Publications

@article{ariascabarcos001,

title = {A Metric-Based Approach to Assess Risk for "On Cloud" Federated Identity Management},

author = {Patricia Arias-Cabarcos and Florina Almenárez-Mendoza and Andrés Marín-López and Daniel Díaz-Sánchez and Rosa Sánchez-Guerrero },

url = {https://link.springer.com/article/10.1007/s10922-012-9244-2},

doi = {https://doi.org/10.1007/s10922-012-9244-2},

issn = {1573-7705},

year  = {2012},

date = {2012-07-04},

urldate = {2012-07-04},

journal = {Journal of Network and Systems Management},

volume = {20},

issue = {4},

pages = {513-533},

abstract = {The cloud computing paradigm is set to become the next explosive revolution on the Internet, but its adoption is still hindered by security problems. One of the fundamental issues is the need for better access control and identity management systems. In this context, Federated Identity Management (FIM) is identified by researchers and experts as an important security enabler, since it will play a vital role in allowing the global scalability that is required for the successful implantation of cloud technologies. However, current FIM frameworks are limited by the complexity of the underlying trust models that need to be put in place before inter-domain cooperation. Thus, the establishment of dynamic federations between the different cloud actors is still a major research challenge that remains unsolved. Here we show that risk evaluation must be considered as a key enabler in evidence-based trust management to foster collaboration between cloud providers that belong to unknown administrative domains in a secure manner. In this paper, we analyze the Federated Identity Management process and propose a taxonomy that helps in the classification of the involved risks in order to mitigate vulnerabilities and threats when decisions about collaboration are made. Moreover, a set of new metrics is defined to allow a novel form of risk quantification in these environments. Other contributions of the paper include the definition of a generic hierarchical risk aggregation system, and a descriptive use-case where the risk computation framework is applied to enhance cloud-based service provisioning.

},

keywords = {Cloud computing, consequence, federation, risk assessment, SAML, servicioseguridad, Trust management},

pubstate = {published},

tppubtype = {article}

}

@article{sanchezguerrero001,

title = {An Event Driven Hybrid Identity Management Approach to Privacy Enhanced e-Health},

author = {Rosa Sánchez-Guerrero and Florina Almenárez and Daniel Díaz-Sánchez and Andrés Marín and Patricia Arias and Fabio Sanvido

},

url = {https://www.mdpi.com/1424-8220/12/5/6129

https://www.mdpi.com/1424-8220/12/5/6129/pdf?version=1403317529},

doi = {https://doi.org/10.3390/s120506129},

issn = {1424-8220},

year  = {2012},

date = {2012-05-10},

urldate = {2012-05-10},

journal = {Sensors },

volume = {12},

issue = {5},

pages = {6129-6154},

abstract = {Credential-based authorization offers interesting advantages for ubiquitous scenarios involving limited devices such as sensors and personal mobile equipment: the verification can be done locally; it offers a more reduced computational cost than its competitors for issuing, storing, and verification; and it naturally supports rights delegation. The main drawback is the revocation of rights. Revocation requires handling potentially large revocation lists, or using protocols to check the revocation status, bringing extra communication costs not acceptable for sensors and other limited devices. Moreover, the effective revocation consent—considered as a privacy rule in sensitive scenarios—has not been fully addressed. This paper proposes an event-based mechanism empowering a new concept, the sleepyhead credentials, which allows to substitute time constraints and explicit revocation by activating and deactivating authorization rights according to events. Our approach is to integrate this concept in IdM systems in a hybrid model supporting delegation, which can be an interesting alternative for scenarios where revocation of consent and user privacy are critical. The delegation includes a SAML compliant protocol, which we have validated through a proof-of-concept implementation. This article also explains the mathematical model describing the event-based model and offers estimations of the overhead introduced by the system. The paper focus on health care scenarios, where we show the flexibility of the proposed event-based user consent revocation mechanism.},

keywords = {delegation, event, federation, health care, identity management, privacy, revocation consent, servicioseguridad, theory queue, user-centric},

pubstate = {published},

tppubtype = {article}

}