@article {MUNOZ2023103180, title = {A survey on the (in)security of Trusted Execution Environments}, journal = {Computers \& Security}, year = {2023}, pages = {103-180}, publisher = {Elsevier}, address = {In Press}, abstract = {

As the number of security and privacy attacks continue to grow around the world, there is an ever increasing need to protect our personal devices. As a matter of fact, more and more manufactures are relying on Trusted Execution Environments (TEEs) to shield their devices. In particular, ARM TrustZone (TZ) is being widely used in numerous embedded devices, especially smartphones, and this technology is the basis for secure solutions both in industry and academia. However, as shown in this paper, TEE is not bullet-proof and it has been successfully attacked numerous times and in very different ways. To raise awareness among potential stakeholders interested in this technology, this paper provides an extensive analysis and categorization of existing vulnerabilities in TEEs and highlights the design flaws that led to them. The presented vulnerabilities, which are not only extracted from existing literature but also from publicly available exploits and databases, are accompanied by some effective countermeasures to reduce the likelihood of new attacks. The paper ends with some appealing challenges and open issues.

}, keywords = {Computer security, Hardware attacks, Secure hardware, Side-channel attacks, Software attacks, Trusted Execution Environments}, issn = {0167-4048}, doi = {https://doi.org/10.1016/j.cose.2023.103180}, url = {https://www.sciencedirect.com/science/article/pii/S0167404823000901}, author = {Mu{\~n}oz, Antonio and Ruben Rios and Rodrigo Roman and Javier Lopez} } @inproceedings {2016, title = {AndroCIES: Automatizaci{\'o}n de la certificaci{\'o}n de seguridad para aplicaciones Android}, booktitle = {XVII Reuni{\'o}n Espa{\~n}ola sobre Criptolog{\'\i}a y Seguridad de la Informaci{\'o}n (RECSI 2022)}, volume = {265}, year = {2022}, month = {10/2022}, pages = {192-197}, publisher = {Ediciones Universidad Cantabria}, organization = {Ediciones Universidad Cantabria}, address = {Santander, Spain}, abstract = {

El auge de las plataformas m{\'o}viles est{\'a} impulsando el desarrollo de un gran n{\'u}mero de aplicaciones, muchas de las cuales salen al mercado sin las convenientes comprobaciones de seguridad. Recientemente, Google est{\'a} apostando por hacer este problema m{\'a}s visible y concienciar a los usuarios de la necesidad de instalar aplicaciones verificadas por laboratorios independientes. Sin embargo, la certificaci{\'o}n de aplicaciones suele ser una tarea ardua y no exenta de errores. Por ello, en este trabajo, presentamos la herramienta AndroCIES, que es capaz de automatizar en gran medida las evaluaciones necesarias para la certificaci{\'o}n de aplicaciones m{\'o}viles, reduciendo en torno a un 20\% el tiempo empleado en este proceso.

}, keywords = {an{\'a}lisis est{\'a}tico, aplicaciones, certificaci{\'o}n, seguridad}, author = {Manuel Ruiz and Ruben Rios and Rodrigo Roman and Mu{\~n}oz, Antonio and Juan Manuel Mart{\'\i}nez and Jorge Wallace} } @article {rios2022cpa, title = {Constrained Proximity Attacks on Mobile Targets}, journal = {ACM Transactions on Privacy and Security (TOPS)}, volume = {25}, number = {10}, year = {2022}, month = {05/2022}, pages = {1 - 29}, publisher = {Association for Computer Machinery (ACM)}, abstract = {

Proximity attacks allow an adversary to uncover the location of a victim by repeatedly issuing queries with fake location data. These attacks have been mostly studied in scenarios where victims remain static and there are no constraints that limit the actions of the attacker. In such a setting, it is not difficult for the attacker to locate a particular victim and quantifying the effort for doing so is straightforward. However, it is far more realistic to consider scenarios where potential victims present a particular mobility pattern. In this paper, we consider abstract (constrained and unconstrained) attacks on services that provide location information on other users in the proximity. We derive strategies for constrained and unconstrained attackers, and show that when unconstrained they can practically achieve success with theoretically optimal effort. We then propose a simple yet effective constraint that may be employed by a proximity service (for example, running in the cloud or using a suitable two-party protocol) as countermeasure to increase the effort for the attacker several orders of magnitude both in simulated and real-world cases.

}, keywords = {Location Privacy, mobility pattern, proximity attacks, quantification}, issn = {2471-2566}, doi = {10.1145/3498543}, author = {Xueou Wang and Xiaolu Hou and Ruben Rios and Nils Ole Tippenhauer and Martin Ochoa} } @article {rios2022pmec, title = {Personal IoT Privacy Control at the Edge}, journal = {IEEE Security \& Privacy }, volume = {20}, year = {2022}, month = {01/2022}, pages = {23 - 32}, publisher = {IEEE}, abstract = {

This article introduces a privacy manager for IoT data based on Edge Computing. This poses the advantage that privacy is enforced before data leaves the control of the user, who is provided with a tool to express data sharing preferences based on a novel context-aware privacy language.

}, issn = {1540-7993}, doi = {10.1109/MSEC.2021.3101865}, author = {Ruben Rios and Jose A. Onieva and Rodrigo Roman and Javier Lopez} } @inproceedings {1979, title = {Privacidad Contextual en entornos Edge}, booktitle = {VII Jornadas Nacionales de Investigaci{\'o}n en Ciberseguridad (JNIC 2022)}, year = {2022}, month = {06/2022}, pages = {122-129}, address = {Bilbao, Spain}, abstract = {

La privacidad contextual se refiere a la protecci{\'o}n de toda aquella informaci{\'o}n que puede desprenderse de la interacci{\'o}n entre usuarios y/o servicios, exceptuando los datos que el propio usuario elige transmitir. La localizaci{\'o}n, el tiempo, los patrones de uso y los diferentes par{\'a}metros necesarios para realizar la comunicaci{\'o}n son algunos ejemplos. Este tipo de privacidad es extremadamente importante en la computaci{\'o}n edge debido al acercamiento de los recursos de la infraestructura a los usuarios. Por ello, el objetivo de este trabajo es ofrecer un an{\'a}lisis y clasificaci{\'o}n de las diferentes soluciones propuestas en la literatura respecto a la privacidad contextual en entornos edge, mostrando tanto las capacidades de los mecanismos actuales como los desaf{\'\i}os en este campo.

}, keywords = {Computaci{\'o}n edge, Privacidad, Privacidad contextual}, isbn = {978-84-88734-13-6 }, author = {Manuel Ruiz and Ruben Rios and Rodrigo Roman and Javier Lopez} } @inproceedings {1846, title = {Distributed Detection of APTs: Consensus vs. Clustering}, booktitle = {25th European Symposium on Research in Computer Security (ESORICS 2020)}, volume = {12308}, year = {2020}, month = {09/2020}, pages = {174-192}, keywords = {Advanced Persistent Threat, clustering, consensus, distributed detection, Opinion Dynamics, Traceability}, isbn = {978-3-030-58951-6}, doi = {https://doi.org/10.1007/978-3-030-58951-6_9}, author = {Juan E. Rubio and Cristina Alcaraz and Ruben Rios and Rodrigo Roman and Javier Lopez} } @article {HFNR2019, title = {Cybersecurity Profiles based on Human-Centric IoT Devices}, journal = {Human-centric Computing and Information Sciences}, volume = {9}, number = {1}, year = {2019}, pages = {1-23}, publisher = {Springer}, issn = {2192-1962}, doi = {10.1186/s13673-019-0200-y}, author = {Ana Nieto and Ruben Rios} } @article {onieva2019vec, title = {Edge-Assisted Vehicular Networks Security}, journal = {IEEE Internet of Things Journal}, volume = {6}, year = {2019}, month = {10/2019}, pages = {8038-8045}, publisher = {IEEE Computer Society}, abstract = {

Edge Computing paradigms are expected to solve some major problems affecting current application scenarios that rely on Cloud computing resources to operate. These novel paradigms will bring computational resources closer to the users and by doing so they will not only reduce network latency and bandwidth utilization but will also introduce some attractive context-awareness features to these systems. In this paper we show how the enticing features introduced by Edge Computing paradigms can be exploited to improve security and privacy in the critical scenario of vehicular networks (VN), especially existing authentication and revocation issues. In particular, we analyze the security challenges in VN and describe three deployment models for vehicular edge computing, which refrain from using vehicular- to-vehicular communications. The result is that the burden imposed to vehicles is considerably reduced without sacrificing the security or functional features expected in vehicular scenarios.

}, keywords = {Critical Infrastructures, Internet of Things, privacy, security, Vehicular Networks}, issn = {2327-4662}, doi = {10.1109/JIOT.2019.2904323}, author = {Jose A. Onieva and Ruben Rios and Rodrigo Roman and Javier Lopez} } @article {roman2018VIS, title = {Immune System for the Internet of Things using Edge Technologies}, journal = {IEEE Internet of Things Journal}, volume = {6}, year = {2019}, month = {06/2019}, pages = {4774-4781}, publisher = {IEEE Computer Society}, abstract = {

The Internet of Things (IoT) and Edge Computing are starting to go hand in hand. By providing cloud services close to end-users, edge paradigms enhance the functionality of IoT deployments, and facilitate the creation of novel services such as augmented systems. Furthermore, the very nature of these paradigms also enables the creation of a proactive defense architecture, an immune system, which allows authorized immune cells (e.g., virtual machines) to traverse edge nodes and analyze the security and consistency of the underlying IoT infrastructure. In this article, we analyze the requirements for the development of an immune system for the IoT, and propose a security architecture that satisfies these requirements. We also describe how such a system can be instantiated in Edge Computing infrastructures using existing technologies. Finally, we explore the potential application of immune systems to other scenarios and purposes.

}, keywords = {Edge computing, Immune Systems, Internet of Things, security}, issn = {2327-4662}, doi = {10.1109/JIOT.2018.2867613}, url = {https://ieeexplore.ieee.org/document/8449989/}, author = {Rodrigo Roman and Ruben Rios and Jose A. Onieva and Javier Lopez} } @inproceedings {1835, title = {Personalized Computer Security Tasks with Automatic Evaluation and Feedback}, booktitle = {International Conference on Information Systems Education and Research (AIS SIGED 2019)}, year = {2019}, month = {12/2019}, keywords = {autonomy, evaluation, feedback, learn by doing, Moodle, self-learning}, isbn = {978-1-7343123-0-0}, author = {Isaac Agudo and Ruben Rios and Ana Nieto} } @incollection {1777, title = {Privacy-Aware Digital Forensics}, booktitle = {Security and Privacy for Big Data, Cloud Computing and Applications}, year = {2019}, month = {09/2019}, publisher = {The Institution of Engineering and Technology (IET) }, organization = {The Institution of Engineering and Technology (IET) }, edition = {Lizhe Wang, Wei Ren, Raymoond Choo and Fatos Xhafa}, address = {United Kingdom}, isbn = {978-1-78561-747-8}, url = {https://www.amazon.es/Security-Privacy-Computing-Applications-Networks/dp/1785617478}, author = {Ana Nieto and Ruben Rios and Javier Lopez} } @proceedings {rios2018dpm, title = {Data Privacy Management, Cryptocurrencies and Blockchain Technology}, volume = {11025}, year = {2018}, publisher = {Springer International Publishing}, edition = {LNCS}, address = {Barcelona, Spain}, abstract = {

ESORICS 2018 International Workshops, DPM 2018 and CBT 2018, Barcelona, Spain, September 6-7, 2018, Proceedings

}, isbn = {978-3-030-00305-0}, doi = {10.1007/978-3-030-00305-0}, author = {Joaquin Garcia-Alfaro and Jordi Herrera-Joancomarti and Giovanni Livraga and Ruben Rios} } @article {nrlSensors2018, title = {IoT-Forensics meets Privacy: Towards Cooperative Digital Investigations}, journal = {Sensors}, volume = {18}, number = {492}, year = {2018}, month = {02/2018}, publisher = {MDPI}, abstract = {
IoT-Forensics is a novel paradigm for the acquisition of electronic evidence whose operation is conditioned by the peculiarities of the Internet of Things (IoT) context. As a branch of computer forensics, this discipline respects the most basic forensic principles of preservation, traceability, documentation, and authorization. The digital witness approach also promotes such principles in the context of the IoT while allowing personal devices to cooperate in digital investigations by voluntarily providing electronic evidence to the authorities. However, this solution is highly dependent on the willingness of citizens to collaborate and they may be reluctant to do so if the sensitive information within their personal devices is not sufficiently protected when shared with the investigators. In this paper, we provide the digital witness approach with a methodology that enables citizens to share their data with some privacy guarantees. We apply the PRoFIT methodology, originally defined for IoT-Forensics environments, to the digital witness approach in order to unleash its full potential. Finally, we show the feasibility of a PRoFIT-compliant digital witness with two use cases.
}, keywords = {digital witness, IoT-Forensics, privacy}, issn = {1424-8220}, doi = {10.3390/s18020492}, url = {http://www.mdpi.com/1424-8220/18/2/492}, author = {Ana Nieto and Ruben Rios and Javier Lopez} } @inproceedings {rios2018mob, title = {Location Proximity Attacks against Mobile Targets: Analytical Bounds and Attacker Strategies}, booktitle = {23rd European Symposium on Research in Computer Security (ESORICS 2018)}, series = {LNCS}, volume = {11099}, year = {2018}, pages = {373-392}, publisher = {Springer}, organization = {Springer}, address = {Barcelona}, abstract = {

Location privacy has mostly focused on scenarios where users remain static. However, investigating scenarios where the victims present a particular mobility pattern is more realistic. In this paper, we consider abstract attacks on services that provide location information on other users in the proximity. In that setting, we quantify the required effort of the attacker to localize a particular mobile victim. We prove upper and lower bounds for the effort of an optimal attacker. We experimentally show that a Linear Jump Strategy\ (LJS) practically achieves the upper bounds for almost uniform initial distributions of victims. To improve performance for less uniform distributions known to the attacker, we propose a Greedy Updating Attack Strategy\ (GUAS). Finally, we derive a realistic mobility model from a real-world dataset and discuss the performance of our strategies in that setting.

}, isbn = {978-3-319-98988-4}, doi = {10.1007/978-3-319-98989-1}, author = {Xueou Wang and Xiaolu Hou and Ruben Rios and Per Hallgren and Nils Ole Tippenhauer and Martin Ochoa} } @article {Ruben2017trust, title = {Modelling Privacy-Aware Trust Negotiations}, journal = {Computers \& Security}, volume = {77 }, year = {2018}, pages = {773-789}, publisher = {Elsevier}, abstract = {

Trust negotiations are mechanisms that enable interaction between previously unknown users. After exchanging various pieces of potentially sensitive information, the participants of a negotiation can decide whether or not to trust one another. Therefore, trust negotiations bring about threats to personal privacy if not carefully considered. This paper presents a framework for representing trust negotiations in the early phases of the Software Development Life Cycle (SDLC). The framework can help software engineers to determine the most suitable policies for the system by detecting conflicts between privacy and trust requirements. More precisely, we extend the SI* modelling language and provide a set of predicates for defining trust and privacy policies and a set of rules for describing the dynamics of the system based on the established policies. The formal representation of the model facilitates its automatic verification. The framework has been validated in a distributed social network scenario for connecting drivers with potential passengers willing to share a journey.

}, keywords = {Goal-Oriented Modelling, Policy, privacy, Requirements Engineering, Secure Software Engineering, Trust}, issn = {0167-4048}, doi = {10.1016/j.cose.2017.09.015}, author = {Ruben Rios and Carmen Fernandez-Gago and Javier Lopez} } @inproceedings {1654, title = {Digital Witness and Privacy in IoT: Anonymous Witnessing Approach}, booktitle = {16th IEEE International Conference On Trust, Security And Privacy In Computing And Communications (TrustCom 2017)}, year = {2017}, month = {08/2017}, pages = {642-649}, publisher = {IEEE}, organization = {IEEE}, address = {Sydney (Australia)}, abstract = {

The digital witness approach defines the collaboration between IoT devices - from wearables to vehicles - to provide digital evidence through a Digital Chain of Custody to an authorised entity. As one of the cores of the digital witness, binding credentials unequivocally identify the user behind the digital witness. The objective of this article is to perform a critical analysis of the digital witness approach from the perspective of privacy, and to propose solutions that help include some notions of privacy in the scheme (for those cases where it is possible). In addition, digital anonymous witnessing as a tradeoff mechanism between the original approach and privacy requirements is proposed. This is a clear challenge in this context given the restriction that the identities of the links in the digital chain of custody should be known.\ 

}, keywords = {Forensics, IEC Standards, ISO Standards, privacy}, isbn = {978-1-5090-4906-6}, issn = {2324-9013}, doi = {10.1109/Trustcom/BigDataSE/ICESS.2017.295}, author = {Ana Nieto and Ruben Rios and Javier Lopez} } @article {Lopez2017iotpriv, title = {Evolving privacy: From sensors to the Internet of Things}, journal = {Future Generation Computer Systems}, volume = {75}, year = {2017}, month = {10/2017}, pages = {46{\textendash}57}, publisher = {Elsevier}, abstract = {

The Internet of Things (IoT) envisions a world covered with billions of smart, interacting things capable of offering all sorts of services to near and remote entities. The benefits and comfort that the IoT will bring about are undeniable, however, these may come at the cost of an unprecedented loss of privacy. In this paper we look at the privacy problems of one of the key enablers of the IoT, namely wireless sensor networks, and analyse how these problems may evolve with the development of this complex paradigm. We also identify further challenges which are not directly associated with already existing privacy risks but will certainly have a major impact in our lives if not taken into serious consideration.\ 

}, keywords = {Challenges, Internet of Things, privacy, WSN}, issn = {0167-739X}, doi = {10.1016/j.future.2017.04.045}, author = {Javier Lopez and Ruben Rios and Feng Bao and Guilin Wang} } @inproceedings {Ruben2017smog, title = {From Smog to Fog: A Security Perspective}, booktitle = {2nd IEEE International Conference on Fog and Edge Mobile Computing (FMEC 2017)}, year = {2017}, month = {06/2017}, pages = {56-61}, publisher = {IEEE Computer Society}, organization = {IEEE Computer Society}, address = {Valencia, Spain. 8-11 May 2017}, abstract = {

Cloud computing has some major limitations that hinder its application to some specific scenarios (e.g., Industrial IoT, and remote surgery) where there are particularly stringent requirements, such as extremely low latency. Fog computing is a specialization of the Cloud that promises to overcome the aforementioned limitations by bringing the Cloud closer to end-users. Despite its potential benefits, Fog Computing is still a developing paradigm which demands further research, especially on security and privacy aspects. This is precisely the focus of this paper: to make evident the urgent need for security mechanisms in Fog computing, as well as to present a research strategy with the necessary steps and processes that are being undertaken within the scope of the SMOG project, in order to enable a trustworthy and resilient Fog ecosystem.

}, isbn = {978-1-5386-2859-1}, doi = {10.1109/FMEC.2017.7946408}, author = {Ruben Rios and Rodrigo Roman and Jose A. Onieva and Javier Lopez} } @inproceedings {1652, title = {A Methodology for Privacy-Aware IoT-Forensics}, booktitle = {16th IEEE International Conference On Trust, Security And Privacy In Computing And Communications (TrustCom 2017)}, year = {2017}, month = {08/2017}, pages = {626-633}, publisher = {IEEE}, organization = {IEEE}, address = {Sydney (Australia)}, abstract = {

The Internet of Things (IoT) brings new challenges to digital forensics. Given the number and heterogeneity of devices in such scenarios, it bring extremely difficult to carry out investigations without the cooperation of individuals. Even if they are not directly involved in the offense, their devices can yield digital evidence that might provide useful clarification in an investigation. However, when providing such evidence they may leak sensitive personal information. This paper proposes PRoFIT; a new model for IoT-forensics that takes privacy into consideration by incorporating the requirements of ISO/IEC 29100:2011 throughout the investigation life cycle. PRoFIT is intended to lay the groundwork for the voluntary cooperation of individuals in cyber crime investigations.

}, keywords = {Adaptation models, Forensics, IEC Standards, Information management, ISO Standards, privacy, Software}, isbn = {978-1-5090-4906-6}, issn = {2324-9013}, doi = {10.1109/Trustcom/BigDataSE/ICESS.2017.293}, author = {Ana Nieto and Ruben Rios and Javier Lopez} } @inproceedings {1655, title = {PRoFIT: modelo forense-IoT con integraci{\'o}n de requisitos de privacidad}, booktitle = {XIII Jornadas de Ingenier{\'\i}a Telem{\'a}tica (JITEL 2017)}, volume = {Libro de actas}, year = {2017}, month = {01/2018}, pages = {302-309}, publisher = {Editorial Universitat Polit{\`e}cnica de Val{\`e}ncia}, organization = {Editorial Universitat Polit{\`e}cnica de Val{\`e}ncia}, address = {Valencia}, isbn = {978-84-9048-595-8}, doi = {http://dx.doi.org/10.4995/JITEL2017.2017.7061}, url = {http://jlloret.webs.upv.es/jitel2017/files/ACTASJITEL2017.pdf}, author = {Ana Nieto and Ruben Rios and Javier Lopez} } @inproceedings {Rios2017query, title = {Query Privacy in Sensing-as-a-Service Platforms}, booktitle = {32nd International Conference on ICT Systems Security and Privacy Protection (IFIP SEC 2017)}, series = {IFIP Advances in Information and Communication Technology (AICT)}, volume = {502}, year = {2017}, month = {05/2017}, pages = {141{\textendash}154}, publisher = {Springer}, organization = {Springer}, address = {Roma, Italy}, abstract = {

The Internet of Things (IoT) promises to revolutionize the way we interact with the physical world. Even though this paradigm is still far from being completely realized, there already exist Sensing-as-a-Service (S2aaS) platforms that allow users to query for IoT data. While this model offers tremendous benefits, it also entails increasingly challenging privacy issues. In this paper, we concentrate on the protection of user privacy when querying sensing devices through a semi-trusted S2aaS platform. In particular, we build on techniques inspired by proxy re-encryption and k-anonymity to tackle two intertwined problems, namely query privacy and query confidentiality. The feasibility of our solution is validated both analytically and empirically.\ 

}, doi = {10.1007/978-3-319-58469-0_10}, author = {Ruben Rios and David Nu{\~n}ez and Javier Lopez}, editor = {Sabrina De Capitani di Vimercati and Fabio Martinelli} } @inproceedings {1648, title = {Requisitos y soluciones de privacidad para la testificaci{\'o}n digital}, booktitle = {III Jornadas Nacionales de Investigaci{\'o}n en Ciberseguridad (JNIC 2017)}, volume = {Actas del JNIC 2017}, year = {2017}, pages = {51-58}, publisher = { Servicio de Publicaciones de la URJC}, organization = { Servicio de Publicaciones de la URJC}, address = {Madrid (Spain)}, isbn = {978-84-608-4659-8}, url = {https://eciencia.urjc.es/handle/10115/14540}, author = {Ana Nieto and Ruben Rios} } @inproceedings {Rios2016a, title = {Evoluci{\'o}n y nuevos desafios de privacidad en la Internet de las Cosas}, booktitle = {XIV Reuni{\'o}n Espa{\~n}ola sobre Criptolog{\'\i}a y Seguridad de la Informaci{\'o}n}, year = {2016}, month = {10/2016}, pages = {209-213}, address = {Mah{\'o}n, Menorca, Islas Baleares}, abstract = {

La Internet de las Cosas (en ingl{\'e}s, Internet of Things\ (IoT)) es una evoluci{\'o}n de la Internet tal y como lo conocemos. Esta nueva versi{\'o}n de Internet incorpora objetos de la vida cotidiana, rompiendo as{\'\i} barrera de los digital y extendi{\'e}ndose al mundo f{\'\i}sico. Estos objetos interactuar{\'a}n entre s{\'\i} y con otras entidades tanto de manera local como remota, y estar{\'a}n dotados de cierta capacidad computacional y sensores para que sean conscientes de lo que ocurre en su entorno. Esto traer{\'a} consigo un sinf{\'\i}n de posibilidades y nuevos servicios, pero tambi{\'e}n dar{\'a} lugar a nuevos y mayores riesgos de privacidad para los ciudadanos. En este art{\'\i}culo, estudiamos los problemas de privacidad actuales de una de las tecnolog{\'\i}as claves para el desarrollo de este prometedor paradigma, las redes de sensores, y analizamos como pueden evolucionar y surgir nuevos riesgos de privacidad al ser completamente integradas en la Internet.

}, keywords = {Challenges, Internet of Things, privacy, Sensors}, author = {Ruben Rios and Javier Lopez} } @book {Rios2016, title = {Location Privacy in Wireless Sensor Networks}, series = {CRC Series in Security, Privacy and Trust}, year = {2016}, publisher = {Taylor \& Francis}, organization = {Taylor \& Francis}, isbn = {9781498776332}, url = {https://www.crcpress.com/Location-Privacy-in-Wireless-Sensor-Networks/Rios-Lopez-Cuellar/p/book/9781498776332}, author = {Ruben Rios and Javier Lopez and Jorge Cuellar} } @inproceedings {rios2016b, title = {Privacy-Aware Trust Negotiation}, booktitle = {12th International Workshop on Security and Trust Management (STM)}, volume = {LNCS 9871}, year = {2016}, month = {09/2016}, pages = {98-105}, publisher = {Springer}, organization = {Springer}, address = {Heraklion, Crete, Greece}, abstract = {

Software engineering and information security have traditionally followed divergent paths but lately some efforts have been made to consider security from the early phases of the Software Development Life Cycle (SDLC). This paper follows this line and concentrates on the incorporation of trust negotiations during the requirements engineering phase. More precisely, we provide an extension to the SI* modelling language, which is further formalised using answer set programming specifications to support the automatic verification of the model and the detection of privacy conflicts caused by trust negotiations.

}, keywords = {Goal-Oriented Modelling, privacy, Requirements Engineering, Secure Software Engineering, Trust}, isbn = {978-3-319-46597-5}, issn = {0302-9743}, doi = {10.1007/978-3-319-46598-2 7}, url = {http://link.springer.com/chapter/10.1007/978-3-319-46598-2_7}, author = {Ruben Rios and Carmen Fernandez-Gago and Javier Lopez} } @article {rios2015, title = {Probabilistic receiver-location privacy protection in wireless sensor networks}, journal = {Information Sciences}, volume = {321}, year = {2015}, month = {07/2015}, pages = {205 - 223}, publisher = {Elsevier}, abstract = {

Wireless sensor networks (WSNs) are continually exposed to many types of attacks. Among these, the attacks targeted at the base station are the most devastating ones since this essential device processes and analyses all traffic generated in the network. Moreover, this feature can be exploited by a passive adversary to determine its location based on traffic analysis. This receiver-location privacy problem can be reduced by altering the traffic pattern of the network but the adversary may still be able to reach the base station if he gains access to the routing tables of a number of sensor nodes. In this paper we present HISP-NC (Homogenous Injection for Sink Privacy with Node Compromise protection), a receiver-location privacy solution that consists of two complementary schemes which protect the location of the base station in the presence of traffic analysis and node compromise attacks. The HISP-NC data transmission protocol prevents traffic analysis by probabilistically hiding the flow of real traffic with moderate amounts of fake traffic. Moreover, HISP-NC includes a perturbation mechanism that modifies the routing tables of the nodes to introduce some level of uncertainty in attackers capable of retrieving the routing information from the nodes. Our scheme is validated both analytically and experimentally through extensive simulations.

}, keywords = {node capture, privacy, security, traffic analysis, wireless sensor networks}, issn = {0020-0255}, doi = {10.1016/j.ins.2015.01.016}, author = {Ruben Rios and Jorge Cuellar and Javier Lopez} } @inproceedings {onieva2014, title = {An{\'a}lisis y Desarrollo de un Canal Encubierto en una Red de Sensores}, booktitle = { XIII Reuni{\'o}n Espa{\~n}ola sobre Criptolog{\'\i}a y Seguridad de la Informaci{\'o}n (RECSI 2014)}, year = {2014}, month = {09/2014}, pages = {333-338}, publisher = {Universidad de Alicante}, organization = {Universidad de Alicante}, address = {Alicante, Spain}, abstract = {

Continuamente aparecen nuevos estudios as{\'\i} como nuevos desarrollos de canales encubiertos. Como veremos, existen m{\'a}s de cien dise{\~n}os distintos para redes de ordenadores, pero no hemos encontrado en la literatura ning{\'u}n an{\'a}lisis, dise{\~n}o e implementaci{\'o}n de canales encubiertos sobre redes de sensores. En este art{\'\i}culo presentamos los resultados del dise{\~n}o e implementaci{\'o}n de un canal multitasa basado en los tiempos de monitorizaci{\'o}n sobre una red de sensores. En este proceso se han establecido las principales propiedades necesarias y, en base a ellas, se desarrolla e implementa el canal encubierto. Se describe el proceso de desarrollo y se analiza su detectabilidad.

}, keywords = {Covert channels, Information Security, Information Warfare, Intrusion Detection, Network Security, Wireless Sensor Network}, isbn = {978-84-9717-323-0}, author = {Jose A. Onieva and Ruben Rios and Bernardo Palenciano} } @incollection {ruben2014a, title = {Location Privacy in WSNs: Solutions, Challenges, and Future Trends}, booktitle = {Foundations of Security Analysis and Design VII}, volume = {8604}, number = {LNCS}, year = {2014}, pages = {244-282}, publisher = {Springer}, organization = {Springer}, abstract = {

Privacy preservation is gaining popularity in Wireless Sensor Network (WSNs) due to its adoption in everyday scenarios. There are a number of research papers in this area many of which concentrate on the location privacy problem. In this paper we review and categorise these solutions based on the information available to the adversary and his capabilities. But first we analyse whether traditional anonymous communication systems conform to the original requirements of location privacy in sensor networks. Finally, we present and discuss a number of challenges and future trends that demand further attention from the research community.

}, keywords = {Location Privacy, survey, traffic analysis, wireless sensor networks}, isbn = {978-3-319-10081-4}, issn = {0302-9743}, doi = {10.1007/978-3-319-10082-1_9}, author = {Ruben Rios and Javier Lopez and Jorge Cuellar} } @inproceedings {Lopez2014prl, title = {Preserving Receiver-Location Privacy in Wireless Sensor Networks}, booktitle = {Information Security Practice and Experience (ISPEC 2014)}, volume = {8434}, year = {2014}, month = {05/2014}, pages = {15-27}, publisher = {Springer}, organization = {Springer}, address = {Fuzhou, China}, abstract = {

Wireless sensor networks (WSNs) are exposed to many different types of attacks. Among these, the most devastating attack is to compromise or destroy the base station since all communications are addressed exclusively to it. Moreover, this feature can be exploited by a passive adversary to determine the location of this critical device. This receiver-location privacy problem can be reduced by hindering traffic analysis but the adversary may still obtain location information by capturing a subset of sensor nodes in the field. This paper addresses, for the first time, these two problems together in a single solution

}, keywords = {Location Privacy, node capture, traffic analysis, wireless sensor networks}, isbn = {978-3-319-06319-5}, issn = {0302-9743}, doi = {10.1007/978-3-319-06320-1_3}, url = {http://link.springer.com/chapter/10.1007/978-3-319-06320-1_3$\#$}, author = {Javier Lopez and Ruben Rios and Jorge Cuellar} } @article {rios2013a, title = {Covert Communications through Network Configuration Messages}, journal = {Computers \& Security}, volume = {39, Part A}, year = {2013}, month = {Nov 2013}, pages = {34 - 46}, publisher = {Elsevier}, abstract = {

Covert channels are a form of hidden communication that may violate the integrity of systems. Since their birth in Multi-Level Security systems in the early 70{\textquoteright}s they have evolved considerably, such that new solutions have appeared for computer networks mainly due to vague protocols specifications. In this paper we concentrate on short-range covert channels and analyze the opportunities of concealing data in various extensively used protocols today. From this analysis we observe several features that can be effectively exploited for subliminal data transmission in the Dynamic Host Configuration Protocol (DHCP). The result is a proof-of-concept implementation, HIDE\_DHCP, which integrates three different covert channels each of which accommodate to different stealthiness and capacity requirements. Finally, we provide a theoretical and experimental analysis of this tool in terms of its reliability, capacity, and detectability.

}, keywords = {Covert channels, Information Warfare, Intrusion Detection, Network Security, System Information Security}, issn = {0167-4048}, doi = {10.1016/j.cose.2013.03.004}, author = {Ruben Rios and Jose A. Onieva and Javier Lopez} } @inproceedings {rios2013b, title = {Ocultaci{\'o}n de la estaci{\'o}n base en redes inal{\'a}mbricas de sensores}, booktitle = {XI Jornadas de Ingenier{\'\i}a Telem{\'a}tica (JITEL 2013)}, year = {2013}, month = {Oct 2013}, pages = {481-486}, publisher = {Asociaci{\'o}n de Telem{\'a}tica}, organization = {Asociaci{\'o}n de Telem{\'a}tica}, address = {Granada}, abstract = {

La estaci{\'o}n base es el elemento m{\'a}s importante en un red de sensores y, por tanto, es necesario evitar que un atacante pueda hacerse con el control de este valioso dispositivo. Para ello, el atacante puede valerse tanto de t{\'e}cnicas de an{\'a}lisis de tr{\'a}fico como de la captura de nodos. En este trabajo presentamos un esquema que consta de dos fases, la primera est{\'a} dedicada a homogeneizar los patrones de tr{\'a}fico y la segunda encargada de perturbar las tablas de rutas de los nodos. Ambas fases permiten mantener a la estaci{\'o}n base fuera del alcance del atacante con un coste computacional insignificante y un consumo energ{\'e}tico moderado. La validez de nuestro esquema ha sido validada anal{\'\i}ticamente y a trav{\'e}s de numerosas simulaciones.

}, isbn = {978-84-616-5597-7}, author = {Ruben Rios and Jorge Cuellar and Javier Lopez}, editor = {Jes{\'u}s E. D{\'\i}az Verdejo and Jorge Navarro Ortiz and Juan J. Ramos Mu{\~n}oz} } @article {agudo2013, title = {A Privacy-Aware Continuous Authentication Scheme for Proximity-Based Access Control}, journal = {Computers \& Security}, volume = {39 (B)}, year = {2013}, month = {11/2013}, pages = {117-126}, publisher = {Elsevier}, abstract = {

Continuous authentication is mainly associated with the use of biometrics to guarantee that a resource is being accessed by the same user throughout the usage period. Wireless devices can also serve as a supporting technology for continuous authentication or even as a complete alternative to biometrics when accessing proximity-based services. In this paper we present the implementation of a secure, non-invasive continuous authentication scheme supported by the use of Wearable Wireless Devices (WWD), which allow users to gain access to proximity-based services while preserving their privacy. Additionally we devise an improved scheme that circumvents some of the limitations of our implementation.

}, issn = {0167-4048}, doi = {10.1016/j.cose.2013.05.004}, author = {Isaac Agudo and Ruben Rios and Javier Lopez} } @article {Rios2012a, title = {(Un)Suitability of Anonymous Communication Systems to WSN}, journal = {IEEE Systems Journal}, volume = {7}, number = {2}, year = {2013}, month = {Jun 2013}, pages = {298 - 310}, publisher = {IEEE Systems Council}, abstract = {

Anonymous communication systems have been extensively studied by the research community to prevent the disclosure of sensitive information from the analysis of individuals{\textquoteright} traffic patterns. Many remarkable solutions have been developed in this area, most of which have proven to be effective in the protection of user privacy against different types of attacks. Recently, the privacy preservation problem has also been considered in the realm of wireless sensor networks (WSNs) due to their imminent adoption in real-world scenarios. A special challenge that arises from the analysis of the flow of sensor nodes{\textquoteright} communications is the location privacy problem. In this work we concentrate on analyzing the suitability of traditional anonymous communication systems originally designed for the Internet to the original scenario of sensor networks. The results show that, in most cases, traditional solutions do not provide the adequate protection means for the particular problem of location privacy, while other solutions are too resource-consuming for the restricted capabilities of sensor nodes.

}, keywords = {Anonymous communication, Location Privacy, wireless sensor networks}, issn = {1932-8184}, doi = {10.1109/JSYST.2012.2221956}, author = {Ruben Rios and Javier Lopez} } @inproceedings {Rios2012b, title = {Adecuaci{\'o}n de soluciones de anonimato al problema de la privacidad de localizaci{\'o}n en WSN}, booktitle = {XII Reuni{\'o}n Espa{\~n}ola sobre Criptolog{\'\i}a y Seguridad de la Informaci{\'o}n (RECSI 2012)}, year = {2012}, month = {Sep 2012}, pages = {309-314}, address = {Donostia-San Sebasti{\'a}n}, abstract = {

Los patrones de tr{\'a}fico caracter{\'\i}sticos de las redes inal{\'a}mbricas de sensores (WSNs) dan lugar al problema de la privacidad de localizaci{\'o}n. De manera similar, el tr{\'a}fico de los usuarios en Internet revela informaci{\'o}n sensible que puede ser protegida mediante sistemas de comunicaci{\'o}n an{\'o}nima (ACS). Por ello, este trabajo analiza la posibilidad de adaptar las soluciones de anonimato tradicionales al problema particular de las redes de sensores. Hasta el momento estas soluciones hab{\'\i}an sido rechazadas sin un an{\'a}lisis riguroso, argumentando simplemente que eran demasiado exigentes computacionalmente para los nodos sensores. Nuestros resultados demuestran que, en general, algunos ACS no cumplen los requisitos de privacidad necesarios en WSNs mientras que otros, que si los cumplen, se valen de una cantidad de recursos que superan la capacidad de los sensores.

}, isbn = {978-84-615-9933-2}, author = {Ruben Rios and Javier Lopez}, editor = {U. Zurutuza and R. Uribeetxeberria and I. Arenaza-Nu{\~n}o} } @inproceedings {Rios2012, title = {HIDE_DHCP: Covert Communications Through Network Configuration Messages}, booktitle = {Proceedings of the 27th IFIP TC 11 International Information Security and Privacy Conference (SEC 2012)}, series = {IFIP AICT}, volume = {376}, year = {2012}, month = {June 2012}, pages = {162-173}, publisher = {Springer Boston}, organization = {Springer Boston}, address = {Heraklion, Crete, Greece}, abstract = {

Covert channels are a form of hidden communication that may violate the integrity of systems. Since their birth in multilevel security systems in the early 70{\textquoteright}s they have evolved considerably, such that new solutions have appeared for computer networks mainly due to vague protocols specifications. We analyze a protocol extensively used today, the Dynamic Host Configuration Protocol (DHCP), in search of new forms of covert communication. From this analysis we observe several features that can be effectively exploited for subliminal data transmission. This results in the implementation of HIDE_DHCP, which integrates three covert channels that accommodate to different stealthiness and bandwidth requirements

}, keywords = {Covert channels, Network Security, System Information Security}, isbn = {978-3-642-30435-4}, issn = {1868-4238}, doi = {http://dx.doi.org/10.1007/978-3-642-30436-1_14}, author = {Ruben Rios and Jose A. Onieva and Javier Lopez}, editor = {Dimitris Gritzalis and Steve Furnell and Marianthi Theoharidou} } @inproceedings {Cuellar2012, title = {Indistinguishable Regions in Geographic Privacy}, booktitle = {Proceedings of the 27th Annual ACM Symposium on Applied Computing (SAC 2012)}, year = {2012}, month = {26-30 March 2012}, pages = {1463-1469}, publisher = {ACM}, organization = {ACM}, address = {Riva del Garda (Trento), Italy}, abstract = {

The ubiquity of positioning devices poses a natural security challenge: users want to take advantage of location-related services as well as social sharing of their position but at the same time have security concerns about how much information should be shared about their exact position. This paper discusses different location-privacy problems, their formalization and the novel notion of indistinguishability regions that allows one to proof that a given obfuscation function provides a good trade-off between location sharing and privacy.

}, keywords = {indistinguishability, Location Privacy, obfuscation}, isbn = {978-1-4503-0857-1}, doi = {10.1145/2245276.2232010}, author = {Jorge Cuellar and Martin Ochoa and Ruben Rios}, editor = {Sascha Ossowski and Paola Lecca} } @inproceedings {Rios2012d, title = {Robust Probabilistic Fake Packet Injection for Receiver-Location Privacy in WSN}, booktitle = {17th European Symposium on Research in Computer Security (ESORICS 2012)}, series = {LNCS}, volume = {7459}, year = {2012}, month = {Sep 2012}, pages = {163-180}, publisher = {Springer}, organization = {Springer}, address = {Pisa, Italy}, abstract = {

The singular communication model in wireless sensor networks (WSNs) originate pronounced traffic patterns that allow a local observer to deduce the location of the base station, which must be kept secret for both strategical and security reasons. In this work we present a new receiver-location privacy solution called HISP (Homogenous Injection for Sink Privacy). Our scheme is based on the idea of hiding the flow of real traffic by carefully injecting fake traffic to homogenize the transmissions from a node to its neighbors. This process is guided by a lightweight probabilistic approach ensuring that the adversary cannot decide with sufficient precision in which direction to move while maintaining a moderate amount of fake traffic. Our system is both validated analytically and experimentally through simulations.

}, isbn = {978-3-642-33167-1}, issn = {0302-9743}, doi = {10.1007/978-3-642-33167-1_10}, author = {Ruben Rios and Jorge Cuellar and Javier Lopez}, editor = {Sara Foresti and Moti Yung and Fabio Martinelli} } @article {Rios2011a, title = {Analysis of Location Privacy Solutions in Wireless Sensor Networks}, journal = {IET Communications}, volume = {5}, year = {2011}, month = {Nov 2011}, pages = {2518 - 2532}, publisher = {Institution of Engineering and Technology}, abstract = {

Extensive work has been done on the protection of Wireless Sensor Networks (WSNs) from the hardware to the application layer. However, only recently, the privacy preservation problem has drawn the attention of the research community because of its challenging nature. This problem is exacerbated in the domain of WSNs due to the extreme resource limitation of sensor nodes. In this paper we focus on the location privacy problem in WSNs, which allows an adversary to determine the location of nodes of interest to him. We provide a taxonomy of solutions based on the power of the adversary and the main techniques proposed by the various solutions. In addition, we describe and analyse the advantages and disadvantages of different approaches. Finally, we discuss some open challenges and future directions of research.

}, issn = {1751-8628}, doi = {10.1049/iet-com.2010.0825}, author = {Ruben Rios and Javier Lopez} } @article {Rios2011b, title = {Exploiting Context-Awareness to Enhance Source-Location Privacy in Wireless Sensor Networks}, journal = {The Computer Journal}, volume = {54}, year = {2011}, month = {Sept 2011}, pages = {1603-1615}, publisher = {Oxford University Press}, abstract = {

The source-location privacy problem in Wireless Sensor Networks has been traditionally tackled by the creation of random routes for every packet transmitted from the source nodes to the base station. These schemes provide a considerable protection level at a high cost in terms of message delivery time and energy consumption. This overhead is due to the fact that the data routing process is done in a blind way, without knowledge about the location of the attacker. In this work we propose the Context-Aware Location Privacy (CALP) approach, which takes advantage of the ability of sensor nodes to perceive the presence of a mobile adversary in their vicinity in order to transmit data packets in a more energy-efficient and privacy-preserving manner. In particular, we apply the concepts of CALP to the development of a shortest-path CALP routing algorithm. A permissive and a strict version of the protocol are studied for different adversarial models and the proposed schemes are evaluated through simulation experiments in terms of privacy protection and energy consumption. Finally, we present the conclusions of the paper as well as possible extensions of this work.

}, keywords = {Context-Awareness, Location Privacy, wireless sensor networks}, issn = {0010-4620}, doi = {10.1093/comjnl/bxr055}, author = {Ruben Rios and Javier Lopez} } @inproceedings {Rios2010a, title = {Implementaci{\'o}n de un esquema de localizaci{\'o}n privada y segura para interiores}, booktitle = {IX Jornadas de Ingenier{\'\i}a Telem{\'a}tica (JITEL{\textquoteright}10)}, year = {2010}, month = {Sept.}, pages = {237 - 244}, address = {Valladolid (Spain)}, abstract = {

Las aplicaciones basadas en localizaci\ón proporcionan a los usuarios servicios personalizados dependiendo de su ubicaci\ón. Las estimaciones prev\én que estos servicios se extender\án enormemente en los pr\óximos a\ños reportando grandes beneficios tanto a la industria como a los usuarios finales. Sin embargo, para que estos avances sean posibles se hace necesario analizar en profundidad las distintas implicaciones de seguridad y privacidad que la utilizaci\ón de tales servicios pueden traer consigo a los usuarios. En este trabajo proponemos un sistema de localizaci\ón que da soporte a la provisi\ón de servicios basados en localizaci\ón para entornos indoor y que se fundamenta en la tecnolog\ía de redes de sensores inal\ámbricos. En este esquema hemos tenido en cuenta diversos aspectos de seguridad y privacidad, prestando especial atenci\ón a la limitaci\ón extrema de recursos caracter\ística de las redes de sensores. Finalmente hemos desarrollado una prueba de concepto para comprobar la viabilidad de nuestro esquema dentro del \ámbito del proyecto OSAmI.

}, isbn = {978-84-693-5398-1}, author = {Ruben Rios and Isaac Agudo and Jose L. Gonzalez}, editor = {Yannis Dimitriadis and Mar{\'\i}a Jes{\'u}s Verd{\'u} P{\'e}rez} } @inproceedings {Rios2010, title = {Source Location Privacy Considerations in Wireless Sensor Networks}, booktitle = {4th International Symposium of Ubiquitous Computing and Ambient Intelligence (UCAmI{\textquoteright}10)}, year = {2010}, month = {Sept.}, pages = {29 - 38}, publisher = {IBERGARCETA PUBLICACIONES, S.L.}, organization = {IBERGARCETA PUBLICACIONES, S.L.}, address = {Valencia (Spain)}, abstract = {

Wireless Sensor Networks are considered to be one of the cornerstones of Ambient Intelligence since they can be used in countless applications, where sensors are unobtrusively embedded into the environment to perform operations like monitoring, tracking and reporting. In such scenarios, privacy issues must be carefully considered since the mere observation of the network operation might reveal great amounts of private information to unauthorised parties. One of the problems that is gaining more attention in the realm of privacy, is the location privacy problem, which aims to prevent an attacker from obtaining the location of specific nodes of interest to him. In this paper we provide a general overview of the proposed solutions to counter this threat. Finally, we will also discuss some open challenges and future directions of research for a convenient management of privacy issues in smart environments.

}, isbn = {978-84-92812-61-5}, author = {Ruben Rios and Javier Lopez}, editor = {Lidia Fuentes and Nadia G{\'a}mez and Jos{\'e} Bravo} } @inproceedings {Rios2008, title = {Clasificaci{\'o}n de canales encubiertos. Un nuevo canal: Covert_DHCP}, booktitle = {X Reuni{\'o}n Espa{\~n}ola de Criptolog{\'\i}a y Seguridad de la Informaci{\'o}n (RECSI{\textquoteright}08)}, year = {2008}, month = {Sept.}, pages = {325-336}, address = {Salamanca (Spain)}, abstract = {

Los canales encubiertos son una forma de comunicaci\ón oculta que puede vulnerar la integridad de los sistemas. Desde sus inicios en sistemas de seguridad multinivel a principios de los a\ños 70 han evolucionado considerablemente, apareciendo soluciones para redes de computadores debido a la especificaci\ón de algunos protocolos. Por este motivo, se hace un estudio sobre las t\écnicas que se han utilizado para crear los canales, as\í como sobre las distintos obst\áculos que han tratado de mermar su actividad. Asimismo, se presenta una nueva clasificaci\ón que trata de albergar la mayor cantidad de canales encubiertos existentes en la actualidad. Por \último, se analiza un protocolo ampliamente extendido en la actualidad, DHCP, en busca de posibilidades de albergar informaci\ón encubierta. A partir de este an\álisis se implementan distintas versiones de un canal encubierto haciendo uso de este protocolo.

}, keywords = {Canales encubiertos, control de accesos y detecci{\'o}n de intrusos, seguridad en redes, seguridad en sistemas de informaci{\'o}n}, isbn = {978-84-691-5158-7}, author = {Ruben Rios and Jose A. Onieva}, editor = {Luis Hern{\'a}ndez Encinas and Angel Martin del Rey} }