OAuth is the most commonly used access delegation protocol. It enables the connection of different APIs to build increasingly sophisticated applications that enhance and amplify our abilities. Increasingly, OAuth is used in applications where a significant amount of personal data is exposed about users. Despite this privacy risk, in most OAuth flows that a user encounters, there is a lack of fine-grained control over the amount of data that is shared on behalf of users. To mitigate these privacy issues we design and implement utAPIa, a middleware which enforces privacy policies on OAuth delegations. utAPIa allows users to modify API responses that are made on their behalf by filtering unrelated attributes and protecting their sensitive information. To enforce privacy policies, utAPIa uses OAuth's standardized Rich Authorization Requests (RAR) extension, requiring no modifications to the existing OAuth protocol. We evaluate utAPIa in a proof-of-concept implementation and show the feasibility of our design, which incurs a reasonable performance overhead.

OAuth is the most commonly used access delegation protocol. It enables the connection of different APIs to build increasingly sophisticated applications that enhance and amplify our abilities. Increasingly, OAuth is used in applications where a significant amount of personal data is exposed about users. Despite this privacy risk, in most OAuth flows that a user encounters, there is a lack of fine-grained control over the amount of data that is shared on behalf of users. To mitigate these privacy issues we design and implement utAPIa, a middleware which enforces privacy policies on OAuth delegations. utAPIa allows users to modify API responses that are made on their behalf by filtering unrelated attributes and protecting their sensitive information. To enforce privacy policies, utAPIa uses OAuth's standardized Rich Authorization Requests (RAR) extension, requiring no modifications to the existing OAuth protocol. We evaluate utAPIa in a proof-of-concept implementation and show the feasibility of our design, which incurs a reasonable performance overhead.

The PhD project presented in this paper aims to design a trust management infrastructure that allows to assess the trustworthiness of context data in the scope of access control with the IoT. The main requirements for this design are independence from the underlying access control model and flexibility of trust calculation schemes based on application needs.

Email is among the cornerstones of our online lives. It has evolved from carrying text-only messages to delivering well-designed HTML contents. The uptake of web protocols into email, however, has facilitated the migration of web tracking techniques into email ecosystem. While recent privacy regulations have impacted the web tracking technologies, they have not directly influenced the email tracking techniques. In this short paper, we analyze a corpus of 5216 emails, give an overview of the identified tracking techniques, and argue that the existing email tracking methods do not comply with privacy regulations.

In Internet of Things (IoT) environments, sensors measure and quantify properties of physical locations, objects and even people. Context-aware access control systems include this data in the decision making process to improve their accuracy and precision. However, access control systems can fail when unexpected situations occur for which no access rules have been defined. One solution implemented by access control systems for critical infrastructure (e.g. a hospital, factory production line), is to break the glass in case of emergency to temporarily obtain the necessary privileges. During this process, sufficient non-repudiation evidence must be collected, which is audited at a later stage to verify whether the emergency access was justified. Shortcomings of existing Break Glass models are twofold: firstly, Break Glass is mostly considered as a static process for which the activation requirements and granted privileges are not adapted to the context of the emergency situation; secondly, a closed environment such as a hospital with authenticated caregivers is generally assumed, which is not realistic for open environments.In this paper, we present a context-aware Break Glass system architecture, which uses contextual information to detect ongoing emergencies, and allows the activation requirements and temporary privileges to be be adapted to the current situation or emergency. Furthermore, the system includes a fail-safe operation to disable the Break Glass activation if the emergency was wrongly detected. Our prototype shows the soundness of the design and its practical feasibility to be used in time-critical scenarios.

Internet of Things (IoT) environments are composed of heterogeneous sensors and devices that collect and share contextual information. This data can improve the accuracy and usability of access control systems, as authentication and authorization requirements can be specified more precisely. However, certain security requirements need to be enforced in order to use such data in access control decision processes. In short, the data must be authentic, recent, and unforgeable. In this paper, we present a generic model for context, which takes datasecurity into account along with properties about the device, or context-source. Security-objects, such as message signatures, are modeled as proofs, which are verifiable, while information about the context-source, communication channel, and the data itself is captured as meta-data. This model allows an access control system to verify the authenticity and trustworthiness of contextdata by (1) checking the presence of a specific proof and verifying it, and (2) analyzing the associated meta-data. It covers not only data from IoT sources, but also authorization and identity tokens. In addition, we present IoTSEAR, a middleware for trustworthy context-aware access control, which uses this model internally. Finally, we show performance results of our IoTSEAR prototype, which show that the overhead is low and that the system is usable even on commodity hardware. Keywords–Access Control, Security, Internet of Things

The security of cyber-physical systems (CPS) is often lacking. This abstract presents a methodology that performs a security evaluation of these systems by automatically generating attack trees based on the system model. The assessor can define different kinds of attackers and see how the attack tree is evaluated with respect to a specific type of attacker. Optimal attacker strategies are calculated and from here the most vulnerable elements of the system can be derived.

Data analytics, especially in the era of Big Data, opens huge possibilities in governmental contexts. These contexts are unfortunately very fragmented and often involve the processing of personal identifiable information (PII). Since anonymisation techniques fail at truly anonymising large citizen records, the data remain in a legal sense PII to which, hence, the privacy legislation still applies. The data owner (controller) is therefore still responsible and liable for the data. This paper presents a flexible approach consistent with the European privacy legislation which 1) enables easy linking of records, 2) maximizes the control of the data-delivering government agencies, 3) minimizes the impact in case of a data breach, and 4) allows for controlled deanonymisation.

Cyber-physical systems are increasingly automated and interconnected. Strategies like predictive maintenance are on the rise and as a result new streams of data will flow through these systems. This data is often confidential, which can be a problem in these low-security systems. In addition, more stakeholders are now involved and various cloud-based service providers are utilised. Companies often no longer know who gets to see their data. This paper presents a methodology that aims to analyse these data flows. The methodology takes as input a set of data asset preferences and service policies, as well as the asset flow of the system. It then returns feedback in the form of an asset profile showing which stakeholders have access to what data assets, and conflicts between the preferences and the modeled situation. Several possible actors with different preferences are modeled for each stakeholder role in the system, the scenarios with the fewest conflicts are returned. The methodology is validated on a case study and has been added to the FAST-CPS framework.

Erratum to: B. De Decker et al. (Eds.) Advances in Network and Distributed Systems Security DOI: 10.1007/978-0-306-46958-9

Erratum to: B. de Decker et al. (Eds.) Communications and Multimedia Security DOI: 10.1007/978-3-642-24712-5 The book was inadvertently published with an incorrect name of the copyright holder. The name of the copyright holder for this book is: © IFIP International Federation for Information Processing. The book has been updated with the changes.

In the last decade, the Internet landscape transformed into a service platform. This evolution has brought more importance to security requirements like strong authentication. We propose a secure and privacy-friendly way to augment authentication mechanisms of Online services by taking context into account. Contextual information, such as location, proximity or the current role of a user in a system is useful to help authenticate and authorize users. Context, however, is often of a personal nature and introduces privacy risks. In addition, a source of such contextual information should provide trustworthy information. In this work, a policy language to express attribute-based and contextual requirements is proposed. In addition, we define a set of protocols to gather, verify and use contextual information and user-attributes originating from third-party systems. The system protects the user's privacy as service providers do not learn precise context information, and avoids linkabilities. Finally, we have implemented this system and our experimental evaluation shows that it is practical to use.

Cyber-Physical Systems are heavily used in today's world. However, their security leaves much to be desired. Attacks such as the Stuxnet worm and the Ukrainian Grid Hack have shown that compromising these systems can have disastrous consequences. It follows that additional methods for assessing the security of these systems must be explored. To this end, several tools have been developed. In this paper, five existing tools that examine the security of cyber-physical systems are presented. The input models and feedback of these tools are then compared with each other. A real life case study has been modelled in all five tools to achieve this. Two versions of this case study are implemented, one with a DMZ in the network and one without. The five tools are evaluated and their strengths and weaknesses for assessing the security of cyber-physical systems are analysed. Finally, additional methods for the security assessment are touched upon, and we discuss how they can be used together with the tools.

Purpose– The medical advances and historical fluctuations in the demographics are contributing to the rise of the average age. These changes are increasing the pressure to organize adequate care to a growing number of individuals. As a way to provide efficient and cost-effective care, eHealth systems are gaining importance. However, this trend is creating new ethical concerns. Major issues are privacy and patients’ control over their data. To deploy these systems on a large scale, they need to offer strict privacy protection. Even though many research proposals focus on eHealth systems and related ethical requirements, there is an evident lack of practical solutions for protecting users’ personal information. The purpose of this study is to explore the ethical considerations related to these systems and extract the privacy requirements. This paper also aims to put forth a system design which ensures appropriate privacy protection.Design/methodology/approach– This paper investigates the existing work in the area of eHealth systems and the related ethical considerations, which establish privacy as one of the main requirements. It lists the ethical requirements and data protection standards that a system needs to fulfil and uses them as a guideline for creating the proposed design.Findings– Even though privacy is considered to be a paramount aspect of the eHealth systems, the existing proposals do not tackle this issue from the outset of the design. Consequently, introducing privacy at the final stages of the system deployment imposes significant limitations and the provided data protection is not always to the standards expected by the users.Originality/value– This paper motivates the need for addressing ethical concerns in the eHealth domain with special focus on establishing strict privacy protection. It lists the privacy requirements and offers practical solutions for developing a privacy-friendly system and takes the approach of privacy-by-design. Additionally, the proposed design is evaluated against ethical principles as proposed in the existing literature. The aim is to show that technological advances can be used to improve quality and efficiency of care, while the usually raised concerns can be avoided.

This paper presents a generic lightweight solution for authentication between powerful devices and resource constrained nodes. The approach is validated through the architectural design of multiple applications in different domains. The paper further discusses variants that might increase the usability of the approach in different settings. More precisely, the solution is tuned for open systems, closed systems and hierarchically structured systems. Further, two use cases are presented in which the open system and closed system approach is applied. Copyright © 2011 John Wiley & Sons, Ltd.

We propose a secure and privacy friendly way to strengthen authentication mechanisms of online services by taking context into account. The use of context, however, is often of a personal nature (e.g. location) and introduces privacy risks. Furthermore, some context sources can be spoofed, and hence, the level of trust of a verifier in a context source can vary. In this paper, a policy language to express contextual constraints is proposed. In addition, a set of protocols to gather, verify and use contextual information in access control decisions is described. The system protects user privacy as service providers do not learn precise context information, and avoids linkabilities. Finally, we have implemented this system and our experimental evaluation shows that it is practical to use.

Millions of users rely on email providers to manage and store their personal communications. This vast amount of private information, however, is often misused not only by adversaries, but also by the providers themselves. End-to-end email encryption is considered the most robust defense against this threat, however, its many requirements make this approach impractical for protecting everyday emails. In this paper, we present Email Cloak, an email alias service with public key encryption capabilities. Email Cloak relaxes email encryption requirements by relying on a privacy-respecting third-party. Emails sent and received by the user are automatically encrypted with her public key by Email Cloak before being forwarded to, and stored by her email provider. This approach, while seemingly straightforward, offers multiple benefits: simplified key management, selective and automatic encryption, advanced deployment options and transparency towards other parties. Moreover, our experimental evaluation shows that the overhead introduced by Email Cloak is adequate for email communications. We have also made our implementation publicly available. In doing so, we deliver a practical and flexible tool that provides privacy-concerned users with greater control over their stored emails.

Individuals disclose personal information to complex services via their front-end which interacts with underlying sub-services. The services involve multiple collaborating parties that may share the collected personal data to accurately profile individuals. Even though their data handling practices are declared in their privacy policies, they are still opaque for individuals. Data protection regulations restrain service providers to collect personal data that is strictly necessary for their purposes. The present paper shows the potential of a logic based framework for analyzing privacy of electronic services by applying the approach to two loyalty schemes. Different query types are defined that provide meaningful feedback for both end users and service designers.

The public transport ticketing systems are undergoing significant changes in recent years. The tickets can now be issued and presented in digital form, significantly improving the user experience. The digital data is also used to improve the services' efficiency. Travelling patterns and route occupancy can be analysed to adjust the frequency and coverage of the service. However, data recorded by the providers extends the information that is needed for simple analysis. The travel passes that are issued usually contain unique identifiers, allowing to trace the movement of users, which can even be linked to their identities. In order to tackle these privacy issues, we propose a novel, privacy-preserving ticketing system, based on a scheme for issuing and redemption of unlinkable certified tokens. The design also allows offering advanced services, such as reduction plans or monthly passes, without introducing privacy concerns. Even though the travellers' actions cannot be linked, the service providers are given assurances against possible misuse, and are able to control the usage of the issued products. Additionally, experimental evaluation shows that the system performance is adequate for practical applications.