Publications

Export results:
[ Author(Asc)] Title Type Year
Filters: First Letter Of Last Name is R  [Clear All Filters]
A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 
R
S. Russell, E. Okamoto, E. Dawson, and J. Lopez, "Improving Performance in Global PKI using Virtual Certificates and Synthetic Certificates",
Symposium on Cryptography and Information Security (SCIS’02), pp. 1149-1154, January, 2002. More..

Abstract

A digital certificate may be used to inform the world of the public key of its owner. To guard against impersonations and fraud, the receiver needs to perform a series of checks. When a hierarchy of certificates is involved, and when there are large volumes of messages between two parties, as is frequent in commerce, the repeated validation of the same chain of certificates consume significant resources. This paper presents new concepts of virtual certificate and synthetic certificate which can be used to speed up repetitive processing of a chain with improved efficiency.

PDF icon SelwynRussell2002.pdf (182.25 KB)
J. E. Rubio, C. Alcaraz, and J. Lopez, "Selecting Privacy Solutions to Prioritise Control in Smart Metering Systems",
The 11th International Conference on Critical Information Infrastructures Security, vol. 10242, pp. 176-188, 2017. More..

Abstract

The introduction of the Smart Grid brings with it several benefits to society, because its bi-directional communication allows both users and utilities to have better control over energy usage. However, it also has some privacy issues with respect to the privacy of the customers when analysing their consumption data. In this paper we review the main privacy-preserving techniques that have been proposed and compare their efficiency, to accurately select the most appropriate ones for undertaking control operations. Both privacy and performance are essential for the rapid adoption of Smart Grid technologies.

PDF icon 1600.pdf (275.75 KB)
J. E. Rubio, M. Manulis, C. Alcaraz, and J. Lopez, "Enhancing Security and Dependability of Industrial Networks with Opinion Dynamics",
European Symposium on Research in Computer Security (ESORICS2019), vol. 11736, pp. 263-280, 09/2019. DOI More..
PDF icon RubioESORICS2019.pdf (489.08 KB)
J. E. Rubio, C. Alcaraz, R. Roman, and J. Lopez, "Analysis of Intrusion Detection Systems in Industrial Ecosystems",
14th International Conference on Security and Cryptography (SECRYPT 2017), vol. 6, SciTePress, pp. 116-128, 2017. DOI More..
PDF icon 1662.pdf (312.9 KB)
J. E. Rubio, R. Roman, C. Alcaraz, and Y. Zhang, "Tracking Advanced Persistent Threats in Critical Infrastructures through Opinion Dynamics",
European Symposium on Research in Computer Security (ESORICS 2018), vol. 11098, Springer, pp. 555-574, 08/2018. DOI More..

Abstract

Advanced persistent threats pose a serious issue for modern industrial environments, due to their targeted and complex attack vectors that are difficult to detect. This is especially severe in critical infrastructures that are accelerating the integration of IT technologies. It is then essential to further develop effective monitoring and response systems that ensure the continuity of business to face the arising set of cyber-security threats. In this paper, we study the practical applicability of a novel technique based on opinion dynamics, that permits to trace the attack throughout all its stages along the network by correlating different anomalies measured over time, thereby taking the persistence of threats and the criticality of resources into consideration. The resulting information is of essential importance to monitor the overall health of the control system and correspondingly deploy accurate response procedures.

PDF icon RubioRomanAlcarazZhang2018.pdf (1.21 MB)
J. E. Rubio, C. Alcaraz, and J. Lopez, "Addressing Security in OCPP: Protection Against Man-in-the-Middle Attacks",
9th IFIP International Conference on New Technologies, Mobility & Security, 2018. More..
PDF icon 1692.pdf (259.16 KB)
J. E. Rubio, C. Alcaraz, R. Rios, R. Roman, and J. Lopez, "Distributed Detection of APTs: Consensus vs. Clustering",
25th European Symposium on Research in Computer Security (ESORICS 2020), vol. 12308, pp. 174-192, 09/2020. DOI More..
PDF icon 1846.pdf (1.07 MB)
J. E. Rubio, R. Roman, and J. Lopez, "Analysis of cybersecurity threats in Industry 4.0: the case of intrusion detection",
The 12th International Conference on Critical Information Infrastructures Security, vol. Lecture Notes in Computer Science, vol 10707, Springer, pp. 119-130, 08/2018. More..
PDF icon 1666.pdf (236.18 KB)
J. E. Rubio, C. Alcaraz, and J. Lopez, "Game Theory-Based Approach for Defense against APTs",
18th International Conference on Applied Cryptography and Network Security (ACNS’20), vol. 12147, Springer, pp. 297-320, 10/2020. DOI
J. E. Rubio, C. Alcaraz, and J. Lopez, "Preventing Advanced Persistent Threats in Complex Control Networks",
European Symposium on Research in Computer Security, vol. 10493, 22nd European Symposium on Research in Computer Security (ESORICS 2017), pp. 402-418, 09/2017. More..
PDF icon RubioAlcarazLopez2017ESORICS.pdf (955.81 KB)
D. G. Rosado, E. Fernandez-Medina, and J. Lopez, "Extensión UML para Casos de Uso Reutilizables en entornos Grid Móviles Seguros",
XIV Jornadas de Ingeniería del Software y Bases de Datos (JISBD 2009), Antonio Vallecillo and Goiuria Sagardui (Eds.), pp. 331-342, September, 2009. More..

Abstract

 

 

 

Los sistemas Grid nos permiten construir sistemas complejos concaracterísticas diferenciadoras (interoperabilidad entre múltiples dominios deseguridad, autenticación y autorización a través de dominios, sistema dinámicoy heterogéneo, etc.). Con el desarrollo de la tecnología wireless y losdispositivos móviles, el Grid llega a ser el candidato perfecto para que losusuarios móviles puedan realizar trabajos complejos, a la vez que añaden nuevacapacidad computacional al Grid. Estamos construyendo un proceso completode desarrollo para sistemas Grid móviles seguros, y una de las actividades es elanálisis de requisitos, que está basado en casos de uso reutilizables. En esteartículo, presentaremos una extensión UML para casos de uso de seguridad yGrid, los cuales capturan el comportamiento de este tipo de sistemas. Estaextensión UML está siendo aplicado a un caso real para construir diagramas decasos de uso de la aplicación, incorporando los aspectos de seguridadnecesarios.

PDF icon rosado2009e.pdf (372.27 KB)
D. G. Rosado, E. Fernandez-Medina, J. Lopez, and M. Piattini, "PSecGCM: Process for the development of Secure Grid Computing based Systems with Mobile devices",
International Conference on Availability, Reliability and Security (ARES’08), IEEE Computer Society, pp. 136-143, 2008. More..

Abstract

 

A Grid computing system is defined as a platformthat supports distributed system applications which require fastaccess to a large quantity of distributed resources in acoordinated manner. With the development of wirelesstechnology and mobile devices, the Grid becomes the perfectcandidate so that mobile users can make complex works that addnew computational capacity to the Grid. Security of thesesystems, due to their distributed and open nature, receives greatinterest. The growing size and profile of the grid requirecomprehensive security solutions as they are critical to thesuccess of the endeavour. A formal approach to security in thesoftware life cycle is essential to protect corporate resources.However, little thought has been given to this aspect of softwaredevelopment. Due to its criticality, security should be integratedas a formal approach in the software life cycle. A methodology ofdevelopment for secure mobile Grid computing based systems isdefined, that is to say, an engineering process that defines thesteps to follow so that starting from the necessities to solve, wecan design and construct a secure Grid system with support formobile devices that is able to solve and cover these necessities.

 

 

PDF icon rosado2008.pdf (164.18 KB)
D. G. Rosado, E. Fernandez-Medina, and J. Lopez, "Reusable Security Use Cases for Mobile Grid environments",
Workshop on Software Engineering for Secure Systems, IEEE, pp. 1-8, 2009. More..

Abstract

 

Due to the growing complexity of softwaredevelopment, developing software through systematicprocesses is becoming more and more important.Likewise, it is important that the development processused integrates security aspects from the first stages atthe same level as other functional and non-functionalrequirements. In the last years, GRID technology hasshown to be the most important one and it allows us tobuild very complex information systems with differentand remarkable features (interoperability betweenmultiple security domains, cross-domainauthentication and authorization, dynamic,heterogeneous and limited mobile devices, etc).Traditionally, systems based on GRID Computing havenot been developed through adequate methodologiesand have not taken into account security requirementsthroughout their development, only offering securitytechnical solutions at the implementation stages. Thispaper shows part of a development methodology thatwe are elaborating for the construction of informationsystems based on Grid Computing highly dependent onmobile devices where security plays a very importantrole. Specifically, in this paper, we will present theanalysis phase, managed by reusable use casesthrough which we can define the requirements andneeds of these systems obtaining an analysis modelthat can be used as input to the following phase of themethodology, the design phase of mobile Grid systems.

 

 

PDF icon rosado2009b.pdf (444.47 KB)
D. G. Rosado, E. Fernandez-Medina, and J. Lopez, "A Study of Security Approaches for the Development of Mobile Grid Systems",
5th International Conference on Software and Data Technologies (ICSOFT’10), vol. 1, Springer, pp. 133-138, july, 2010. More..

Abstract

Mobile Grid systems allow us to build highly complex information systems with various and remarkable features (interoperability between multiple security domains, cross-domain authentication and authorization, dynamic, heterogeneous and limited mobile devices, etc), which demand secure development methodologies to build quality software, offering methods, techniques and tools that facilitate the work of the entire team involved in software development. These methodologies should be supported by Grid security architectures that define the main security aspects to be considered, and by solutions to the problem of how to integrate mobile devices within Grid systems. Some approaches regarding secure development methodologies of Grid security architectures and of the integration of mobile devices in the Grid have been found in literature, and these are analyzed and studied in this paper, offering a comparison framework of all the approaches related to security in Mobile Grid environments.

D. G. Rosado, E. Fernandez-Medina, J. Lopez, and M. Piattini, "Engineering Process Based On Grid Use Cases For Mobile Grid Systems",
Third International Conference on Software and Data Technologies (ICSOFT’08), Springer, pp. 146-151, 2008. More..

Abstract

 

The interest to incorporate mobile devices into Grid systems has arisen with two main purposes. The firstone is to enrich users of these devices while the other is that of enriching the own Grid infrastructure.Security of these systems, due to their distributed and open nature, is considered a topic of great interest. Aformal approach to security in the software life cycle is essential to protect corporate resources. However,little attention has been paid to this aspect of software development. Due to its criticality, security should beintegrated as a formal approach into the software life cycle. We are developing a methodology ofdevelopment for secure mobile Grid computing based systems that helps to design and build secure Gridsystems with support for mobile devices directed by use cases and security use cases and focused onservice-oriented security architecture. In this paper, we will present one of the first steps of ourmethodology consisting of analyzing security requirements of mobile grid systems. This analysis will allowus to obtain a set of security requirements that our methodology must cover and implement.

 

 

PDF icon rosado2008a.pdf (813.44 KB)
D. G. Rosado, E. Fernandez-Medina, and J. Lopez, "Hacia una Arquitectura de Servicios de Seguridad para entornos Grid móviles",
V Congreso Iberoamericano de Seguridad Informática (CIBSI’09), Universidad de la República, Uruguay, pp. 409-423, 2009. More..

Abstract

 

Grid móvil incluye las características de los sistemas Grid junto conlas peculiaridades de la computación móvil, añadiendo la propiedad de soportarusuarios y recursos móviles de forma homogénea, transparente, segura yeficiente. La seguridad de estos sistemas, debido a su naturaleza abierta ydistribuida, es un tema de gran interés. Una arquitectura de seguridad basada enSOA proporciona una arquitectura distribuida diseñada para interoperabilidadde servicios, fácil integración, y acceso seguro, simple y extensible. Por tanto,una arquitectura orientada a servicios de seguridad es construida para entornosGrid móviles, ofreciendo servicios de seguridad a usuarios móviles quienesusan servicios Grid y recursos para ejecutar sus trabajos y tareas. Estaarquitectura es integrada con otras arquitecturas existentes proporcionandomayor seguridad y permitiendo que los usuarios móviles puedan acceder aservicios Grid existentes ofreciendo nuevos y necesarios servicios de seguridadpara Grid móviles. Hemos definido un conjunto de servicios de seguridad, quejunto a protocolos, políticas y estándares de seguridad forman una arquitecturade seguridad orientada a servicios para entornos Grid móviles. Esta arquitecturaes abierta, escalable, dinámica, interoperable y flexible.

 

 

PDF icon rosado2009d.pdf (314.97 KB)
D. G. Rosado, E. Fernandez-Medina, J. Lopez, and M. Piattini, "Hacia un Proceso sistemático para el desarrollo de sistemas Grid Seguros con Dispositivos Móviles",
IV Congreso Iberoamericano de Seguridad Informática (CIBSI’07), Sebastián Cañón, M.A., pp. 111-124, 2007.
D. G. Rosado, E. Fernandez-Medina, and J. Lopez, "Applying a UML Extension to build Use Cases diagrams in a secure mobile Grid application",
5th International Workshop on Foundations and Practices of UML, LNCS 5833, Springer Berlin Heidelberg, pp. 126-136, 2009. More..

Abstract

 

Systems based on Grid computing have not traditionally beendeveloped through suitable methodologies and have not taken into accountsecurity requirements throughout their development, offering technical securitysolutions only during the implementation stages. We are creating a developmentmethodology for the construction of information systems based on GridComputing, which is highly dependent on mobile devices, in which securityplays a highly important role. One of the activities in this methodology is therequirements analysis which is use-case driven. In this paper, we build use casediagrams for a real mobile Grid application by using a UML-extension, calledGridUCSec-Profile, through which it is possible to represent specific mobileGrid features and security aspects for use case diagrams, thus obtainingdiagrams for secure mobile Grid environments.

 

 

PDF icon rosado2009f.pdf (249 KB)
D. G. Rosado, E.. Fernandez-Medina, M.. Pattini, and J. Lopez, "Analysis of Secure Mobile Grid Systems: A systematic approach",
XVI Jornadas de Ingeniería del Software y Bases de Datos (JISBD 2011), Servizo de publicacións da Universidade da Coruña, pp. 487-491, 2011. More..

Abstract

Developing software through systematic processes is becoming more and more important due to the growing complexity of software development. It is important that the development process used integrates security aspects from the first stages at the same level as other functional and non-functional requirements. The identification of security aspects in the first stages ensures a more robust development and permits the security requirements to be perfectly coupled with the design and the rest of the system’s requirements. Systems which are based on Grid Computing are a kind of systems that have clear differentiating features in which security is a highly important aspect. Generic development processes are sometimes used to develop Grid specific systems without taking into consideration either the subjacent technological environment or the special features and particularities of these specific systems. In fact, the majority of existing Grid applications have been built without a systematic development process and are based on ad hoc developments.

PDF icon 1642.pdf (44.27 KB)
D. G. Rosado, E. Fernandez-Medina, and J. Lopez, "Reutilización de Casos de Uso en el Desarrollo de Sistemas Grid seguros",
XII Conferencia Iberoamericana de Ingeniería de Requisitos y Ambientes de Software (IDEAS’09), University of Colombia, pp. 388-393, 2009. More..

Abstract

El desarrollo software debe estar basado en un proceso sistemático y estructurado donde se definan los métodos y técnicas a utilizar en todo su ciclo de vida, ayudando así a obtener un producto de calidad. Es igualmente importante que el proceso sistemático considere aspectos de seguridad desde las primeras etapas, integrándola como un elemento más en el ciclo de desarrollo. En este artículo mostramos la metodología de desarrollo sistemático que sirve de guía para el desarrollo de cualquier sistema Grid con dispositivos móviles, considerando la seguridad durante todas las fases de desarrollo, lo que nos permitirá obtener como resultado sistemas Grid seguros, robustos y escalables. Este artículo presenta la fase de análisis, dirigida por casos de uso reutilizables, mediante los cuales se definen los requisitos y necesidades de estos sistemas, y es aplicada a un caso de estudio real de un Grid para el acceso de contenidos multimedia en un contexto periodístico.

 

R. Roman, J. Lopez, and J. Zhou, "Análisis de Seguridad en Redes Inalámbricas de Sensores",
V Jornadas de Ingenería Telemática (JITEL’05), pp. 335-343, Septiembre, 2005. More..

Abstract

The design and development of security infrastructures and protocols for Wireless Sensor Networks is a difficult task, due to several factors like the constraints of the sensor nodes and the public nature of the communication channels. The intrinsic features of these networks create numerous security problems. In this paper, we analyze and put into perspective those problems.

PDF icon R.Roman2005.pdf (233.58 KB)
R. Roman, J. Zhou, and J. Lopez, "Protection Against Spam using Pre-Challenges",
20th IFIP International Information Security Conference (IFIP-SEC’05), R. Sasaki, S. Qing, E. Okamoto, and H. Yoshiura Eds., Springer, pp. 281-294, May, 2005. More..

Abstract

Spam turns out to be an increasingly serious problem to email users. A number of anti-spam schemes have been proposed and deployed, but the problem has yet been well addressed. One of those schemes is challenge-response, in which a challenge is imposed on an email sender. However, such a scheme introduces new problems for the users, e.g., delay of service and denial of service attacks. In this paper, we introduce a pre-challenge scheme that avoids those problems. It assumes each user has a challenge that is defined by the user himself/herself and associated with his/her email address, in such a way that an email sender can simultaneously retrieve a new receiver’s email address and challenge before sending an email in the first contact. Some new mechanisms are employed to reach a good balance between security against spam and convenience to email users.

PDF icon Roman2005d.pdf (174.76 KB)
R. Roman, J. Lopez, C. Alcaraz, and H. Hwa Chen, "SenseKey - Simplifying the Selection of Key Management Schemes for Sensor Networks",
5th International Symposium on Security and Multimodality in Pervasive Environments (SMPE’11), IEEE, March, 2011. DOI More..

Abstract

Key Management Schemes (KMS) are a very important security mechanism for Wireless Sensor Networks (WSN), as they are used to manage the credentials (i.e. secret keys) that are needed by the security primitives. There is a large number of available KMS protocols in the literature, but it is not clear what should network designers do to choose the most suitable protocol for the needs of their applications. In this paper, we consider that given a certain set of application requirements, the network designer can check which properties comply with those requirements and select the KMS protocols that contains those particular properties. Therefore, we study the relationship between requirements and properties, and we provide a web tool, the SenseKey tool, that can be used to automatically obtain an optimal set of KMS protocols.

PDF icon Roman11SK.pdf (143.01 KB)
R. Roman, J. Zhou, and J. Lopez, "Applying Intrusion Detection Systems to Wireless Sensor Networks",
IEEE Consumer Communications & Networking Conference (CCNC 2006), IEEE, pp. 640-644, January, 2006. DOI More..

Abstract

The research of Intrusion Detection Systems (IDS) is a mature area in wired networks, and has also attracted many attentions in wireless ad hoc networks recently. Nevertheless, there is no previous work reported in the literature about IDS architectures in wireless sensor networks. In this paper, we discuss the general guidelines for applying IDS to static sensor networks, and introduce a novel technique to optimally watch over the communications of the sensors’ neighborhood on certain scenarios.

PDF icon Roman2006.pdf (144.74 KB)
R. Roman, J. Zhou, and J. Lopez, "On the Security of Wireless Sensor Networks",
Computational Science and Its Applications (ICCSA’05), LNCS 3482, Springer, pp. 681-690, May, 2005. DOI More..

Abstract

Wireless Sensor Networks are extremely vulnerable against any kind of internal or external attacks, due to several factors such as resource-constrained nodes and lack of tamper-resistant packages. As a result, security must be an important factor to have in mind when designing the infrastructure and protocols of sensor networks. In this paper we survey the state-of-the-art security issues in sensor networks and highlight the open areas of research.security issues in sensor networks and highlight the open areas of research.

PDF icon Roman2005e.pdf (111.92 KB)
R. Roman, J. Lopez, and J. Zhou, "Protección contra el Spam Utilizando Desafíos a Priori",
V Jornadas de Ingeniería Telemática (JITEL’05), pp. 375-382, September, 2005. More..

Abstract

Spam is considered to be one of the biggest problems in messaging systems. In the area of email Spam, A high number of anti-spam schemes have been proposed and deployed, but the problem has yet been well addressed. In this paper, we introduce a new scheme, called pre-challenge scheme, which avoids problems that exists in other schemes such as delay of service and denial of service. Some new mechanisms are employed to reach a good balance between security against Spam and convenience to email users. In addition, our scheme can be used for protecting other types of messaging systems, such as Instant Messaging (IM) and Blogs, against Spam.

PDF icon Roman2005a.pdf (280.64 KB)
R. Roman, and C. Alcaraz, "Applicability of Public Key Infrastructures in Wireless Sensor Networks",
European PKI Workshop: Theory and Practice (EuroPKI’07), LNCS 4582, Springer, pp. 313-320, June, 2007. DOI More..

Abstract

Wireless Sensor Networks (WSN) are becoming a key technology in the support of pervasive and ubiquitous services. The previous notion of PKC is too expensive for WSN has changed partially due to the existence of new hardware and software prototypes based on Elliptic Curve Cryptography and other PKC primitives. Then, it is necessary to analyze whether it is both feasible and convenient to have a Public Key Infrastructure for sensor networks that would allow the creation of PKC-based services like Digital Signatures.

PDF icon Roman2007b.pdf (142.01 KB)
R. Roman, and J. Lopez, "KeyLED - Transmitting Sensitive Data over out-of-band Channels in Wireless Sensor Networks",
5th IEEE International Conference on Mobile Ad Hoc and Sensor Systems (MASS’08), IEEE, pp. 796-801, September, 2008. DOI More..

Abstract

An out-of-band (OoB) channel can be defined as an extra channel, different from the main wireless channel, that has additional security properties. They are specially suitable for protecting spontaneous interactions and exchanging sensitive data between previously unknown devices. Due to the vulnerable nature of wireless sensor networks (WSN), these kind of channels might be useful for protecting certain sensor network operations. In this paper we analyze the applicability of out-of-band channels to wireless sensor networks, and specify why an optical channel should be a good candidate for implementing an extra channel in sensor nodes. Also, we analyze how the existing security threats may affect this type of channel. Finally, the suitability and usability of optical channels for sensor networks is demonstrated by means of a prototype.

PDF icon Roman2008b.pdf (161.47 KB)
R. Roman, J. Lopez, and J. Zhou, "Aplicación de Sistemas de Detección de Intrusiones en Redes de Sensores",
Simposio sobre Computación Ubicua e Inteligencia Ambiental (UCAmI’05), pp. 113-120, September, 2005. More..

Abstract

Los sistemas de detección de intrusiones (IDS) son una herramienta imprescindible de seguridad a la hora de proteger una red. Recientemente se han investigado y desarrollado arquitecturas de IDS para redes inalámbricas, en concreto para redes "Ad Hoc". No obstante, no existe un trabajo previo que desarrolle una arquitectura de IDS para una red de sensores. En este artículo, analizamos porque los sistemas IDS de redes "Ad Hoc" no pueden aplicarse a redes de sensores, e introducimos una arquitectura de IDS para redes de sensores que incorpora una nueva técnica para vigilar las comunicaciones de la red en ciertos escenarios.

PDF icon Roman2005b.pdf (467.35 KB)
R. Roman, J. Lopez, and C. Alcaraz, "Do Wireless Sensor Networks Need to be Completely Integrated into the Internet?",
3rd CompanionAble Workshop - Future Internet of People, Things and Services (IoPTS) eco-Systems, xxxx, pp. xxxx, December, 2009. More..

Abstract

Wireless sensor networks are considered as an integral part of the Internet of Things paradigm. Not only they provide a virtual presence to elements of the real world, but also allow any computationalsystem to know about the physical state of those elements thanks to the use of embedded sensors. In order to belong to the Internet of Things, the elements of a sensor network can implement Internet protocols and services such as the TCP/IP stack and web services. Still, a question that must be raised at this point of time is whether all sensor network applications should be completely integrated into the Internet or not. The purpose of this paper is to analyze this question, reviewing the challenges and security requirements of Internet-enabled sensor networks.

PDF icon roman2009.pdf (106.88 KB)
R. Roman, C. Fernandez-Gago, and J. Lopez, "Featuring Trust and Reputation Management Systems for Constrained Hardware Devices",
1st International Conference on Autonomic Computing and Communication Systems (Autonomics’07), ICST, October, 2007. More..

Abstract

Research on trust management systems for wireless sensor networks is still at a very early stage and few works have done so far. It seems that for those works which deal with the topic general features of how these systems should be are not clearly identified. In this paper we try to identify the main features that a trust management system should have and justify their importance for future developments.

PDF icon Roman2007c.pdf (110.26 KB)
R. Roman, and J. Lopez, "Especificación de Sistemas Electrónicos de Microdonaciones",
III Simposio Español de Comercio Electrónico, pp. 95-104, June, 2005. More..

Abstract

Los sistemas electrónicos de pago permiten que un comprador adquiera a un vendedor una serie de productos y servicios de forma virtual. Sin embargo, estos sistemas no tienen en cuenta el escenario en el que un comprador se convierte en donante, accediendo al servicio de forma gratuita. En este artículo se presenta el concepto y características de las microdonaciones, o la donación de cantidades tan pequeñas como un céntimo de euro en el contexto del comercio electrónico. También se muestra como la microdonación es algo necesario en el contexto actual de Internet, y como es posible su implementación basándose en sistemas de micropago.

PDF icon Roman2005c.pdf (362.76 KB)
R. Rios, J. Cuellar, and J. Lopez, "Ocultación de la estación base en redes inalámbricas de sensores",
XI Jornadas de Ingeniería Telemática (JITEL 2013), J. E. Díaz Verdejo, J. Navarro Ortiz, and J. J. Ramos Muñoz Eds., Asociación de Telemática, pp. 481-486, Oct 2013. More..

Abstract

La estación base es el elemento más importante en un red de sensores y, por tanto, es necesario evitar que un atacante pueda hacerse con el control de este valioso dispositivo. Para ello, el atacante puede valerse tanto de técnicas de análisis de tráfico como de la captura de nodos. En este trabajo presentamos un esquema que consta de dos fases, la primera está dedicada a homogeneizar los patrones de tráfico y la segunda encargada de perturbar las tablas de rutas de los nodos. Ambas fases permiten mantener a la estación base fuera del alcance del atacante con un coste computacional insignificante y un consumo energético moderado. La validez de nuestro esquema ha sido validada analíticamente y a través de numerosas simulaciones.

PDF icon rios2013b.pdf (348.08 KB)
R. Rios, and J. Lopez, "Evolución y nuevos desafios de privacidad en la Internet de las Cosas",
XIV Reunión Española sobre Criptología y Seguridad de la Información, pp. 209-213, 10/2016. More..

Abstract

La Internet de las Cosas (en inglés, Internet of Things (IoT)) es una evolución de la Internet tal y como lo conocemos. Esta nueva versión de Internet incorpora objetos de la vida cotidiana, rompiendo así barrera de los digital y extendiéndose al mundo físico. Estos objetos interactuarán entre sí y con otras entidades tanto de manera local como remota, y estarán dotados de cierta capacidad computacional y sensores para que sean conscientes de lo que ocurre en su entorno. Esto traerá consigo un sinfín de posibilidades y nuevos servicios, pero también dará lugar a nuevos y mayores riesgos de privacidad para los ciudadanos. En este artículo, estudiamos los problemas de privacidad actuales de una de las tecnologías claves para el desarrollo de este prometedor paradigma, las redes de sensores, y analizamos como pueden evolucionar y surgir nuevos riesgos de privacidad al ser completamente integradas en la Internet.

 

PDF icon Rios2016a.pdf (263.7 KB)
R. Rios, J. A. Onieva, and J. Lopez, "HIDE_DHCP: Covert Communications Through Network Configuration Messages",
Proceedings of the 27th IFIP TC 11 International Information Security and Privacy Conference (SEC 2012), D. Gritzalis, S. Furnell, and M. Theoharidou Eds., IFIP AICT 376, Springer Boston, pp. 162-173, June 2012. DOI More..

Abstract

Covert channels are a form of hidden communication that may violate the integrity of systems. Since their birth in multilevel security systems in the early 70’s they have evolved considerably, such that new solutions have appeared for computer networks mainly due to vague protocols specifications. We analyze a protocol extensively used today, the Dynamic Host Configuration Protocol (DHCP), in search of new forms of covert communication. From this analysis we observe several features that can be effectively exploited for subliminal data transmission. This results in the implementation of HIDE_DHCP, which integrates three covert channels that accommodate to different stealthiness and bandwidth requirements

PDF icon Rios2012.pdf (400 KB)
R. Rios, R. Roman, J. A. Onieva, and J. Lopez, "From Smog to Fog: A Security Perspective",
2nd IEEE International Conference on Fog and Edge Mobile Computing (FMEC 2017), IEEE Computer Society, pp. 56-61, 06/2017. DOI More..

Abstract

Cloud computing has some major limitations that hinder its application to some specific scenarios (e.g., Industrial IoT, and remote surgery) where there are particularly stringent requirements, such as extremely low latency. Fog computing is a specialization of the Cloud that promises to overcome the aforementioned limitations by bringing the Cloud closer to end-users. Despite its potential benefits, Fog Computing is still a developing paradigm which demands further research, especially on security and privacy aspects. This is precisely the focus of this paper: to make evident the urgent need for security mechanisms in Fog computing, as well as to present a research strategy with the necessary steps and processes that are being undertaken within the scope of the SMOG project, in order to enable a trustworthy and resilient Fog ecosystem.

PDF icon Ruben2017smog.pdf (486.34 KB)
R. Rios, and J. Lopez, "Source Location Privacy Considerations in Wireless Sensor Networks",
4th International Symposium of Ubiquitous Computing and Ambient Intelligence (UCAmI’10), L. Fuentes, N. Gámez, and J. Bravo Eds., IBERGARCETA PUBLICACIONES, S.L., pp. 29 - 38, Sept., 2010. More..

Abstract

Wireless Sensor Networks are considered to be one of the cornerstones of Ambient Intelligence since they can be used in countless applications, where sensors are unobtrusively embedded into the environment to perform operations like monitoring, tracking and reporting. In such scenarios, privacy issues must be carefully considered since the mere observation of the network operation might reveal great amounts of private information to unauthorised parties. One of the problems that is gaining more attention in the realm of privacy, is the location privacy problem, which aims to prevent an attacker from obtaining the location of specific nodes of interest to him. In this paper we provide a general overview of the proposed solutions to counter this threat. Finally, we will also discuss some open challenges and future directions of research for a convenient management of privacy issues in smart environments.

PDF icon Rios2010.pdf (352.58 KB)
R. Rios, and J. A. Onieva, "Clasificación de canales encubiertos. Un nuevo canal: Covert_DHCP",
X Reunión Española de Criptología y Seguridad de la Información (RECSI’08), L. Hernández Encinas, and A. Martin del Rey Eds., pp. 325-336, Sept., 2008. More..

Abstract

Los canales encubiertos son una forma de comunicación oculta que puede vulnerar la integridad de los sistemas. Desde sus inicios en sistemas de seguridad multinivel a principios de los años 70 han evolucionado considerablemente, apareciendo soluciones para redes de computadores debido a la especificación de algunos protocolos. Por este motivo, se hace un estudio sobre las técnicas que se han utilizado para crear los canales, así como sobre las distintos obstáculos que han tratado de mermar su actividad. Asimismo, se presenta una nueva clasificación que trata de albergar la mayor cantidad de canales encubiertos existentes en la actualidad. Por último, se analiza un protocolo ampliamente extendido en la actualidad, DHCP, en busca de posibilidades de albergar información encubierta. A partir de este análisis se implementan distintas versiones de un canal encubierto haciendo uso de este protocolo.

PDF icon Rios2008.pdf (397.05 KB)
R. Rios, J. Cuellar, and J. Lopez, "Robust Probabilistic Fake Packet Injection for Receiver-Location Privacy in WSN",
17th European Symposium on Research in Computer Security (ESORICS 2012), S. Foresti, M. Yung, and F. Martinelli Eds., LNCS 7459, Springer, pp. 163-180, Sep 2012. DOI More..

Abstract

The singular communication model in wireless sensor networks (WSNs) originate pronounced traffic patterns that allow a local observer to deduce the location of the base station, which must be kept secret for both strategical and security reasons. In this work we present a new receiver-location privacy solution called HISP (Homogenous Injection for Sink Privacy). Our scheme is based on the idea of hiding the flow of real traffic by carefully injecting fake traffic to homogenize the transmissions from a node to its neighbors. This process is guided by a lightweight probabilistic approach ensuring that the adversary cannot decide with sufficient precision in which direction to move while maintaining a moderate amount of fake traffic. Our system is both validated analytically and experimentally through simulations.

PDF icon Rios2012d.pdf (524.61 KB)
R. Rios, D. Nuñez, and J. Lopez, "Query Privacy in Sensing-as-a-Service Platforms",
32nd International Conference on ICT Systems Security and Privacy Protection (IFIP SEC 2017), S. De Capitan di Vimercati, and F. Martinelli Eds., IFIP Advances in Information and Communication Technology (AICT) 502, Springer, pp. 141–154, 05/2017. DOI More..

Abstract

The Internet of Things (IoT) promises to revolutionize the way we interact with the physical world. Even though this paradigm is still far from being completely realized, there already exist Sensing-as-a-Service (S2aaS) platforms that allow users to query for IoT data. While this model offers tremendous benefits, it also entails increasingly challenging privacy issues. In this paper, we concentrate on the protection of user privacy when querying sensing devices through a semi-trusted S2aaS platform. In particular, we build on techniques inspired by proxy re-encryption and k-anonymity to tackle two intertwined problems, namely query privacy and query confidentiality. The feasibility of our solution is validated both analytically and empirically. 

PDF icon Rios2017query.pdf (367.05 KB)
R. Rios, I. Agudo, and J. L. Gonzalez, "Implementación de un esquema de localización privada y segura para interiores",
IX Jornadas de Ingeniería Telemática (JITEL’10), Y. Dimitriadis, and M. Jesús Ver Pérez Eds., pp. 237 - 244, Sept., 2010. More..

Abstract

Las aplicaciones basadas en localización proporcionan a los usuarios servicios personalizados dependiendo de su ubicación. Las estimaciones prevén que estos servicios se extenderán enormemente en los próximos años reportando grandes beneficios tanto a la industria como a los usuarios finales. Sin embargo, para que estos avances sean posibles se hace necesario analizar en profundidad las distintas implicaciones de seguridad y privacidad que la utilización de tales servicios pueden traer consigo a los usuarios. En este trabajo proponemos un sistema de localización que da soporte a la provisión de servicios basados en localización para entornos indoor y que se fundamenta en la tecnología de redes de sensores inalámbricos. En este esquema hemos tenido en cuenta diversos aspectos de seguridad y privacidad, prestando especial atención a la limitación extrema de recursos característica de las redes de sensores. Finalmente hemos desarrollado una prueba de concepto para comprobar la viabilidad de nuestro esquema dentro del ámbito del proyecto OSAmI.

PDF icon Rios2010a.pdf (311.53 KB)
R. Rios, and J. Lopez, "Adecuación de soluciones de anonimato al problema de la privacidad de localización en WSN",
XII Reunión Española sobre Criptología y Seguridad de la Información (RECSI 2012), U.. Zurutuza, R.. Uribeetxeberria, and I.. Arenaza-Nuño Eds., pp. 309-314, Sep 2012. More..

Abstract

Los patrones de tráfico característicos de las redes inalámbricas de sensores (WSNs) dan lugar al problema de la privacidad de localización. De manera similar, el tráfico de los usuarios en Internet revela información sensible que puede ser protegida mediante sistemas de comunicación anónima (ACS). Por ello, este trabajo analiza la posibilidad de adaptar las soluciones de anonimato tradicionales al problema particular de las redes de sensores. Hasta el momento estas soluciones habían sido rechazadas sin un análisis riguroso, argumentando simplemente que eran demasiado exigentes computacionalmente para los nodos sensores. Nuestros resultados demuestran que, en general, algunos ACS no cumplen los requisitos de privacidad necesarios en WSNs mientras que otros, que si los cumplen, se valen de una cantidad de recursos que superan la capacidad de los sensores.

PDF icon Rios2012b.pdf (156.9 KB)
R. Rios, C. Fernandez-Gago, and J. Lopez, "Privacy-Aware Trust Negotiation",
12th International Workshop on Security and Trust Management (STM), vol. LNCS 9871, Springer, pp. 98-105, 09/2016. DOI More..

Abstract

Software engineering and information security have traditionally followed divergent paths but lately some efforts have been made to consider security from the early phases of the Software Development Life Cycle (SDLC). This paper follows this line and concentrates on the incorporation of trust negotiations during the requirements engineering phase. More precisely, we provide an extension to the SI* modelling language, which is further formalised using answer set programming specifications to support the automatic verification of the model and the detection of privacy conflicts caused by trust negotiations.

PDF icon rios2016b.pdf (237.78 KB)
G. Ramos, and J. Lopez, "ID3f+A. Algoritmo de Aprendizaje Inductivo Borroso con División Intervalar Automática de los Atributos",
VI Congreso Español Sobre Tecnologías y Lógica Fuzzy (ESTYLF’96), pp. 225-230, Septiembre, 1996. More..

Abstract

Uno de los campos más prometedores dentro del estudio de la ambigüedad es el del aprendizaje, tanto por su importancia consusntacial como por su relación con la Inteligencia Artificial. Esta relación se hace evidente cuando intentamos resolver, desde una perspectiva borrosa, el problema de la adquisición automática del conocimiento en sistemas expertos. El algoritmo ID3, el más relevante de los utilizados para la inducción de árboles de decisión, no es utilizable tal cual con un concepto borroso del concepto de pertenencia. Además se muestra ineficiente cuando no existe un experto humano que defina correctamente los subrangos de actuación para los atributos que junto a las clases expresan las relaciones entre situaciones que este algoritmo de aprendizaje intenta descubrir. Proponemos como solución un nuevo algoritmo, el ID3f+A, que posee la capacidad de tratamiento borroso del concepto de pertenencia, gracias a una modificación del concepto de entropía, y además realiza la división intervalar automática de los atributos, merced al control del proceso inductivo por medio de la utilización de experiencias de control.

PDF icon GonzaloRamos1996.pdf (425.41 KB)