without the proxy being able to learn any information about the original message. Thus, it serves as a means for delegating decryption rights, opening up many possible applications that require of delegated access to encrypted data. In particular, sharing information in the cloud is a prime example. In this paper, we review the main proxy re-encryption schemes so far, and provide a detailed analysis of their characteristics. Additionally, we also study the efficiency of selected schemes, both theoretically and empirically, based on our own implementation. Finally, we discuss some applications of proxy re-encryption, with a focus on secure access delegation in the cloud.Impact Factor: 3.991Journal Citation Reports® Science Edition (Thomson Reuters, 2017)
- "On the Application of Generic CCA-Secure Transformations to Proxy Re-Encryption",
Security and Communication Networks, vol. 9, issue 12, Wiley, pp. 1769-1785, 08/2016. DOI (I.F.: 1.067)
Several generic methods exist for achieving chosen-ciphertext attack (CCA)-secure public-key encryption schemes from weakly secure cryptosystems, such as the Fujisaki–Okamoto and REACT transformations. In the context of proxy re-encryption (PRE), it would be desirable to count on analogous constructions that allow PRE schemes to achieve better security notions. In this paper, we study the adaptation of these transformations to proxy re-encryption and find both negative and positive results. On the one hand, we show why it is not possible to directly integrate these transformations with weakly secure PRE schemes because of general obstacles coming from both the constructions themselves and the security models, and we identify 12 PRE schemes that exhibit these problems. On the other hand, we propose an extension of the Fujisaki–Okamoto transformation for PRE, which achieves a weak form of CCA security in the random oracle model, and we describe the sufficient conditions for applying itImpact Factor: 1.067Journal Citation Reports® Science Edition (Thomson Reuters, 2016)
- "NTRUReEncrypt: An Efficient Proxy Re-Encryption Scheme Based on NTRU",
10th ACM Symposium on Information, Computer and Communications Security (AsiaCCS), pp. 179-189, 04/2015. DOI
The use of alternative foundations for constructing more secure and efficient cryptographic schemes is a topic worth exploring. In the case of proxy re-encryption, the vast majority of schemes are based on number theoretic problems such as the discrete logarithm. In this paper we present NTRUReEncrypt, a new bidirectional and multihop proxy re-encryption scheme based on NTRU, a widely known lattice-based cryptosystem. We provide two versions of our scheme: the first one is based on the conventional NTRU encryption scheme and, although it lacks a security proof, remains as efficient as its predecessor; the second one is based on a variant of NTRU proposed by Stehlé and Steinfeld, which is proven CPA-secure under the hardness of the Ring-LWE problem. To the best of our knowledge, our proposals are the first proxy re-encryption schemes to be based on the NTRU primitive. In addition, we provide experimental results to show the efficiency of our proposal, as well as a comparison with previous proxy re-encryption schemes, which confirms that our first scheme outperforms the rest by an order of magnitude.
- "A Parametric Family of Attack Models for Proxy Re-Encryption",
28th IEEE Computer Security Foundations Symposium, IEEE Computer Society, pp. 290-301, 07/2015. DOI
Proxy Re-Encryption (PRE) is a type of Public-Key Encryption (PKE) which provides an additional re-encryption functionality. Although PRE is inherently more complex than PKE, attack models for PRE have not been developed further than those inherited from PKE. In this paper we address this gap and define a parametric family of attack models for PRE, based on the availability of both the decryption and re-encryption oracles during the security game. This family enables the definition of a set of intermediate security notions for PRE that ranges from ``plain'' IND-CPA to ``full'' IND-CCA. We analyze some relations among these notions of security, and in particular, the separations that arise when the re-encryption oracle leaks re-encryption keys. In addition, we discuss which of these security notions represent meaningful adversarial models for PRE. Finally, we provide an example of a recent ``CCA1- secure'' scheme from PKC 2014 whose security model does not capture chosen-ciphertext attacks through re-encryption and for which we describe an attack under a more realistic security notion. This attack emphasizes the fact that PRE schemes that leak re-encryption keys cannot achieve strong security notions.
- "BlindIdM: A Privacy-Preserving Approach for Identity Management as a Service",
International Journal of Information Security, vol. 13, issue 2, Springer, pp. 199-215, 2014. DOI (I.F.: 0.963)
Identity management is an almost indispensable component of today’s organizations and companies, as it plays a key role in authentication and access control; however, at the same time it is widely recognized as a costly and time-consuming task. The advent of cloud computing technologies, together with the promise of flexible, cheap and efficient provision of services, has provided the opportunity to externalize such a common process, shaping what has been called Identity Management as a Service (IDaaS). Nevertheless, as in the case of other cloud-based services, IDaaS brings with it great concerns regarding security and privacy, such as the loss of control over the outsourced data. In this paper we analyze these concerns and propose BlindIdM, a model for privacy-preserving IDaaS with a focus on data privacy protection. In particular, we describe how a SAML-based system can be augmented to employ proxy re-encryption techniques for achieving data condentiality with respect to the cloud provider, while preserving the ability to supply the identity service. This is an innovative contribution to both the privacy and identity management landscapes.Impact Factor: 0.963Journal Citation Reports® Science Edition (Thomson Reuters, 2014)
- "Building Trust from Context Similarity Measures",
Computer Standards & Interfaces, Special Issue on Security in Information Systems, vol. 36, issue 4, Elsevier, pp. 792-800, 2014. DOI (I.F.: 0.879)
Trust is an essential feature of any system where entities have to collaborate among them. Trust can assist entities making decisions about what is the best entity for establishing a certain collaboration. It would be desirable to simulate behaviour of users as in social environments where they tend to establish relationships or to trust users who have common interests or share some of their opinions, i.e., users who are similar to them to some extent. Thus, in this paper we first introduce the concept of context similarity among entities and from it we derive a similarity network which can be seen as a graph. Based on this similarity network we dene a trust model that allows us also to establish trust along a path of entities. A possible applications of our model are proximity-based trust establishment. We validate our model in this scenario.Impact Factor: 0.879Journal Citation Reports® Science Edition (Thomson Reuters, 2014)
- "A Privacy-Aware Continuous Authentication Scheme for Proximity-Based Access Control",
Computers & Security, vol. 39 (B), Elsevier, pp. 117-126, 11/2013. DOI (I.F.: 1.172)
Continuous authentication is mainly associated with the use of biometrics to guarantee that a resource is being accessed by the same user throughout the usage period. Wireless devices can also serve as a supporting technology for continuous authentication or even as a complete alternative to biometrics when accessing proximity-based services. In this paper we present the implementation of a secure, non-invasive continuous authentication scheme supported by the use of Wearable Wireless Devices (WWD), which allow users to gain access to proximity-based services while preserving their privacy. Additionally we devise an improved scheme that circumvents some of the limitations of our implementation.Impact Factor: 1.172Journal Citation Reports® Science Edition (Thomson Reuters, 2013)
- "Integrating OpenID with Proxy Re-Encryption to enhance privacy in cloud-based identity services",
IEEE CloudCom 2012, IEEE Computer Society, pp. 241 - 248, Dec 2012. DOI
The inclusion of identity management in the cloud computing landscape represents a new business opportunity for providing what has been called Identity Management as a Service (IDaaS). Nevertheless, IDaaS introduces the same kind of problems regarding privacy and data confidentiality as other cloud services; on top of that, the nature of the outsourced information (users’ identity) is critical. Traditionally, cloud services (including IDaaS) rely only on SLAs and security policies to protect the data, but these measures have proven insufficient in some cases; recent research has employed advanced cryptographic mechanisms as an additional safeguard. Apart from this, there are several identity management schemes that could be used for realizing IDaaS systems in the cloud; among them, OpenID has gained crescent popularity because of its open and decentralized nature, which makes it a prime candidate for this task. In this paper we demonstrate how a privacy-preserving IDaaS system can be implemented using OpenID Attribute Exchange and a proxy re-encryption scheme. Our prototype enables an identity provider to serve attributes to other parties without being able to read their values. This proposal constitutes a novel contribution to both privacy and identity management fields. Finally, we discuss the performance and economical viability of our proposal.
Courses and seminars
- Private seminar on "Blockchain, Distributed Identity and software based key protection and encryption" sponsored by Idfy, May 2019.
- European Intensive Programme on Information & Communication Systems Security (IPICS), September 2012.
- Computer Science Paradigms - Esp. in Information Security. University of la Laguna, November 2012