Containerized workloads are commonly built via CI/CD pipelines, stored in registries, and executed across heterogeneous infrastructures, including cloud and edge environments. A single compromised build step or credential can turn routine automation into large-scale distribution of malicious artifacts, motivating integrity, transparency, and enforceable deployment-time checks. In this paper, we present an architecture for verifiable container image distribution that addresses key-management challenges and enables policy-enforced admission-time verification. A transparency service generates one-time signing keys bound to authenticated identities, records signing events in an append-only transparency registry, and returns cryptographically verifiable proofs of inclusion. These proofs and identity attributes are attached to image metadata and evaluated by policy-as-code at admission time, so only compliant artifacts are deployed. We implement a proof-of-concept integrated with GitHub Actions and GitLab Runners and evaluate how the resulting pipeline mitigates common supply-chain attacks under a realistic threat model.

Network Music Performance (NMP), where musicians perform music together over the Internet, requires ultra-low delays. Achieving a sense of presence in NMP requires both aural and visual communication, preferably coupled with immersive telepresence technologies, such as holographic communication. Existing 4G networks offer neither the ultra-low latencies needed for audio and video, nor the ample bandwidth required for video and (especially) holographic communication. In the Telepresence-Enhanced Network Music Performance (TENeMP) project we are investigating and developing solutions for immersive NMP, to be tested in the 5G testbeds of the SPIRIT project. We provide an overview of the experimental testbeds of TENeMP as well as the software tools developed by the project. We then present baseline video and audio latency measurements over 4G and 5G-NSA networks, which demonstrate NMP’s need for the capabilities of 5G-SA and beyond networks.

Firmware update mechanisms are a critical part of the software supply chain in IoT and embedded systems, yet they remain vulnerable to a range of attacks-particularly those targeting the signing keys of firmware authors. A compromised signing key can be used to distribute malicious firmware that appears legitimate, undermining the integrity of the entire update process. In this paper, we address this class of attacks by introducing transparency and traceability services into the firmware update pipeline. We propose the use of a transparency registry-an immutable, append-only log where all firmware signing events are recorded. By monitoring this registry, key compromise and unauthorized signing activity can be detected and mitigated. Our approach shifts trust from opaque signature validation to verifiable, auditable records of signing activity. To evaluate this approach, we design and implement two systems: one based on a centralized transparency registry built using Merkle tree structures, and another based on a decentralized, permissioned blockchain. Both implementations demonstrate that transparency-based defenses against firmware supply chain attacks are practical, scalable, and effective.

Software is a pillar of the modern digital economy. It has become very complex and its supply chain involves many entities, components, and processes, of varying complexity, roles, value, and security, now including open-source and many independent developers software. Modern supply chain tracing techniques and transparency services promise to improve the security and trustworthiness of software. But this task entails many open, challenges. Firstly, the attack surface of the software supply chain is vast. Secondly, software involves a multitude of tools and external components. Thirdly, software development and maintenance governance is complex. Finally, supply chain attack detection and mitigation require access to diverse types of techniques and information. We develop processes and tools that provide responses to the following questions about transparency services: what information is recorded, who can record information, and how risks can be mitigated by extracted information. Outcomes allow software companies, developer communities, and end-users to make informed decisions related to the security of the software supply chain. Our approach integrates Decentralized Identifiers, Verifiable Credentials, and Relation-Based Access Control for improving the trustworthiness of software. We promote decentralization by empowering users to depart from the legacy Web PKI system, traditionally used for "signing" information related to software, as well as by enabling decentralized governance of transparency registries.

Data spaces represent an emerging paradigm that facilitates secure and trusted data exchange through foundational elements of data interoperability, sovereignty, and trust. Within a data space, data items, potentially owned by different entities, can be interconnected. Concurrently, data consumers can execute advanced data lookup operations and subscribe to data-driven events. Achieving fine-grained access control without compromising functionality presents a significant challenge. In this paper, we design and implement an access control mechanism that ensures continuous evaluation of access control policies, is data semantics aware, and supports subscriptions to data events. We present a construction where access control policies are stored in a centralized location, which we extend to allow data owners to maintain their own Policy Administration Points. This extension builds upon W3C Verifiable Credentials.

The computing continuum introduces new challenges for access control due to its dynamic, distributed, and heterogeneous nature. In this paper, we propose a Zero-Trust (ZT) access control solution that leverages decentralized identification and authentication mechanisms based on Decentralized Identifiers (DIDs) and Verifiable Credentials (VCs). Additionally, we employ Relationship-Based Access Control (ReBAC) to define policies that capture the evolving trust relationships inherent in the continuum. Through a proof-of-concept implementation, we demonstrate the feasibility and efficiency of our solution, highlighting its potential to enhance security and trust in decentralized environments.

Most Reinforcement Learning (RL) pipelines require the explicit definition of a reward function that closely matches the goal of an RL agent, which is not trivial in some use cases, e.g. when user satisfaction is part of the objective, such as in energy efficiency recommendations. Reinforcement Learning from Human Feedback (RLHF) is a recently proposed RL paradigm in which user feedback is used to train a reward model without the need for an explicit reward definition, and it first appeared in Large Language Models (LLMs). However, most RLHF approaches focus only on processing human feedback and do not consider other parameters, such as costs, which are crucial in domains like energy optimization. Overall, a gap in the literature exists regarding RLHF applications within building energy efficiency optimization, especially in terms of partially defined rewards since existing methods assume that the reward function is fully defined without considering user feedback data. In this work, an RLHF approach with partially defined rewards is proposed, offering energy efficiency recommendations that optimize energy costs while learning user behavior based on collected feedback instances. The proposed approach fits a reward model using a feedback collection mechanism based on Markov Decision Processes for limited human feedback cases. Experiments show that the proposed pipeline outperforms existing RL approaches with explicit rewards, in terms of energy costs and achieved rewards, while it does not need a fully defined reward function.

The InterPlanetary File System (IPFS) offers a decentralized approach to file storage and sharing, promising resilience and efficiency, while also realizing the Web3 paradigm. Simultaneously, the offered anonymity raises significant questions about potential misuse. In this study, we explore methods that malicious actors can exploit IPFS to upload and disseminate harmful content while remaining anonymous. We evaluate the role of pinning services and public gateways, identifying their capabilities and limitations in maintaining content availability. Using scripts, we systematically test the behavior of these services by uploading malicious files. Our analysis reveals that pinning services and public gateways lack mechanisms to assess or restrict the propagation of malicious content. Our findings demonstrate that attackers can exploit the decentralized nature of IPFS and its ecosystem to ensure persistent availability of malicious content while masking their identities. Moreover, we observed instances of this exploitation occurring in practice, further validating the real-world applicability of such attacks.

Mining pools have gained wide attention allowing in-dividual miners, who contribute their computational resources to collectively mine blocks to be rewarded more predictably. Although (traditional) mining pools make the mining process more predictable and incentivize small miners to participate, they introduce centralization and miners need to trust the pool manager that the revenues would be fairly shared among members. Efforts to create decentralized mining pools have been reported in the literature. Nonetheless, the aforementioned schemes have not been widely adopted and are not currently in use, mostly due to their scalability issues and the probabilistic nature of their share validation algorithms, which may result in potential security problems, as only a random subset of shares is chosen for validation. Our solution aims to create an efficient scheme for decentralized mining pools for Proof-of- Work (PoW) blockchains by leveraging Ethereum smart contracts to share mining rewards accordingly, while also utilizing the InterPlanetary File System (IPFS) to minimize gas fees by storing only the necessary information in the smart contract.

The shift from centralized identity systems to decentralized alternatives is becoming more imminent. Users are increasingly encouraged to embrace the principles of Self-Sovereign Identity (SSI), relying on two key components, Decentralized Identifiers (DIDs) and Verifiable Credentials (VCs), to regain total ownership and control over their identity and data, as well as how and to whom they are shared. This emphasizes a pressing need for VC wallet solutions that are not only user-friendly, but also uncompromisingly secure. In this paper, we introduce VC-Vault, an innovative wallet application that incorporates the principles of SSI and conforms to the European Blockchain Services Infrastructure (EBSI) standards. VC-Vault operates across both desktop and mobile platforms, delivering a coherent and effortless user experience. By establishing seamless integration with EBSI services, SSI principles, and VCs, VC-Vault places the control of digital identity and credentials firmly in the discretion of users.

The proliferation of Internet of Things (IoT) devices and applications that need to cooperate unattended highlights the need for seamless interoperability and intrinsic security. We argue that Distributed Ledger Technologies (DLTs), due to their decentralized nature, transparent operations, immutability, and availability, can enhance the security, reliability, and interoperability of such IoT systems. In this paper, we advance the integration of W3C's Web of Things (WoT) standards with DLTs and smart contracts, introducing smart contracts as "Digital Twins" of (physical) devices, or whole Cyber-Physical subsystems. Namely, we introduce a DLT-based architecture for controlling devices across federated IoT systems, securely, reliably, and with full auditability. The proposed architecture provides mass actuation and service composition with notable security properties, such as full auditability, transparency, and high availability. Specifically, a single request, with multiple action parameters and conditions, can trigger the reliable and secure actuation of a large number of possibly physically dispersed actuators.

Many Internet of Things (IoT) applications are considering multi-tenancy to support for multiple entities sharing access to the same IoT devices. The challenge of ensuring IoT security and privacy is exacerbated in multi-tenant environments accommodating “guest” users, i.e., opportunistic users that the system has not encountered. Thus, there is a need for novel access control mechanisms capable of addressing the complexities introduced by the opportunistic nature of the users who create complex trust relationships within the IoT ecosystem. In this study, we proposed a solution that leverages Verifiable Credentials (VCs) to implement Attribute-Based Access Control (ABA C) for multi-tenant IoT environments and we integrate it with W3C's Web of Things (WoT) standards, enhancing interoperability. Through the utilization of VCs, the solution provides secure verification and efficient revocation of user attributes, enabling access control decisions based on the enclosed attributes. Additionally, the proposed system ensures privacy, since users can selectively disclose the necessary attributes to gain access to resources through the utilization of Zero Knowledge Proofs (ZKPs). Finally, the solution does not require users to have any “pre-existing” trust relationships with the protected system.

Emerging energy management systems (EMS) involve devices and services provided by multiple stakeholders. In order to improve the interoperability of these systems, state of the art efforts propose an interoperability middleware that mediates the communication between end-user applications and EMS components. The potential lack of trust between the different stakeholders raises the need for fine-grained access control mechanisms. However, extending the middleware to support access control in a secure and usable way is a challenging problem. In this paper, we present a solution that achieves fine-grained authorization using Verifiable Credentials (VCs). Our solution leverages VC properties to enable end-users to combine authorizations issued by different entities. Additionally, our solution integrates a cloud-based VC wallet that hides the authorization process from end-user applications, thus facilitating interoperability among EMSes and the development of new, secure applications.

The InterPlanetary File System (IPFS) holds a pivotal role in the storage layer of the decentralized Web, commonly known as Web3. Its efficient functioning is crucial for a plethora of applications linked to blockchains, NFTs, and similar technologies. A key component, Bitswap, plays a central role in locating and exchanging files within the IPFS network. In this paper, we measure the latency of IPFS in fulfilling download requests and introduce an enhanced version of Bitswap designed to optimize its performance. We take into consideration the popularity of files and perform a series of experiments comparing the baseline version with our proposed method. Our findings indicate that, with the proposed improvements, the latency of download requests is significantly reduced, especially for content with low popularity. We also compare the two versions as network size grows, and demonstrate that our proposed method enhances the scalability of IPFS, as it keeps latency low without requiring node state to grow in proportion to the network size.

Personalized device-level energy consumption recommendations towards energy efficiency can have a notable impact both on electricity bills and on the overall energy supply-demand balance. End-user behavior regarding device activation is usually unknown a priori, thus giving rise to a highly dynamic environment. Hence, Reinforcement Learning (RL) can be utilized for device scheduling and consumption recommendations since it constitutes an Artificial Intelligence (AI) framework that learns a control policy in a dynamic environment through trying actions and observing incurred rewards. However, existing works on energy consumption recommendations do not explicitly take into account human feedback and preferences regarding the issued recommendations, and they train a single RL agent per device, hence missing the human behavior interdependencies in using different devices. In addition, a flexible open-source RL environment model that integrates user behavior in a Markov Decision Process (MDP) model is missing. In this paper, we propose an MDP-driven RL framework for energy efficiency recommendations that jointly learns the user’s behavior for multiple devices. The proposed model is wrapped as an open-source customizable Gymnasium environment, named EMS-env, for multi-device energy efficiency recommendations. EMS-env can simulate different types of consumer behavior profiles based on the MDP model and supports different device types as well as user feedback. Validation experiments demonstrate the framework’s merits and hyperparameters for diverse use cases in terms of user simulation models and RL training policies, resulting in decreased energy costs while maintaining end-user satisfaction.

Despite its rapid growth, the Internet of Things (IoT) still faces significant challenges related to interoperability, transparency and security. To address these issues, we propose the utilization of smart contract-based Digital Twins (DTs) "hosted" in the Hyperledger Fabric blockchain network, while leveraging the Web of Things paradigm for interoperability. Thus, our solution includes several notable features, such as decentralization, auditability and security. However, implementing DTs using Distributed Ledger Technologies (DLTs) introduces certain overheads. In this paper, we assess the feasibility and evaluate the performance of smart contract-based DTs using a set of Key Performance Indicators (KPIs). Our results demonstrate that, although DLT-induced overheads, such as latency, are present, they remain manageable for IoT use cases.

Self-Sovereign Identity (SSI) has highlighted the benefits and importance of granting users complete control over their identity. Unlike previous solutions, which entrust identity management to third-party applications or services, SSI empowers users to control their personal data. Nonetheless, compromised identities remain a challenge as they must be revoked in order to prevent additional privacy and security issues. However, in several SSI systems, privacy is compromised in favor of efficiency, allowing third parties to gain access to users’ personal data. In this paper, we highlight the shortcomings of existing SSI solutions and propose a system that addresses credential revocation by balancing privacy with efficiency, by leveraging Verifiable Random Functions (VRFs).

InterPlanetary File System (IPFS) is one of the most promising decentralized off-chain storage mechanisms, particularly relevant for blockchains, aiming to store the content forever, thus it is crucial to understand its composition, deduce actor intent and investigate its operation and impact. Beyond the network functionality that IPFS offers, assessing the quality of nodes, i.e. analysing and categorising node software and data, is essential to mitigate possible risks and exploitation of IPFS. To this end, in this work we took three daily snapshots of IPFS nodes within a month and analysed each node (by IP address) individually, using threat intelligence feeds. The above enabled us to quantify the number of potentially malicious and/or abused nodes. The outcomes lead us to consider using a filter to isolate malicious nodes from the network, an approach we implemented as a prototype and used for assessment of effectiveness.

Decentralized Identity (dID) has brought to the forefront the advantages and importance of total user control over identity. Previous solutions delegate identity management to the responsibility of third-party applications or services, which may raise multiple privacy and security concerns regarding users' personal data. In this paper, we highlight the significance of dID and in particular Self-Sovereign Identity (SSI) for a rapidly evolving ecosystem with a plethora of interconnected devices with different characteristics, such as the Internet of Things (IoT). Specifically, we analyze the benefits of incorporating SSI principles and technologies in IoT environments, while also discussing the challenges that may be introduced when combining the complexity of SSI concepts with the diverse and large-scale IoT environment. In addition, we present a thorough overview of existing systems that integrate SSI components into IoT environments, in order to address the challenges of authentication, authorization, and access control even for constrained IoT devices. Finally, we provide a comprehensive analysis regarding the contributions of Decentralized Identifiers and Verifiable Credentials, the two main pillars of SSI, for enhanced privacy and security for the Internet at large and for the IoT in particular.

Forecasting the energy demand of individual consumers is a vital component of future smart energy grids since it enables energy-saving mechanisms such as Demand Response, activity scheduling, and prosumer energy markets. However, training a separate model with each consumer's available smart meter data can raise significant cold-start and scalability issues, despite the fact that personalization can be achieved in cases where the respective training sets have adequate data. Namely, making accurate forecasts for new consumers with limited historical data is challenging since a machine learning model requires a significant volume of data to be trained adequately, while scalability becomes an issue when the number of consumers increases. Training a single model on multiple consumers can mitigate these issues, hence we propose a single-model RNN-based deep learning architecture named Deep4Ener, for consumer-level energy demand forecasting, trained on multiple users and capable of making predictions for unseen consumers with scarce historical data that were not included in the training phase. Deep4Ener learns common energy demand characteristics among different consumers, by utilizing a novel architecture for energy profiling, including clustering, and an encoder neural network for feature extraction. Experiments with data from two open datasets show that Deep4Ener achieves high predictive performance both for known and completely new consumers, while outperforming the current state-of-the-art, namely one-model-per-consumer, standalone RNN, and Amazon's DeepAR approaches. Finally, we demonstrate that Deep4Ener shines when combined with Transfer Learning to further improve its forecasting performance on different energy demand consumers with limited data available.