Publications

Export results:
Author Title Type [ Year(Asc)]
Filters: First Letter Of Title is M  [Clear All Filters]
M. Kolar, C. Fernandez-Gago, and J. Lopez, "A Model Specification Implementation for Trust Negotiation",
The 14th International Conference on Network and System Security (NSS 2020), vol. 12570, Springer, pp. 327-341, 11/2020. More..

Abstract

Trust negotiation represents a suitable approach for building trust in online environments, where the interacting entities are anonymous. It covers important criteria on security and privacy. In this work, we propose a method for implementing our model specification that handles trust negotiation. We define the structure of the trust negotiation module that is a standalone unit capable of negotiating on its own. It may be included to any software by its defined interfaces. We realise our method with a ride-sharing scenario and four trust negotiation strategies that we apply in order to validate our design and implementation. We propose a solution that is fully customisable based on different requirements. The proposal provides guidelines for developers in the process of including trust negotiation into their software.

PDF icon 1852.pdf (569.75 KB)
A. Acien, A. Nieto, and J. Lopez, "Modelo para la clasificación y análisis de ataques Cross-Platform",
IV Jornadas Nacionales de Investigación en Ciberseguridad (JNIC 2018), Servicio Editorial de Mondragon Unibertsitatea, 06/2018. More..

Abstract

Los ataques cross-platform suponen un serio desafío para los mecanismos de seguridad cuando los portadores de un ataque dirigido no son conscientes de su participacion en el mismo. Es por ello que, con dispositivos y tecnologías cada vez mas entrelazadas, en constante comunicación, numerosos ataques pasan desapercibidos hasta que alcanzan su objetivo final. Estos nuevos escenarios hacen posible una vía de transmision a tener en cuenta, y que se debe abordar cuanto antes, ya que sus consecuencias, especialmente en el panorama de telecomunicaciones actual, podrían ser desoladoras. La rapida transmisión de estos ataques, y la dificultad que supone su prevencion, detección y mitigación antes de que se hagan efectivos, hacen que el problema sea particularmente preocupante. En este artículo se presentará una arquitectura para el analisis de los ataques cross-platform silenciosos, cuyo objetivo es ayudar a comprender mejor este tipo de amenazas y ofrecer soluciones que permitan mitigarlas y rastrearlas.

PDF icon 1699.pdf (880.31 KB)
A. Nieto, R. Rios, and J. Lopez, "A Methodology for Privacy-Aware IoT-Forensics",
16th IEEE International Conference On Trust, Security And Privacy In Computing And Communications (TrustCom 2017), IEEE, pp. 626-633, 08/2017. DOI More..

Abstract

The Internet of Things (IoT) brings new challenges to digital forensics. Given the number and heterogeneity of devices in such scenarios, it bring extremely difficult to carry out investigations without the cooperation of individuals. Even if they are not directly involved in the offense, their devices can yield digital evidence that might provide useful clarification in an investigation. However, when providing such evidence they may leak sensitive personal information. This paper proposes PRoFIT; a new model for IoT-forensics that takes privacy into consideration by incorporating the requirements of ISO/IEC 29100:2011 throughout the investigation life cycle. PRoFIT is intended to lay the groundwork for the voluntary cooperation of individuals in cyber crime investigations.

PDF icon 1652.pdf (517.19 KB)
G. Fernandez, A. Nieto, and J. Lopez, "Modeling Malware-driven Honeypots",
14th International Conference On Trust, Privacy & Security In Digital Business (TrustBus 2017), vol. 10442, Springer International Publishing, pp. 130-144, 08/2017. DOI More..

Abstract

In this paper we propose the Hogney architecture for the deployment of malware-driven honeypots. This new concept refers to honeypots that have been dynamically configured according to the environment expected by malware. The adaptation mechanism designed here is built on services that offer up-to-date and relevant intelligence information on current threats. Thus, the Hogney architecture takes advantage of recent Indicators Of Compromise (IOC) and information about suspicious activity currently being studied by analysts. The information gathered from these services is then used to adapt honeypots to fulfill malware requirements, inviting them to unleash their full strength.

PDF icon 1656.pdf (406.21 KB)
C. Alcaraz, E. Etcheves Miciolino, and S. Wolthusen, "Multi-Round Attacks on Structural Controllability Properties for Non-Complete Random Graphs",
The 16th Information Security Conference (ISC), vol. 7807, Springer, pp. 140–151, 09/2015. DOI More..

Abstract

 The notion of controllability, informally the ability to force a system into a desired state in a finite time or number of steps, is most closely associated with control systems such as those used to maintain power networks and other critical infrastructures, but has wider relevance in distributed systems. It is clearly highly desirable to understand under which conditions attackers may be able to disrupt legitimate control, or to force overriding controllability themselves. Following recent results by Liu et al., there has been considerable interest also in graph-theoretical interpretation of Kalman controllability originally introduced by Lin, structural controllability. This permits the identification of sets of driver nodes with the desired state-forcing property, but determining such nodes is aW[2]-hard problem. To extract these nodes and represent the control relation, here we apply the POWER DOMINATING SET problem and investigate the effects of targeted iterative multiple-vertex removal. We report the impact that different attack strategies with multiple edge and vertex removal will have, based on underlying non-complete graphs, with an emphasis on power-law random graphs with different degree sequences.

PDF icon alcaraz2013controla.pdf (169.18 KB)
D. Nuñez, C. Fernandez-Gago, S. Pearson, and M. Felici, "A Metamodel for Measuring Accountability Attributes in the Cloud",
2013 IEEE International Conference on Cloud Computing Technology and Science (CloudCom 2013), IEEE, pp. 355-362, 12/2013. DOI More..

Abstract

Cloud governance, and in particular data governance in the cloud, relies on different technical and organizational practices and procedures, such as policy enforcement, risk management, incident management and remediation. The concept of accountability encompasses such practices, and is essential for enhancing security and trustworthiness in the cloud. Besides this, proper measurement of cloud services, both at a technical and governance level, is a distinctive aspect of the cloud computing model. Hence, a natural problem that arises is how to measure the impact on accountability of the procedures held in practice by organizations that participate in the cloud ecosystem. In this paper, we describe a metamodel for addressing the problem of measuring accountability properties for cloud computing, as discussed and defined by the Cloud Accountability Project (A4Cloud). The goal of this metamodel is to act as a language for describing: (i) accountability properties in terms of actions between entities, and (ii) metrics for measuring the fulfillment of such properties. It also allows the recursive decomposition of properties and metrics, from a high-level and abstract world to a tangible and measurable one. Finally, we illustrate our proposal of the metamodel by modelling the transparency property, and define some metrics for it.

PDF icon nunez2013metamodel.pdf (304.22 KB)
C. Alcaraz, I. Agudo, D. Nuñez, and J. Lopez, "Managing Incidents in Smart Grids à la Cloud",
IEEE CloudCom 2011, IEEE Computer Society, pp. 527-531, Nov-Dec 2011. DOI More..

Abstract

During the last decade, the Cloud Computing paradigm has emerged as a panacea for many problems in traditional IT infrastructures. Much has been said about the potential of Cloud Computing in the Smart Grid context, but unfortunately it is still relegated to a second layer when it comes to critical systems. Although the advantages of outsourcing those kind of applications to the cloud is clear, data confidentiality and operational privacy stand as mayor drawbacks. In this paper, we try to give some hints on which security mechanisms and more specific, which cryptographic schemes, will help a better integration of Smart Grids and Clouds. We propose the use of Virtual SCADA in the Cloud (VS-Cloud) as a mean to improve reliability and efficiency whilst maintaining the same protection level as in traditional SCADA architectures.

 

PDF icon 1643.pdf (272.71 KB)
I. Agudo, C. Fernandez-Gago, and J. Lopez, "A Multidimensional Reputation Scheme for Identity Federations",
Sixth European Workshop on Public Key Services, Applications and Infrastructures (EuroPKI’09), LNCS 6391, Springer, pp. 225-238, 2009. DOI More..

Abstract

Deciding who to trust in the internet of services paradigm is an important and open question. How to do it in an optimal way is not always easy to determine. Trust is usually referred to a particular context whereas a single user may interact in more than one given context. We are interested in investigating how a Federated Reputation System can help exporting trust perceptions from one context to another. We propose a model for deriving trust in online services. In this context, trust is defined as the level of confidence that the service provider holds on the subject interacting with it to behave in a proper way while using the service. Thus, we derive trust by using the reputation values that those users have gained for interacting with these services.

PDF icon Agudo2009a.pdf (238.71 KB)
R. J. Caro, et al., "Middleware Seguro EP2P: un Desafío para las Redes Sociales",
XVIII Jornadas Telecom I+D, October, 2008. More..

Abstract

Los sistemas distribuidos en dispositivos embebidos representan un nuevo reto en el desarrollo de software. Estos sistemas han supuesto una importante revolución en el paradigma de la computación distribuida donde se intenta fragmentar un problema grande en múltiples problemas más pequeños. El nuevo escenario tiende entonces hacia sistemas en los cuales todos los elementos de la red se consideran iguales y los mecanismos de comunicación estãn basados en redes ad-hoc que se forman dinámicamente. De esta forma cualquier usuario de la red (en realidad cualquier elemento, hasta el más simple dispositivo) adquiere valor, a mayor colaboración, mayor éxito del sistema. Sin embargo, desde el punto de vista de la seguridad, estos sistemas son extremadamente vulnerables. En este artículo se presenta SMEPP, un middleware diseñado especialmente para sistemas P2P incluyendo aspectos de seguridad. SMEPP está diseñado para poder ser ejecutado en un amplio rango de dispositivos (desde redes de sensores hasta PC), y trata de facilitar el desarrollo de aplicaciones ocultando los detalles de la plataforma y otros aspectos tales como escalabilidad, adaptabilidad e interoperabilidad. Además el artículo presenta dos aplicaciones de alto nivel que utilizando este middleware pasan a ser más personales, más sociales y más baratas, haciendo que todos los usuarios de la red cobren mayor importancia.

PDF icon Benito2008.pdf (575.71 KB)
I. Agudo, C. Fernandez-Gago, and J. Lopez, "A Model for Trust Metrics Analysis",
5th International Conference on Trust, Privacy and Security in Digital Business (TrustBus’08), LNCS 5185, Springer, pp. 28-37, 2008. DOI More..

Abstract

Trust is an important factor in any kind of network essential, for example, in the decision-making process. As important as the definition of trust is the way to compute it. In this paper we propose a model for defining trust based on graph theory and show examples of some simple operators and functions that will allow us to compute trust.

PDF icon Agudo2008a.pdf (129.8 KB)
M. Carbonell, J. Maria Sierra, and J. Lopez, "Modelo de pago con intermediario. Su aplicación a un escenario real",
IX Reunión Española sobre Criptología y Seguridad de la información (IX RECSI), pp. 35-46, Sep 2006.
M. Carbonell, J. A. Onieva, J. Lopez, and J. Zhou, "Modelo de Simulacion para la Estimacion de Parametros en los protocolos de no Repudio",
III Simposio Español de Comercio Electronico (SCE’05), Universitat de les Illes Balears, pp. 151-164, 2005. More..

Abstract

El no repudio es un requisito de seguridad cuya importancia se ha hecho evidente con el crecimiento del comercio electrónico. Muchos protocolos se han desarrollado como solución a este requisito. La gran mayoría incluye en su especificación parámetros cuyos valores no son fáciles de especificar pues dependen de las condiciones reales de implementación del mismo como los tiempos límites, las características de la TTP, tiempo de publicación de las claves, etc. En este trabajo proponemos un modelo que nos ayudará en la estimación de esos parámetros basado en la simulación del escenario real. Para la explicación y prueba del modelo mostramos un conjunto de experimentos.

PDF icon MildreyCarbonell2005.pdf (360.56 KB)
J. A. Onieva, J. Lopez, and J. Zhou, "Mejorando Servicios de Correo Electronico Certificado con Prontitud Temporal y Multicasting",
VIII Reunión Española sobre Criptología y Seguridad de la información (RECSI’04). Avances en Criptologia y Seguridad de la Informacion, Diaz de Santos, pp. 537-546, 2004. More..

Abstract

El correo electrónico certificado es un servicio añadido al correo electrónico estándar, en el cual el remitente desea obtener un recibo procedente del destinatario. Para este servicio, encontramos que los protocolos de intercambio (justo) son un componente principal para asegurar la corrección en la ejecución de los servicios de correo electrónico certificado, ya que los ítems que ambas partes presentan (en este caso específico, el mensaje de correo y el recibo del mismo) deben ser intercambiados sin que ninguna de las partes obtenga una ventaja durante el proceso sobre la otra. Podemos encontrar en esta línea de investigación protocolos optimistas eficientes para el intercambio electrónico, y mas concretamente para Correo Electrónico Certificado (CEC) y Firma Electrónica de Contratos (FEC). Realizando un estudio adecuado hemos observado que algunos aspectos de dichos protocolos podrían ser mejorados. En este artículo proponemos una solución que permite a ambas entidades terminar el protocolo de forma asíncrona. También extendemos el protocolo a múltiples usuarios.

PDF icon JoseA.Onieva2004d.pdf (139.28 KB)
J. A. Onieva, J. Zhou, M. Carbonell, and J. Lopez, "A Multi-Party Non-Repudiation Protocol for Exchange of Different Messages",
18th IFIP International Information Security Conference. Security and Privacy in the Age of Uncertainty (IFIP SEC’03), IFIP, pp. 37-48, May, 2003. More..

Abstract

Non-repudiation is a security service that provides cryptographic evidence to support the settlement of disputes. In this paper, we introduce the state-of-the-art of multi-party non-repudiation protocols, and analyze the previous work where one originator is able to send the same message to many recipients. We propose a new multi-party non-repudiation protocol for sending different messages to many recipients. We also discuss the improvements achieved with respect to the multiple instances of a two-party non-repudiation protocol, and present some applications that would benefit from them.

PDF icon Onieva2003.pdf (203.9 KB)
J. Areitio, and J. Lopez, "Mecanismo de Seguridad de Bajo Costo para Micropagos",
VI Reunion Española de Criptología y Seguridad de la Información (VI RECSI), pp. 193-200, Septiembre, 2000. More..

Abstract

La presente comunicación presenta un mecanismo de micropagos flexible, de bajo costo que puede utilizarse para realizar pagos en línea entre el cliente y el vendedor y fuera de línea con el agente de negocios. Este mecanismo evita grandes almacenamientos de datos y cálculos largos. Se puede implantar en software para el cliente y en hardware/software para el vendedor.  

PDF icon JavierAreitio2000a.pdf (63.72 KB)
Modify or remove your filters and try again.