Cloud computing Conditional access system content management content protection copy protection digital video broadcasting DLNA Hardware History Home automation home computing home network Identity federation Identity management Internet internetworking IPTV Pervasive computing Privacy Protection Protocols risk assessment SAML security set-top boxes Social network services social networks Telematics Trust management TV
2016 |
Díaz-Sánchez, D; Sherratt, R S; Almenarez, F; Arias, P; Marín, A Secure store and forward proxy for dynamic IoT applications over M2M networks Journal Article IEEE Transactions on Consumer Electronics, 62 (4), pp. 389-397, 2016, ISSN: 0098-3063. Abstract | Links | BibTeX | Tags: encryption, IoT, M2M, security @article{7838091, title = {Secure store and forward proxy for dynamic IoT applications over M2M networks}, author = {D. Díaz-Sánchez and R. S. Sherratt and F. Almenarez and P. Arias and A. Marín}, url = {https://pervasive.it.uc3m.es/?post_type=wpdmpro&p=418&preview=true }, doi = {10.1109/TCE.2016.7838091}, issn = {0098-3063}, year = {2016}, date = {2016-11-01}, journal = {IEEE Transactions on Consumer Electronics}, volume = {62}, number = {4}, pages = {389-397}, abstract = {Internet of Things (IoT) applications are expected to generate a huge unforeseen amount of traffic flowing from Consumer Electronics devices to the network. In order to overcome existing interoperability problems, several standardization bodies have joined to bring a new generation of Machine to Machine (M2M) networks as a result of the evolution of wireless sensor/actor networks and mobile cellular networks to converged networks. M2M is expected to enable IoT paradigms and related concepts into a reality at a reasonable cost. As part of the convergence, several technologies preventing new IoT services to interfere with existing Internet services are flourishing. Responsive, message-driven, resilient and elastic architectures are becoming essential parts of the system. These architectures will control the entire data flow for an IoT system requiring sometimes to store, shape and forward data among nodes of a M2M network to improve network performance. However, IoT generated data have an important personal component since it is generated in personal devices or are the result of the observation of the physical world, so rises significant security concerns. This article proposes a novel opportunistic flexible secure store and forward proxy for M2M networks and its mapping to asynchronous protocols that guarantees data confidentiality}, keywords = {encryption, IoT, M2M, security}, pubstate = {published}, tppubtype = {article} } Internet of Things (IoT) applications are expected to generate a huge unforeseen amount of traffic flowing from Consumer Electronics devices to the network. In order to overcome existing interoperability problems, several standardization bodies have joined to bring a new generation of Machine to Machine (M2M) networks as a result of the evolution of wireless sensor/actor networks and mobile cellular networks to converged networks. M2M is expected to enable IoT paradigms and related concepts into a reality at a reasonable cost. As part of the convergence, several technologies preventing new IoT services to interfere with existing Internet services are flourishing. Responsive, message-driven, resilient and elastic architectures are becoming essential parts of the system. These architectures will control the entire data flow for an IoT system requiring sometimes to store, shape and forward data among nodes of a M2M network to improve network performance. However, IoT generated data have an important personal component since it is generated in personal devices or are the result of the observation of the physical world, so rises significant security concerns. This article proposes a novel opportunistic flexible secure store and forward proxy for M2M networks and its mapping to asynchronous protocols that guarantees data confidentiality |
2015 |
González, Icíar González Selección de Proveedores de Servicios Cloud basada en métricas de seguridad Masters Thesis University Carlos III of Madrid, 2015. Abstract | Links | BibTeX | Tags: AHP, Analytic Hierarchy Process, Cloud, MAUT, Multiattribute Utility Theory, Multicriteria @mastersthesis{González2015, title = {Selección de Proveedores de Servicios Cloud basada en métricas de seguridad}, author = {Icíar González González}, url = {http://pervasive.it.uc3m.es/wp-content/uploads/2016/02/IciarGonzalezGonzalez-TFG.pdf}, year = {2015}, date = {2015-10-15}, school = {University Carlos III of Madrid}, abstract = {One of the technological services that is in full development and use by many industries is Cloud Computing. Over time we have witnessed the many changes that have hit the technology sector but few advances have been as significant as the development of this service as well as the entry of numerous global providers that offer it. Cloud services allow a large number of companies to gain ubiquitous and on demand access to a shared set of computing resources, which has supposed a revolution that benefits both the end consumer and the public or private companies. The security in this service has been one of the main problems, as the user data happen to be stored in outside servers, for all this, the safety aspects are of key importance as outsourcing infrastructure (IaaS), platform (PaaS ) and (SaaS) software to a third party which handles our data. Moreover, at the present time, the exploration of greater productivity and efficiency encourage the search for new methods to cope with decision-making in settings where many selection criteria or alternatives are involved. For all these reasons, it is necessary to use tools to discern between alternatives for obtaining, to the greatest extent possible, the most satisfactory solution as well as the provider that most security grant us is of primary i mportance. In this search of new methodologies we find the multicriteria decision methods in which this project focuses. If we combine the increased demand for cloud services and the number of providers that offer this service with multicriteria decision methods, we obtain as a result the search for maximum efficiency through proper selection of a provider that best suits the criteria selected by the client. Within these criteria, security aspects have a fundamental importance to select the right provider according to the level of protection that they need. In this Final Project we study two types of methodologies based on multicriteria decision making mechanisms to discern between different cloud service providers, these methodologies are: first, Analytic Hierarchy Process (AHP) and, secondly, Multiattribute Utility Theory (MAUT).}, keywords = {AHP, Analytic Hierarchy Process, Cloud, MAUT, Multiattribute Utility Theory, Multicriteria}, pubstate = {published}, tppubtype = {mastersthesis} } One of the technological services that is in full development and use by many industries is Cloud Computing. Over time we have witnessed the many changes that have hit the technology sector but few advances have been as significant as the development of this service as well as the entry of numerous global providers that offer it. Cloud services allow a large number of companies to gain ubiquitous and on demand access to a shared set of computing resources, which has supposed a revolution that benefits both the end consumer and the public or private companies. The security in this service has been one of the main problems, as the user data happen to be stored in outside servers, for all this, the safety aspects are of key importance as outsourcing infrastructure (IaaS), platform (PaaS ) and (SaaS) software to a third party which handles our data. Moreover, at the present time, the exploration of greater productivity and efficiency encourage the search for new methods to cope with decision-making in settings where many selection criteria or alternatives are involved. For all these reasons, it is necessary to use tools to discern between alternatives for obtaining, to the greatest extent possible, the most satisfactory solution as well as the provider that most security grant us is of primary i mportance. In this search of new methodologies we find the multicriteria decision methods in which this project focuses. If we combine the increased demand for cloud services and the number of providers that offer this service with multicriteria decision methods, we obtain as a result the search for maximum efficiency through proper selection of a provider that best suits the criteria selected by the client. Within these criteria, security aspects have a fundamental importance to select the right provider according to the level of protection that they need. In this Final Project we study two types of methodologies based on multicriteria decision making mechanisms to discern between different cloud service providers, these methodologies are: first, Analytic Hierarchy Process (AHP) and, secondly, Multiattribute Utility Theory (MAUT). |
Candía, José Romero Gestión de Métricas de Seguridad sobre Proveedores de Servicios Cloud Masters Thesis University Carlos III of Madrid, 2015. Abstract | Links | BibTeX | Tags: API, CAIQ, Cloud computing, Cloud Security Alliance, evaluación de servicios Cloud, métricas de seguridad, proveedores, seguridad, servicio Web @mastersthesis{Candía2015, title = {Gestión de Métricas de Seguridad sobre Proveedores de Servicios Cloud}, author = {José Romero Candía}, url = {http://pervasive.it.uc3m.es/wp-content/uploads/2016/02/TFG_GestionDeMetricasDeSeguridadSobreProveedoresDeServiciosCloud.pdf}, year = {2015}, date = {2015-10-15}, school = {University Carlos III of Madrid}, abstract = {Information and Communications Technologies (ICT) are constantly evolving. One of the current trends is the use of Cloud Computing services. These services provide on-demand access to resources such as software tools, servers and storage systems, by representing a reduction of infrastructure costs for customers. However, there is some distrust about the risks of contracting cloud services. The concern stems from privacy management, especially with sensitive information, or data loss; therefore, security is a key point. The main objective of this Final Degree Project is precisely the development of a tool that processes the available information about security metrics of Cloud Computing service providers, and that makes it accessible through a Web service. In this way, users can assess services of different providers and compare them to get the service that best suits their needs. In particular, this project is focused on developing a system that allows other applications to access a security metrics based on providers’ metadata through a Web service. This etadata is obtained by processing cloud service assessment documents (CAIQ) provided by the Cloud Security Alliance (CSA).}, keywords = {API, CAIQ, Cloud computing, Cloud Security Alliance, evaluación de servicios Cloud, métricas de seguridad, proveedores, seguridad, servicio Web}, pubstate = {published}, tppubtype = {mastersthesis} } Information and Communications Technologies (ICT) are constantly evolving. One of the current trends is the use of Cloud Computing services. These services provide on-demand access to resources such as software tools, servers and storage systems, by representing a reduction of infrastructure costs for customers. However, there is some distrust about the risks of contracting cloud services. The concern stems from privacy management, especially with sensitive information, or data loss; therefore, security is a key point. The main objective of this Final Degree Project is precisely the development of a tool that processes the available information about security metrics of Cloud Computing service providers, and that makes it accessible through a Web service. In this way, users can assess services of different providers and compare them to get the service that best suits their needs. In particular, this project is focused on developing a system that allows other applications to access a security metrics based on providers’ metadata through a Web service. This etadata is obtained by processing cloud service assessment documents (CAIQ) provided by the Cloud Security Alliance (CSA). |
Ricca, Joaquin Melgarejo; Díaz-Sánchez, Daniel Diseño y desarrollo de un sistema distribuido de búsqueda de audio y streaming basado en P2P Masters Thesis Escuela Politécnica Superior, 2015. Abstract | Links | BibTeX | Tags: DHT, Music distribution, P2P @mastersthesis{Melgarejo2015, title = {Diseño y desarrollo de un sistema distribuido de búsqueda de audio y streaming basado en P2P}, author = {Joaquin Melgarejo Ricca and Daniel Díaz-Sánchez}, editor = {Universidad Carlos III de Madrid}, url = {http://pervasive.it.uc3m.es/download/diseno-y-desarrollo-de-un-sistema-distribuido-de-busqueda-de-audio-y-streaming-basado-en-p2p/}, year = {2015}, date = {2015-07-03}, address = {Universidad Carlos III de Madrid}, school = {Escuela Politécnica Superior}, abstract = {The approach of this project will be to evaluate the performance of a distributed system, interconnected by a Peer-to-peer network, making use of more powerful machines than the new generation devices, seeking to build services with similar performance to those on previous existing systems. The main purpose of this project is the development of a DHT over Peer-to-peer, creating a hierarchy from the at structure of the network.The initial purpose of this project is the creation of a structuring system for a Peer-to-peer network. For this reason, mechanisms should be created for the classi cation of the content shared by the network, as well as the mapping of the nodes connected to each other}, type = {Bachelor\'s Degree}, keywords = {DHT, Music distribution, P2P}, pubstate = {published}, tppubtype = {mastersthesis} } The approach of this project will be to evaluate the performance of a distributed system, interconnected by a Peer-to-peer network, making use of more powerful machines than the new generation devices, seeking to build services with similar performance to those on previous existing systems. The main purpose of this project is the development of a DHT over Peer-to-peer, creating a hierarchy from the at structure of the network.The initial purpose of this project is the creation of a structuring system for a Peer-to-peer network. For this reason, mechanisms should be created for the classi cation of the content shared by the network, as well as the mapping of the nodes connected to each other |
Arias-Cabarcos, Patricia ; Almenarez, Florina ; Trapero, Ruben ; Diaz-Sanchez, Daniel ; Marin, Andres Blended Identity: Pervasive IdM for Continuous Authentication Journal Article Security Privacy, IEEE, 13 (3), pp. 32-39, 2015, ISSN: 1540-7993. Abstract | Links | BibTeX | Tags: Authentication, blended identity, Computer architecture, Identity management, IdM, Pervasive computing, Protocols, risk assessment, Risk management, security @article{7118079, title = {Blended Identity: Pervasive IdM for Continuous Authentication}, author = {Arias-Cabarcos, Patricia and Almenarez, Florina and Trapero, Ruben and Diaz-Sanchez, Daniel and Marin, Andres}, doi = {10.1109/MSP.2015.62}, issn = {1540-7993}, year = {2015}, date = {2015-05-01}, journal = {Security Privacy, IEEE}, volume = {13}, number = {3}, pages = {32-39}, abstract = {A proper identity management approach is necessary for pervasive computing to be invisible to users. Federated identity management is key to achieving efficient identity blending and natural integration in the physical and online layers where users, devices, and services are present.}, keywords = {Authentication, blended identity, Computer architecture, Identity management, IdM, Pervasive computing, Protocols, risk assessment, Risk management, security}, pubstate = {published}, tppubtype = {article} } A proper identity management approach is necessary for pervasive computing to be invisible to users. Federated identity management is key to achieving efficient identity blending and natural integration in the physical and online layers where users, devices, and services are present. |
2014 |
Arias-Cabarcos, Patricia; Almenárez, Florina; Gómez-Mármol, Félix; Marín, Andrés To federate or not to federate: a reputation-based mechanism to dynamize cooperation in identity management Journal Article Wireless Personal Communications, 75 (3), pp. 1769-1786, 2014, ISSN: 0929-6212. Abstract | Links | BibTeX | Tags: Cooperative systems, Identity federation, Identity management, Trust and reputation management @article{Cabarcos2014, title = {To federate or not to federate: a reputation-based mechanism to dynamize cooperation in identity management}, author = {Patricia Arias-Cabarcos and Florina Almenárez and Félix Gómez-Mármol and Andrés Marín}, url = {http://dx.doi.org/10.1007/s11277-013-1338-y}, issn = {0929-6212}, year = {2014}, date = {2014-04-01}, journal = {Wireless Personal Communications}, volume = {75}, number = {3}, pages = {1769-1786}, abstract = {Identity Management systems cannot be centralized anymore. Nowadays, users have multiple accounts, profiles and personal data distributed throughout the web and hosted by different providers. However, the online world is currently divided into identity silos forcing users to deal with repetitive authentication and registration processes and hindering a faster development of large scale e-business. Federation has been proposed as a technology to bridge different trust domains, allowing user identity information to be shared in order to improve usability. But further research is required to shift from the current static model, where manual bilateral agreements must be pre-configured to enable cooperation between unknown parties, to a more dynamic one, where trust relationships are established on demand in a fully automated fashion. This paper presents IdMRep, the first completely decentralized reputation-based mechanism which makes dynamic federation a reality. Initial experiments demonstrate its accuracy as well as an assumable overhead in scenarios with and without malicious nodes.}, keywords = {Cooperative systems, Identity federation, Identity management, Trust and reputation management}, pubstate = {published}, tppubtype = {article} } Identity Management systems cannot be centralized anymore. Nowadays, users have multiple accounts, profiles and personal data distributed throughout the web and hosted by different providers. However, the online world is currently divided into identity silos forcing users to deal with repetitive authentication and registration processes and hindering a faster development of large scale e-business. Federation has been proposed as a technology to bridge different trust domains, allowing user identity information to be shared in order to improve usability. But further research is required to shift from the current static model, where manual bilateral agreements must be pre-configured to enable cooperation between unknown parties, to a more dynamic one, where trust relationships are established on demand in a fully automated fashion. This paper presents IdMRep, the first completely decentralized reputation-based mechanism which makes dynamic federation a reality. Initial experiments demonstrate its accuracy as well as an assumable overhead in scenarios with and without malicious nodes. |
Sánchez, Daniel Díaz; Almenarez, Florina; Marín, Andrés; Guerrero, Rosa Sanchez; Arias, Patricia Media Gateway: bringing privacy to private multimedia cloud connections Journal Article Telecommunication Systems, 55 (2), pp. 315–330, 2014. Abstract | Links | BibTeX | Tags: @article{DiazSanchez2014, title = {Media Gateway: bringing privacy to private multimedia cloud connections}, author = {Daniel Díaz Sánchez and Florina Almenarez and Andrés Marín and Rosa Sanchez Guerrero and Patricia Arias}, url = {http://pervasive.it.uc3m.es/download/media-gateway-bringing-privacy-to-private-multimedia-cloud-connections/ http://dx.doi.org/10.1007/s11235-013-9783-1 }, doi = {10.1007/s11235-013-9783-1}, year = {2014}, date = {2014-01-01}, journal = {Telecommunication Systems}, volume = {55}, number = {2}, pages = {315--330}, abstract = {The growing interest in media sharing combined with the explosion of social applications have opened an opportunity window for cloud based applications for media management as Media Cloud, described in this article, that has brought the concept of Cloud Computing to home environments. Media Cloud provides a comprehensive and efficient solution for managing content among federated home environments. As part of the purpose of empowering the user role as well as to improve user experience, we placed significant efforts on interoperability and privacy protection when it comes to accessing cloud resources from other networks. This article describes a solution that enables limited devices to access contents located in private clouds, as Media Cloud, with the cooperation of network providers}, keywords = {}, pubstate = {published}, tppubtype = {article} } The growing interest in media sharing combined with the explosion of social applications have opened an opportunity window for cloud based applications for media management as Media Cloud, described in this article, that has brought the concept of Cloud Computing to home environments. Media Cloud provides a comprehensive and efficient solution for managing content among federated home environments. As part of the purpose of empowering the user role as well as to improve user experience, we placed significant efforts on interoperability and privacy protection when it comes to accessing cloud resources from other networks. This article describes a solution that enables limited devices to access contents located in private clouds, as Media Cloud, with the cooperation of network providers |
2013 |
de García, Laura Matías Gestión de riesgo en dispositivos Android basada en eliminación de vulnerabilidades y detección de contextos Masters Thesis University Carlos III of Madrid, 2013. Abstract | Links | BibTeX | Tags: Android, NVDB, risk assessment, vulnerabilities @mastersthesis{deGarcía2013, title = {Gestión de riesgo en dispositivos Android basada en eliminación de vulnerabilidades y detección de contextos}, author = {Laura de Matías García}, url = {http://pervasive.it.uc3m.es/wp-content/uploads/2016/02/PFC_Laura_De_Matias_Garcia.pdf}, year = {2013}, date = {2013-10-10}, school = {University Carlos III of Madrid}, abstract = {In only a few years, smartphones have become one of the most commonly used communication devices due to their versatility. But all that different functionalities imply the access to a lot of personal and confidential information from the installed applications. Nowadays, Android is one of the most important mobile operative systems. However, due to its youth, there is a lack of risk mitigation mechanisms. Besides, its security configuration is tedious, which involves no implication of the user. This project pretends to provide a better control over security risks in Android. Its main is to increase the knowledge and control over possible vulnerabilities in applications and contribute to an automatic adaptable security device configuration depending on the environment the smartphone is in. The implemented system counts with a vulnerability manager and a context based security module, and it interacts with the NVD, U.S. government repository of software vulnerability data, and the Android’s API, after the evaluation of other alternatives as information sources. In conclusion, it is introduced an application that, based on free software development tools, contributes to mitigate risks in Android and that lays the foundations of new ideas for the security investigation on this operative system.}, keywords = {Android, NVDB, risk assessment, vulnerabilities}, pubstate = {published}, tppubtype = {mastersthesis} } In only a few years, smartphones have become one of the most commonly used communication devices due to their versatility. But all that different functionalities imply the access to a lot of personal and confidential information from the installed applications. Nowadays, Android is one of the most important mobile operative systems. However, due to its youth, there is a lack of risk mitigation mechanisms. Besides, its security configuration is tedious, which involves no implication of the user. This project pretends to provide a better control over security risks in Android. Its main is to increase the knowledge and control over possible vulnerabilities in applications and contribute to an automatic adaptable security device configuration depending on the environment the smartphone is in. The implemented system counts with a vulnerability manager and a context based security module, and it interacts with the NVD, U.S. government repository of software vulnerability data, and the Android’s API, after the evaluation of other alternatives as information sources. In conclusion, it is introduced an application that, based on free software development tools, contributes to mitigate risks in Android and that lays the foundations of new ideas for the security investigation on this operative system. |
Almenares, F; Arias, P; Marin, A; Diaz-Sanchez, D; Sanchez, R Overhead of using secure wireless communications in mobile computing Journal Article Consumer Electronics, IEEE Transactions on, 59 (2), pp. 335-342, 2013, ISSN: 0098-3063. Abstract | Links | BibTeX | Tags: @article{6531115, title = {Overhead of using secure wireless communications in mobile computing}, author = {Almenares, F. and Arias, P. and Marin, A. and Diaz-Sanchez, D. and Sanchez, R.}, doi = {10.1109/TCE.2013.6531115}, issn = {0098-3063}, year = {2013}, date = {2013-05-01}, journal = {Consumer Electronics, IEEE Transactions on}, volume = {59}, number = {2}, pages = {335-342}, abstract = {Secure wireless communications are fundamental in any interaction in order to avoid security and privacy breaches, especially from mobile devices. The use of this kind of communications is far more frequent and the number of users increases day after day. This paper shows and analyzes the support, performance and consumption of cryptographic algorithms and cipher suites in terms of time and energy when secure communications (i.e., using SSL) are established according to different security levels. This study has been performed in distinct operating systems, and using different browsers and libraries.}, keywords = {}, pubstate = {published}, tppubtype = {article} } Secure wireless communications are fundamental in any interaction in order to avoid security and privacy breaches, especially from mobile devices. The use of this kind of communications is far more frequent and the number of users increases day after day. This paper shows and analyzes the support, performance and consumption of cryptographic algorithms and cipher suites in terms of time and energy when secure communications (i.e., using SSL) are established according to different security levels. This study has been performed in distinct operating systems, and using different browsers and libraries. |
2012 |
Cabarcos, P A; Mendoza, F A; Guerrero, R S; Lopez, A M; Diaz-Sanchez, D SuSSo: Seamless and ubiquitous single sign-on for cloud service continuity across devices Journal Article Consumer Electronics, IEEE Transactions on, 58 (4), pp. 1425-1433, 2012, ISSN: 0098-3063. Abstract | Links | BibTeX | Tags: @article{6415016, title = {SuSSo: Seamless and ubiquitous single sign-on for cloud service continuity across devices}, author = { P.A. Cabarcos and F.A. Mendoza and R.S. Guerrero and A.M. Lopez and D. Diaz-Sanchez}, doi = {10.1109/TCE.2012.6415016}, issn = {0098-3063}, year = {2012}, date = {2012-11-01}, journal = {Consumer Electronics, IEEE Transactions on}, volume = {58}, number = {4}, pages = {1425-1433}, abstract = {The great variety of consumer electronic devices with support of wireless communications combined with the emerging Cloud Computing paradigm is paving the way to real anytime/anywhere computing. In this context, many services, such as music or video streaming, are delivered to the clients using Cloud-based providers. However, service continuity when moving across different terminals is still a major challenge. This paper proposes SuSSo, a novel middleware architecture that allows sessions initiated from one device to be seamlessly transferred to a second one, as might be desirable in the enjoyment of long running media.}, keywords = {}, pubstate = {published}, tppubtype = {article} } The great variety of consumer electronic devices with support of wireless communications combined with the emerging Cloud Computing paradigm is paving the way to real anytime/anywhere computing. In this context, many services, such as music or video streaming, are delivered to the clients using Cloud-based providers. However, service continuity when moving across different terminals is still a major challenge. This paper proposes SuSSo, a novel middleware architecture that allows sessions initiated from one device to be seamlessly transferred to a second one, as might be desirable in the enjoyment of long running media. |
Sanchez, R; Almenares, F; Arias, P; Diaz-Sanchez, D; Marin, A Enhancing privacy and dynamic federation in IdM for consumer cloud computing Journal Article Consumer Electronics, IEEE Transactions on, 58 (1), pp. 95-103, 2012, ISSN: 0098-3063. Abstract | Links | BibTeX | Tags: @article{6170060, title = {Enhancing privacy and dynamic federation in IdM for consumer cloud computing}, author = { R. Sanchez and F. Almenares and P. Arias and D. Diaz-Sanchez and A. Marin}, doi = {10.1109/TCE.2012.6170060}, issn = {0098-3063}, year = {2012}, date = {2012-02-01}, journal = {Consumer Electronics, IEEE Transactions on}, volume = {58}, number = {1}, pages = {95-103}, abstract = {Consumer cloud computing paradigm has emerged as the natural evolution and integration of advances in several areas including distributed computing, service oriented architecture and consumer electronics. In this complex ecosystem, security and identity management challenges have cropped up, given their dynamism and heterogeneity. As a direct consequence, dynamic federated identity management with privacy improvements has arisen as an indispensable mechanism to enable the global scalability and usability that are required for the successful implantation of Cloud technologies. With these requirements in mind, we present an IdM architecture based on privacy and reputation extensions compliance with the SAMLv2/ID-FF standards1.}, keywords = {}, pubstate = {published}, tppubtype = {article} } Consumer cloud computing paradigm has emerged as the natural evolution and integration of advances in several areas including distributed computing, service oriented architecture and consumer electronics. In this complex ecosystem, security and identity management challenges have cropped up, given their dynamism and heterogeneity. As a direct consequence, dynamic federated identity management with privacy improvements has arisen as an indispensable mechanism to enable the global scalability and usability that are required for the successful implantation of Cloud technologies. With these requirements in mind, we present an IdM architecture based on privacy and reputation extensions compliance with the SAMLv2/ID-FF standards1. |
Sánchez-Guerrero, Rosa; Almenárez, Florina; Díaz-Sánchez, Daniel; Marín, Andrés; Arias, Patricia; Sanvido, Fabio An Event Driven Hybrid Identity Management Approach to Privacy Enhanced e-Health Journal Article Sensors, 12 (5), pp. 6129, 2012, ISSN: 1424-8220. Abstract | Links | BibTeX | Tags: @article{s120506129, title = {An Event Driven Hybrid Identity Management Approach to Privacy Enhanced e-Health}, author = { Rosa Sánchez-Guerrero and Florina Almenárez and Daniel Díaz-Sánchez and Andrés Marín and Patricia Arias and Fabio Sanvido}, url = {http://www.mdpi.com/1424-8220/12/5/6129}, doi = {10.3390/s120506129}, issn = {1424-8220}, year = {2012}, date = {2012-01-01}, journal = {Sensors}, volume = {12}, number = {5}, pages = {6129}, abstract = {Credential-based authorization offers interesting advantages for ubiquitous scenarios involving limited devices such as sensors and personal mobile equipment: the verification can be done locally; it offers a more reduced computational cost than its competitors for issuing, storing, and verification; and it naturally supports rights delegation. The main drawback is the revocation of rights. Revocation requires handling potentially large revocation lists, or using protocols to check the revocation status, bringing extra communication costs not acceptable for sensors and other limited devices. Moreover, the effective revocation consent—considered as a privacy rule in sensitive scenarios—has not been fully addressed.This paper proposes an event-based mechanism empowering a new concept, the sleepyhead credentials, which allows to substitute time constraints and explicit revocation by activating and deactivating authorization rights according to events. Our approach is to integrate this concept in IdM systems in a hybrid model supporting delegation, which can be an interesting alternative for scenarios where revocation of consent and user privacy are critical. The delegation includes a SAML compliant protocol, which we have validated through a proof-of-concept implementation. This article also explains the mathematical model describing the event-based model and offers estimations of the overhead introduced by the system. The paper focus on health care scenarios, where we show the flexibility of the proposed event-based user consent revocation mechanism.}, keywords = {}, pubstate = {published}, tppubtype = {article} } Credential-based authorization offers interesting advantages for ubiquitous scenarios involving limited devices such as sensors and personal mobile equipment: the verification can be done locally; it offers a more reduced computational cost than its competitors for issuing, storing, and verification; and it naturally supports rights delegation. The main drawback is the revocation of rights. Revocation requires handling potentially large revocation lists, or using protocols to check the revocation status, bringing extra communication costs not acceptable for sensors and other limited devices. Moreover, the effective revocation consent—considered as a privacy rule in sensitive scenarios—has not been fully addressed.This paper proposes an event-based mechanism empowering a new concept, the sleepyhead credentials, which allows to substitute time constraints and explicit revocation by activating and deactivating authorization rights according to events. Our approach is to integrate this concept in IdM systems in a hybrid model supporting delegation, which can be an interesting alternative for scenarios where revocation of consent and user privacy are critical. The delegation includes a SAML compliant protocol, which we have validated through a proof-of-concept implementation. This article also explains the mathematical model describing the event-based model and offers estimations of the overhead introduced by the system. The paper focus on health care scenarios, where we show the flexibility of the proposed event-based user consent revocation mechanism. |
Arias-Cabarcos, Patricia; Almenárez-Mendoza, Florina; Marín-López, Andrés; Díaz-Sánchez, Daniel; Sánchez-Guerrero, Rosa A Metric-Based Approach to Assess Risk for “On Cloud” Federated Identity Management Journal Article Journal of Network and Systems Management, 20 (4), pp. 513-533, 2012, ISSN: 1064-7570. Links | BibTeX | Tags: Cloud computing, Federation, Risk assessment metrics, SAML, Trust management @article{b, title = {A Metric-Based Approach to Assess Risk for “On Cloud” Federated Identity Management}, author = { Patricia Arias-Cabarcos and Florina Almenárez-Mendoza and Andrés Marín-López and Daniel Díaz-Sánchez and Rosa Sánchez-Guerrero}, url = {http://dx.doi.org/10.1007/s10922-012-9244-2}, doi = {10.1007/s10922-012-9244-2}, issn = {1064-7570}, year = {2012}, date = {2012-01-01}, journal = {Journal of Network and Systems Management}, volume = {20}, number = {4}, pages = {513-533}, publisher = {Springer US}, keywords = {Cloud computing, Federation, Risk assessment metrics, SAML, Trust management}, pubstate = {published}, tppubtype = {article} } |
2011 |
Almenarez, F; Arias, P; Diaz-Sanchez, D; Marin, A; Sanchez, R fedTV: personal networks federation for IdM in mobile DTV Journal Article Consumer Electronics, IEEE Transactions on, 57 (2), pp. 499-506, 2011, ISSN: 0098-3063. Abstract | Links | BibTeX | Tags: @article{5955185, title = {fedTV: personal networks federation for IdM in mobile DTV}, author = { F. Almenarez and P. Arias and D. Diaz-Sanchez and A. Marin and R. Sanchez}, doi = {10.1109/TCE.2011.5955185}, issn = {0098-3063}, year = {2011}, date = {2011-05-01}, journal = {Consumer Electronics, IEEE Transactions on}, volume = {57}, number = {2}, pages = {499-506}, abstract = {Mobile Social TV and Mobile Video Blogging are new challenging scenarios arising from mobile and online DTV. They will allow for new interactions, and dynamically share content and delegate services. That requires the dynamic discovery, joining, and establishing new federations, emerging the trust management as an important facet for that. Such trust management should be autonomous, user-centric, and dynamic to cope with forthcoming applications. We propose an enhanced mobile client to support federated environments for cooperation in mobile DTV scenarios. Our proposal extends the Enhanced Client Profile defined in SAML v2, incorporating a trust management layer inside user's consumer electronic devices' software.}, keywords = {}, pubstate = {published}, tppubtype = {article} } Mobile Social TV and Mobile Video Blogging are new challenging scenarios arising from mobile and online DTV. They will allow for new interactions, and dynamically share content and delegate services. That requires the dynamic discovery, joining, and establishing new federations, emerging the trust management as an important facet for that. Such trust management should be autonomous, user-centric, and dynamic to cope with forthcoming applications. We propose an enhanced mobile client to support federated environments for cooperation in mobile DTV scenarios. Our proposal extends the Enhanced Client Profile defined in SAML v2, incorporating a trust management layer inside user's consumer electronic devices' software. |
Díaz-Sánchez, D; Almenarez, F; Marin, A; Proserpio, D; Cabarcos, Arias P Media cloud: an open cloud computing middleware for content management Journal Article Consumer Electronics, IEEE Transactions on, 57 (2), pp. 970-978, 2011, ISSN: 0098-3063. Abstract | Links | BibTeX | Tags: Cloud computing, content distribution, content management, DLNA, Home automation, home network, Indexes, Internet, Media, media cloud, media file sharing, middleware, open cloud computing middleware, Protocols, set-top boxes, Social network services, social networks, UPnP @article{5955247, title = {Media cloud: an open cloud computing middleware for content management}, author = { D. Díaz-Sánchez and F. Almenarez and A. Marin and D. Proserpio and P. Arias Cabarcos}, doi = {10.1109/TCE.2011.5955247}, issn = {0098-3063}, year = {2011}, date = {2011-05-01}, journal = {Consumer Electronics, IEEE Transactions on}, volume = {57}, number = {2}, pages = {970-978}, abstract = {Cloud computing allows accessing resources across Internet transparently: requiring no expertise in, or control over the underlying infrastructure. There is an increasing interest in sharing media files with family and friends. However, UPnP or DLNA were not designed for media distribution beyond the boundaries of a local network and manage media files through web applications can be tedious. To overcome this problem, we propose Media Cloud, a middleware for Set-top boxes for classifying, searching, and delivering media inside home network and across the cloud that interoperates with UPnP and DLNA.}, keywords = {Cloud computing, content distribution, content management, DLNA, Home automation, home network, Indexes, Internet, Media, media cloud, media file sharing, middleware, open cloud computing middleware, Protocols, set-top boxes, Social network services, social networks, UPnP}, pubstate = {published}, tppubtype = {article} } Cloud computing allows accessing resources across Internet transparently: requiring no expertise in, or control over the underlying infrastructure. There is an increasing interest in sharing media files with family and friends. However, UPnP or DLNA were not designed for media distribution beyond the boundaries of a local network and manage media files through web applications can be tedious. To overcome this problem, we propose Media Cloud, a middleware for Set-top boxes for classifying, searching, and delivering media inside home network and across the cloud that interoperates with UPnP and DLNA. |
Proserpio, D; Díaz-Sánchez, D; Almenarez, F; Marin, A; Guerrero, R S Achieving IPTV service portability through delegation Journal Article Consumer Electronics, IEEE Transactions on, 57 (2), pp. 492-498, 2011, ISSN: 0098-3063. Abstract | Links | BibTeX | Tags: Authorization, content protection, delegation, digital right management, Hardware, home network, IPTV, IPTV service portability, IPTV subscription, OAuth protocol, Protocols, Servers, set-top boxes, Subscriptions, tamper proof hardware, telecommunication services, TV over IP @article{5955184, title = {Achieving IPTV service portability through delegation}, author = { D. Proserpio and D. Díaz-Sánchez and F. Almenarez and A. Marin and R.S. Guerrero}, doi = {10.1109/TCE.2011.5955184}, issn = {0098-3063}, year = {2011}, date = {2011-05-01}, journal = {Consumer Electronics, IEEE Transactions on}, volume = {57}, number = {2}, pages = {492-498}, abstract = {IPTV Set-top boxes rely on tamper proof hardware to cope with content protection but hampers enjoying an IPTV subscription in other devices. There are solutions that share the IPTV subscription using the home network but there is no approach to make the IPTV subscription portable. This article describes a solution to delegate IPTV rights to any STB using an inexpensive piece of hardware and the OAuth protocol.}, keywords = {Authorization, content protection, delegation, digital right management, Hardware, home network, IPTV, IPTV service portability, IPTV subscription, OAuth protocol, Protocols, Servers, set-top boxes, Subscriptions, tamper proof hardware, telecommunication services, TV over IP}, pubstate = {published}, tppubtype = {article} } IPTV Set-top boxes rely on tamper proof hardware to cope with content protection but hampers enjoying an IPTV subscription in other devices. There are solutions that share the IPTV subscription using the home network but there is no approach to make the IPTV subscription portable. This article describes a solution to delegate IPTV rights to any STB using an inexpensive piece of hardware and the OAuth protocol. |
Cabarcos, Arias P; Guerrero, R S; Mendoza, F A; Díaz-Sánchez, D; Lopez, Marin A FamTV: An architecture for presence-aware personalized television Journal Article Consumer Electronics, IEEE Transactions on, 57 (1), pp. 6-13, 2011, ISSN: 0098-3063. Abstract | Links | BibTeX | Tags: Bluetooth, content overloaded digital home, content personalization, digital era, digital television, Digital TV, direct consequence, ecology, ecosystem, History, Identity management, Internet, presence aware personalized television, presence detection, Privacy, Radiofrequency identification, security, TV @article{5735473, title = {FamTV: An architecture for presence-aware personalized television}, author = { P. Arias Cabarcos and R.S. Guerrero and F.A. Mendoza and D. Díaz-Sánchez and A. Marin Lopez}, doi = {10.1109/TCE.2011.5735473}, issn = {0098-3063}, year = {2011}, date = {2011-02-01}, journal = {Consumer Electronics, IEEE Transactions on}, volume = {57}, number = {1}, pages = {6-13}, abstract = {Since the advent of the digital era, the traditional TV scenario has rapidly evolved towards an ecosystem comprised of a myriad of services, applications, channels, and contents. As a direct consequence, the amount of available information and configuration options targeted at today's end consumers have become unmanageable. Thus, personalization and usability emerge as indispensable elements to improve our content-overloaded digital homes. With these requirements in mind, we present a way to combine content adaptation paradigms together with presence detection in order to allow a seamless and personalized entertainment experience when watching TV.}, keywords = {Bluetooth, content overloaded digital home, content personalization, digital era, digital television, Digital TV, direct consequence, ecology, ecosystem, History, Identity management, Internet, presence aware personalized television, presence detection, Privacy, Radiofrequency identification, security, TV}, pubstate = {published}, tppubtype = {article} } Since the advent of the digital era, the traditional TV scenario has rapidly evolved towards an ecosystem comprised of a myriad of services, applications, channels, and contents. As a direct consequence, the amount of available information and configuration options targeted at today's end consumers have become unmanageable. Thus, personalization and usability emerge as indispensable elements to improve our content-overloaded digital homes. With these requirements in mind, we present a way to combine content adaptation paradigms together with presence detection in order to allow a seamless and personalized entertainment experience when watching TV. |
Almenárez, Florina; Marín, Andrés; Díaz, Daniel; Cortés, Alberto; Campo, Celeste; García-Rubio, Carlos Trust management for multimedia P2P applications in autonomic networking Journal Article Ad Hoc Networks, 9 (4), pp. 687 - 697, 2011, ISSN: 1570-8705, (Multimedia Ad Hoc and Sensor Networks). Abstract | Links | BibTeX | Tags: Autonomic networking @article{Almenárez2011687, title = {Trust management for multimedia P2P applications in autonomic networking}, author = {Florina Almenárez and Andrés Marín and Daniel Díaz and Alberto Cortés and Celeste Campo and Carlos García-Rubio}, url = {http://www.sciencedirect.com/science/article/pii/S1570870510001459}, doi = {http://dx.doi.org/10.1016/j.adhoc.2010.09.005}, issn = {1570-8705}, year = {2011}, date = {2011-01-01}, journal = {Ad Hoc Networks}, volume = {9}, number = {4}, pages = {687 - 697}, abstract = {In the last years, trust management has become a fundamental basis for facilitating the cooperation between different users in peer-to-peer (P2P) multimedia applications within autonomic networks. In these networks and applications, trust management should fulfill certain requirements (i.e. decentralisation, dynamism, simplicity, interoperability, etc.) for being functional. In this paper, we propose an evolutionary model of trust management that captures dynamic entities’ behaviour over time. Likewise, we explain protection mechanisms against several attacks, which are based on the cooperative behaviour of the entities, trust relationship properties, and trust rules. Finally, we successfully validate our model from several scenarios and compare it with other proposals in this field.}, note = {Multimedia Ad Hoc and Sensor Networks}, keywords = {Autonomic networking}, pubstate = {published}, tppubtype = {article} } In the last years, trust management has become a fundamental basis for facilitating the cooperation between different users in peer-to-peer (P2P) multimedia applications within autonomic networks. In these networks and applications, trust management should fulfill certain requirements (i.e. decentralisation, dynamism, simplicity, interoperability, etc.) for being functional. In this paper, we propose an evolutionary model of trust management that captures dynamic entities’ behaviour over time. Likewise, we explain protection mechanisms against several attacks, which are based on the cooperative behaviour of the entities, trust relationship properties, and trust rules. Finally, we successfully validate our model from several scenarios and compare it with other proposals in this field. |
2010 |
Diaz-Sanchez, D; Sanvido, F; Proserpio, D; Marin, A DLNA, DVB-CA and DVB-CPCM integration for commercial content management Journal Article IEEE Transactions on Consumer Electronics, 56 (1), pp. 79-87, 2010, ISSN: 0098-3063. Abstract | Links | BibTeX | Tags: commercial content management, Conditional access system, Consumer electronics, content management, content protection, copy management, copy protection, digital living network alliance, digital video broadcasting, Displays, DLNA, DVB-CA, DVB-CPCM, Hardware, Home automation, home network, household networked consumer electronics, Protection, security, Telematics, User-generated content, user-generated contents @article{5439129, title = {DLNA, DVB-CA and DVB-CPCM integration for commercial content management}, author = {D. Diaz-Sanchez and F. Sanvido and D. Proserpio and A. Marin}, doi = {10.1109/TCE.2010.5439129}, issn = {0098-3063}, year = {2010}, date = {2010-02-01}, journal = {IEEE Transactions on Consumer Electronics}, volume = {56}, number = {1}, pages = {79-87}, abstract = {DLNA can be considered as a good candidate for sharing user-generated contents among household networked consumer electronics. However, commercial content sharing requires a high degree of device protection that DLNA does not provides. We propose a solution supporting acquisition and post acquisition content protection by the integration of DLNA with DVB Conditional Access and DVB Content Protection & Copy Management. This article shows the design and implementation of a solution to improve commercial content management over DLNA.}, keywords = {commercial content management, Conditional access system, Consumer electronics, content management, content protection, copy management, copy protection, digital living network alliance, digital video broadcasting, Displays, DLNA, DVB-CA, DVB-CPCM, Hardware, Home automation, home network, household networked consumer electronics, Protection, security, Telematics, User-generated content, user-generated contents}, pubstate = {published}, tppubtype = {article} } DLNA can be considered as a good candidate for sharing user-generated contents among household networked consumer electronics. However, commercial content sharing requires a high degree of device protection that DLNA does not provides. We propose a solution supporting acquisition and post acquisition content protection by the integration of DLNA with DVB Conditional Access and DVB Content Protection & Copy Management. This article shows the design and implementation of a solution to improve commercial content management over DLNA. |
Diaz-Sanchez, D; Marin, A; Almenarez, F; Cortes, A Social applications in the home network Journal Article IEEE Transactions on Consumer Electronics, 56 (1), pp. 220-225, 2010, ISSN: 0098-3063. Abstract | Links | BibTeX | Tags: credential management, data privacy, Fans, Home automation, home computing, home devices, home network, home networks, Information services, Internet, internetworking, media gateways, Multimedia systems, Privacy, Privacy in social networks, Prototypes, security policy, set-top boxes, Social network services, social networks, telecommunication computing, Telematics, user information, user privacy, Videos @article{5439148, title = {Social applications in the home network}, author = {D. Diaz-Sanchez and A. Marin and F. Almenarez and A. Cortes}, doi = {10.1109/TCE.2010.5439148}, issn = {0098-3063}, year = {2010}, date = {2010-02-01}, journal = {IEEE Transactions on Consumer Electronics}, volume = {56}, number = {1}, pages = {220-225}, abstract = {Home devices like set-top boxes and media gateways are a rich source of users' information. They can play a role to facilitate interactions with friends and relatives in social networks. However these interactions have to follow policies to safeguard users' privacy while maintaining the complexity low for the average user. In this article we prototype an architecture based for home devices to participate in social networks. Besides, we explore the privacy issues and how the privacy offered in social networks can be improved.}, keywords = {credential management, data privacy, Fans, Home automation, home computing, home devices, home network, home networks, Information services, Internet, internetworking, media gateways, Multimedia systems, Privacy, Privacy in social networks, Prototypes, security policy, set-top boxes, Social network services, social networks, telecommunication computing, Telematics, user information, user privacy, Videos}, pubstate = {published}, tppubtype = {article} } Home devices like set-top boxes and media gateways are a rich source of users' information. They can play a role to facilitate interactions with friends and relatives in social networks. However these interactions have to follow policies to safeguard users' privacy while maintaining the complexity low for the average user. In this article we prototype an architecture based for home devices to participate in social networks. Besides, we explore the privacy issues and how the privacy offered in social networks can be improved. |
Forné, Jordi; Hinarejos, Francisca; Marín, Andrés; Almenárez, Florina; Lopez, Javier; Montenegro, Jose A; Lacoste, Marc; Díaz, Daniel Pervasive authentication and authorization infrastructures for mobile users Journal Article Computers & Security, 29 (4), pp. 501 - 514, 2010, ISSN: 0167-4048. Abstract | Links | BibTeX | Tags: Security architecture @article{Forné2010501, title = {Pervasive authentication and authorization infrastructures for mobile users}, author = {Jordi Forné and Francisca Hinarejos and Andrés Marín and Florina Almenárez and Javier Lopez and Jose A. Montenegro and Marc Lacoste and Daniel Díaz}, url = {http://www.sciencedirect.com/science/article/pii/S0167404809000911}, doi = {http://dx.doi.org/10.1016/j.cose.2009.09.001}, issn = {0167-4048}, year = {2010}, date = {2010-01-01}, journal = {Computers & Security}, volume = {29}, number = {4}, pages = {501 - 514}, abstract = {Network and device heterogeneity, nomadic mobility, intermittent connectivity and, more generally, extremely dynamic operating conditions, are major challenges in the design of security infrastructures for pervasive computing. Yet, in a ubiquitous computing environment, limitations of traditional solutions for authentication and authorization can be overcome with a pervasive public key infrastructure (pervasive-PKI). This choice allows the validation of credentials of users roaming between heterogeneous networks, even when global connectivity is lost and some services are temporarily unreachable. Proof-of-concept implementations and testbed validation results demonstrate that strong security can be achieved for users and applications through the combination of traditional PKI services with a number of enhancements like: (i) dynamic and collaborative trust model, (ii) use of attribute certificates for privilege management, and (iii) modular architecture enabling nomadic mobility and enhanced with reconfiguration capabilities.}, keywords = {Security architecture}, pubstate = {published}, tppubtype = {article} } Network and device heterogeneity, nomadic mobility, intermittent connectivity and, more generally, extremely dynamic operating conditions, are major challenges in the design of security infrastructures for pervasive computing. Yet, in a ubiquitous computing environment, limitations of traditional solutions for authentication and authorization can be overcome with a pervasive public key infrastructure (pervasive-PKI). This choice allows the validation of credentials of users roaming between heterogeneous networks, even when global connectivity is lost and some services are temporarily unreachable. Proof-of-concept implementations and testbed validation results demonstrate that strong security can be achieved for users and applications through the combination of traditional PKI services with a number of enhancements like: (i) dynamic and collaborative trust model, (ii) use of attribute certificates for privilege management, and (iii) modular architecture enabling nomadic mobility and enhanced with reconfiguration capabilities. |
2009 |
Arias-Cabarcos, Patricia; Almenárez-Mendoza, Florina; Marín-López, Andrés; Díaz-Sánchez, Daniel Enabling SAML for dynamic identity federation management Conference Wireless and Mobile Networking Conference. Second IFIP WG 6.8 Joint Conference, WMNC 2009, Gdańsk, Poland, September 9-11, 2009. Proceedings, 2009, ISBN: 978-3-642-03840-2. Abstract | Links | BibTeX | Tags: Dynamic Trust, Identity federation, Reputation, SAML @conference{Arias-Cabarcos2009, title = {Enabling SAML for dynamic identity federation management}, author = {Patricia Arias-Cabarcos and Florina Almenárez-Mendoza and Andrés Marín-López and Daniel Díaz-Sánchez}, url = {http://dx.doi.org/10.1007/978-3-642-03841-9_16}, doi = {10.1007/978-3-642-03841-9_16}, isbn = {978-3-642-03840-2}, year = {2009}, date = {2009-09-09}, booktitle = {Wireless and Mobile Networking Conference. Second IFIP WG 6.8 Joint Conference, WMNC 2009, Gdańsk, Poland, September 9-11, 2009. Proceedings}, pages = {173-184}, abstract = {Federation in identity management has emerged as a key concept for reducing complexity in the companies and offering an improved user experience when accessing services. In this sense, the process of trust establishment is fundamental to allow rapid and seamless interaction between different trust domains. However, the problem of establishing identity federations in dynamic and open environments that form part of Next Generation Networks (NGNs), where it is desirable to speed up the processes of service provisioning and deprovisioning, has not been fully addressed. This paper analyzes the underlying trust mechanisms of the existing frameworks for federated identity management and its suitability to be applied in the mentioned environments. This analysis is mainly focused on the Single Sign On (SSO) profile. We propose a generic extension for the SAML standard in order to facilitate the creation of federation relationships in a dynamic way between prior unknown parties. Finally, we give some details of implementation and compatibility issues.}, keywords = {Dynamic Trust, Identity federation, Reputation, SAML}, pubstate = {published}, tppubtype = {conference} } Federation in identity management has emerged as a key concept for reducing complexity in the companies and offering an improved user experience when accessing services. In this sense, the process of trust establishment is fundamental to allow rapid and seamless interaction between different trust domains. However, the problem of establishing identity federations in dynamic and open environments that form part of Next Generation Networks (NGNs), where it is desirable to speed up the processes of service provisioning and deprovisioning, has not been fully addressed. This paper analyzes the underlying trust mechanisms of the existing frameworks for federated identity management and its suitability to be applied in the mentioned environments. This analysis is mainly focused on the Single Sign On (SSO) profile. We propose a generic extension for the SAML standard in order to facilitate the creation of federation relationships in a dynamic way between prior unknown parties. Finally, we give some details of implementation and compatibility issues. |
Diaz-Sanchez, D; Marin, A; Almenarez, F; Cortes, A Sharing conditional access modules through the home network for pay TV access Journal Article IEEE Transactions on Consumer Electronics, 55 (1), pp. 88-96, 2009, ISSN: 0098-3063. Abstract | Links | BibTeX | Tags: Codecs, conditional access module, Conditional access system, Content addressable storage, content protection, content protection and sharing, cryptographic protocols, descambler registration protocol, descrambler registration protocol, digital video broadcasting, Home automation, home computing, home gateway, home network, internetworking, IPTV, pay TV access, Protection, Satellite broadcasting, smart cards, Telematics, TV, Visualization @article{4814419, title = {Sharing conditional access modules through the home network for pay TV access}, author = {D. Diaz-Sanchez and A. Marin and F. Almenarez and A. Cortes}, doi = {10.1109/TCE.2009.4814419}, issn = {0098-3063}, year = {2009}, date = {2009-02-01}, journal = {IEEE Transactions on Consumer Electronics}, volume = {55}, number = {1}, pages = {88-96}, abstract = {In this article we present a system for sharing a Conditional Access Module among different visualization devices. Current pay-TV systems require having conditional access modules and smart cards replicated at every visualization device willing to access Pay-TV contents. In this article, we show how a home gateway, capable of securely distribute decryption keys to home visualization device, an inexpensive descrambler, and a home network, enable a flexible solution to access Pay-TV.}, keywords = {Codecs, conditional access module, Conditional access system, Content addressable storage, content protection, content protection and sharing, cryptographic protocols, descambler registration protocol, descrambler registration protocol, digital video broadcasting, Home automation, home computing, home gateway, home network, internetworking, IPTV, pay TV access, Protection, Satellite broadcasting, smart cards, Telematics, TV, Visualization}, pubstate = {published}, tppubtype = {article} } In this article we present a system for sharing a Conditional Access Module among different visualization devices. Current pay-TV systems require having conditional access modules and smart cards replicated at every visualization device willing to access Pay-TV contents. In this article, we show how a home gateway, capable of securely distribute decryption keys to home visualization device, an inexpensive descrambler, and a home network, enable a flexible solution to access Pay-TV. |
2008 |
Cortes, A; Garcia-Rubio, C; Campo, C; Marin, A; Almenarez, F; Diaz, D Decoupling path failure detection from congestion control to improve SCTP failovers Journal Article IEEE Communications Letters, 12 (11), pp. 858-860, 2008, ISSN: 1089-7798. Abstract | Links | BibTeX | Tags: active path monitoring, Automatic control, Computer network reliability, Condition monitoring, congestion control, decoupling path failure detection, Delay effects, Force control, mobile communication, mobility solution, Object detection, Phase frequency detector, Probes, SCTP failovers improvement, TCPIP, telecommunication congestion control, Telematics, transport protocol, transport protocols, unreliable heartbeats @article{4685978, title = {Decoupling path failure detection from congestion control to improve SCTP failovers}, author = {A. Cortes and C. Garcia-Rubio and C. Campo and A. Marin and F. Almenarez and D. Diaz}, doi = {10.1109/LCOMM.2008.080884}, issn = {1089-7798}, year = {2008}, date = {2008-11-01}, journal = {IEEE Communications Letters}, volume = {12}, number = {11}, pages = {858-860}, abstract = {SCTP handover is too slow to be useful as a mobility solution for most applications. With quicker handovers, SCTP will be an interesting solution to mobility. SCTP uses retransmissions as probes for path failure detection. Congestion control forces slow paced retransmissions but quick failovers need fast paced probes. Our solution is to stop using retransmissions as probes. Instead, we propose active path monitoring using unreliable heartbeats. Applications can tune this algorithm to meet their own requirements. We show data from a simple experiment in a real environment.}, keywords = {active path monitoring, Automatic control, Computer network reliability, Condition monitoring, congestion control, decoupling path failure detection, Delay effects, Force control, mobile communication, mobility solution, Object detection, Phase frequency detector, Probes, SCTP failovers improvement, TCPIP, telecommunication congestion control, Telematics, transport protocol, transport protocols, unreliable heartbeats}, pubstate = {published}, tppubtype = {article} } SCTP handover is too slow to be useful as a mobility solution for most applications. With quicker handovers, SCTP will be an interesting solution to mobility. SCTP uses retransmissions as probes for path failure detection. Congestion control forces slow paced retransmissions but quick failovers need fast paced probes. Our solution is to stop using retransmissions as probes. Instead, we propose active path monitoring using unreliable heartbeats. Applications can tune this algorithm to meet their own requirements. We show data from a simple experiment in a real environment. |
2007 |
Sanchez, Daniel Díaz; , Marin Lopez Andres; , Almenarez Mendoza Florina; , Campo Vazquez Celeste; Carlos, Garcia-Rubio Context awareness in network selection for dynamic environments Journal Article Telecommunication Systems, 36 (1), pp. 49–60, 2007, ISSN: 1572-9451. Abstract | Links | BibTeX | Tags: Context-awareness, Mobile devices, network selection, Pervasive computing @article{DíazSánchez2007, title = {Context awareness in network selection for dynamic environments}, author = { Daniel Díaz Sanchez and Marin Lopez Andres and Almenarez Mendoza Florina and Campo Vazquez Celeste and Garcia-Rubio Carlos }, url = {http://dx.doi.org/10.1007/s11235-007-9058-9}, doi = {10.1007/s11235-007-9058-9}, issn = {1572-9451}, year = {2007}, date = {2007-01-01}, journal = {Telecommunication Systems}, volume = {36}, number = {1}, pages = {49--60}, abstract = {Mobile devices of new generation are able to connect to multiple networks and to constitute new infrastructureless networks. These dynamic environments require new security paradigms and automatic mechanisms to minimize user intervention. Our goal is the definition of a new concept of distance that considers the current domain constraints and the user preferences. This paper addresses some of the problems of these complex environments by using Multidimensional Scaling (MDS) techniques. We also propose collaborative mechanisms for automatic environment marking. Based on these ideas we have developed Pervasive Interaction Manager (PervsIM), a decision mechanism that selects the most appropriate network or peer to interact with. Besides we have defined an embedded access control module which ensures that PervsIM decisions are followed by all applications. Furthermore, several simulation results and implementation details outline how these results can be incorporated in today's mobile devices.}, keywords = {Context-awareness, Mobile devices, network selection, Pervasive computing}, pubstate = {published}, tppubtype = {article} } Mobile devices of new generation are able to connect to multiple networks and to constitute new infrastructureless networks. These dynamic environments require new security paradigms and automatic mechanisms to minimize user intervention. Our goal is the definition of a new concept of distance that considers the current domain constraints and the user preferences. This paper addresses some of the problems of these complex environments by using Multidimensional Scaling (MDS) techniques. We also propose collaborative mechanisms for automatic environment marking. Based on these ideas we have developed Pervasive Interaction Manager (PervsIM), a decision mechanism that selects the most appropriate network or peer to interact with. Besides we have defined an embedded access control module which ensures that PervsIM decisions are followed by all applications. Furthermore, several simulation results and implementation details outline how these results can be incorporated in today's mobile devices. |
2006 |
Campo, Celeste; Almenárez, Florina; Díaz, Daniel; García-Rubio, Carlos; López, Andrés Marín Secure Service Discovery based on Trust Management for ad-hoc Networks Journal Article 12 (3), pp. 340–356, 2006, (url|http://www.jucs.org/jucs_12_3/secure_service_discovery_based|). Abstract | BibTeX | Tags: ad-hoc networks, security, service discovery protocol, trust @article{Campo:jucs_12_3:secure_service_discovery_based, title = {Secure Service Discovery based on Trust Management for ad-hoc Networks}, author = {Celeste Campo and Florina Almenárez and Daniel Díaz and Carlos García-Rubio and Andrés Marín López}, year = {2006}, date = {2006-03-28}, volume = {12}, number = {3}, pages = {340--356}, abstract = {In ad-hoc networks, mobile devices communicate via wireless links without the aid of any fixed networking infrastructure. These devices must be able to discover services dynamically and share them safely, taking into account ad-hoc net-works requirements such as limited processing and communication power, decentralised management, and dynamic network topology, among others. Legacy solutions fail in addressing these requirements. In this paper, we propose a service discovery protocol with security features, the Secure Pervasive Discovery Protocol. SPDP is a fully distributed protocol in which services offered by devices can be discovered by others, without a central server. It is based on an anarchy trust model, which provides location of trusted services, as well as protection of confidential information, secure communications, or access control.}, note = {url|http://www.jucs.org/jucs_12_3/secure_service_discovery_based|}, keywords = {ad-hoc networks, security, service discovery protocol, trust}, pubstate = {published}, tppubtype = {article} } In ad-hoc networks, mobile devices communicate via wireless links without the aid of any fixed networking infrastructure. These devices must be able to discover services dynamically and share them safely, taking into account ad-hoc net-works requirements such as limited processing and communication power, decentralised management, and dynamic network topology, among others. Legacy solutions fail in addressing these requirements. In this paper, we propose a service discovery protocol with security features, the Secure Pervasive Discovery Protocol. SPDP is a fully distributed protocol in which services offered by devices can be discovered by others, without a central server. It is based on an anarchy trust model, which provides location of trusted services, as well as protection of confidential information, secure communications, or access control. |
2004 |
, Florina; , Diaz Daniel; Almenarez, Marin Andres Secure Ad-Hoc mBusiness: Enhancing WindowsCE Security Journal Article Lecture Notes in Computer Science (LNCS), pp. 90–99, 2004, ISBN: 978-3-540-30079-3. Links | BibTeX | Tags: Pervasive computing, Trust management @article{Alménarez2004, title = {Secure Ad-Hoc mBusiness: Enhancing WindowsCE Security}, author = { Florina and Diaz Daniel and Marin Andres Almenarez}, editor = {Katsikas, Sokratis and Lopez, Javier and Pernul, Gunther}, url = {http://dx.doi.org/10.1007/978-3-540-30079-3_10}, doi = {10.1007/978-3-540-30079-3_10}, isbn = {978-3-540-30079-3}, year = {2004}, date = {2004-01-01}, booktitle = {Trust and Privacy in Digital Business: First International Conference, TrustBus 2004, Zaragoza, Spain, August 30 - September 1, 2004. Proceedings}, journal = {Lecture Notes in Computer Science (LNCS)}, pages = {90--99}, publisher = {Springer Berlin Heidelberg}, address = {Berlin, Heidelberg}, keywords = {Pervasive computing, Trust management}, pubstate = {published}, tppubtype = {article} } |