Publications

@article{Diaz_Sanchez_2019,

title = {DNS/DANE Collision-Based Distributed and Dynamic Authentication for Microservices in IoT †},

author = {Daniel Díaz-Sánchez and Andrés Marín-Lopez and Florina Almenárez Mendoza and Patricia Arias Cabarcos},

url = {http://dx.doi.org/10.3390/s19153292

/download/DNS_DANE_Collision-Based_Distributed_and_Dynamic_Authentication_for_Microservices_in_IoT.pdf},

doi = {https://doi.org/10.3390/s19153292},

issn = {1424-8220},

year  = {2019},

date = {2019-07-26},

urldate = {2019-07-26},

journal = {Sensors},

volume = {19},

issue = {15},

pages = {1-23},

publisher = {MDPI AG},

abstract = {IoT devices provide real-time data to a rich ecosystem of services and applications. The volume of data and the involved subscribe/notify signaling will likely become a challenge also for access and core networks. To alleviate the core of the network, other technologies like fog computing can be used. On the security side, designers of IoT low-cost devices and applications often reuse old versions of development frameworks and software components that contain vulnerabilities. Many server applications today are designed using microservice architectures where components are easier to update. Thus, IoT can benefit from deploying microservices in the fog as it offers the required flexibility for the main players of ubiquitous computing: nomadic users. In such deployments, IoT devices need the dynamic instantiation of microservices. IoT microservices require certificates so they can be accessed securely. Thus, every microservice instance may require a newly-created domain name and a certificate. The DNS-based Authentication of Named Entities (DANE) extension to Domain Name System Security Extensions (DNSSEC) allows linking a certificate to a given domain name. Thus, the combination of DNSSEC and DANE provides microservices’ clients with secure information regarding the domain name, IP address, and server certificate of a given microservice. However, IoT microservices may be short-lived since devices can move from one local fog to another, forcing DNSSEC servers to sign zones whenever new changes occur. Considering DNSSEC and DANE were designed to cope with static services, coping with IoT dynamic microservice instantiation can throttle the scalability in the fog. To overcome this limitation, this article proposes a solution that modifies the DNSSEC/DANE signature mechanism using chameleon signatures and defining a new soft delegation scheme. Chameleon signatures are signatures computed over a chameleon hash, which have a property: a secret trapdoor function can be used to compute collisions to the hash. Since the hash is maintained, the signature does not have to be computed again. In the soft delegation schema, DNS servers obtain a trapdoor that allows performing changes in a constrained zone without affecting normal DNS operation. In this way, a server can receive this soft delegation and modify the DNS zone to cope with frequent changes such as microservice dynamic instantiation. Changes in the soft delegated zone are much faster and do not require the intervention of the DNS primary servers of the zone.},

keywords = {authentication, chameleon signatures, cynamon, DANE, DNSSEC, Internet of Things, magos, microservices},

pubstate = {published},

tppubtype = {article}

}

@article{8704893,

title = {TLS/PKI Challenges and Certificate Pinning Techniques for IoT and M2M Secure Communications},

author = {Daniel Díaz-Sánchez and Andrés Marín-López and Florina Almenárez-Mendoza and Patricia Arias-Cabarcos and R. Simon-Sherratt},

url = {https://doi.org/10.1109/COMST.2019.2914453

https://ieeexplore.ieee.org/document/8704893

https://phpmyadmin.pervasive.it.uc3m.es/download/TLC-PKI-challenges-certificate-pinning.pdf},

doi = {10.1109/COMST.2019.2914453},

issn = {1553-877X},

year  = {2019},

date = {2019-05-02},

urldate = {2019-05-02},

journal = {IEEE Communications Surveys and Tutorials},

volume = {21},

issue = {4},

pages = {3502-3531},

abstract = {Transport layer security (TLS) is becoming the de facto standard to provide end-to-end security in the current Internet. IoT and M2M scenarios are not an exception since TLS is also being adopted there. The ability of TLS for negotiating any security parameter, its flexibility and extensibility are responsible for its wide adoption but also for several attacks. Moreover, as it relies on public key infrastructure (PKI) for authentication, it is also affected by PKI problems. Considering the advent of IoT/M2M scenarios and their particularities, it is necessary to have a closer look at TLS history to evaluate the potential challenges of using TLS and PKI in these scenarios. According to this, this paper provides a deep revision of several security aspects of TLS and PKI, with a particular focus on current certificate pinning solutions in order to illustrate the potential problems that should be addressed.},

keywords = {authentication, certificate pinning, cynamon, DTLS, Internet of Things, Machine to Machine, magos, PKI, Protocols, TLS, Trusted Third Party, Tutorials},

pubstate = {published},

tppubtype = {article}

}

@article{almenarez003,

title = {Enhancing privacy and dynamic federation in IdM for consumer cloud computing},

author = {Rosa Sánchez and Florina Almenares and Patricia Arias and Daniel Díaz-Sánchez and Andrés Marín},

url = {https://ieeexplore.ieee.org/document/6170060

https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6170060},

doi = {https://doi.org/10.1109/TCE.2012.6170060},

issn = {0098-3063},

year  = {2012},

date = {2012-02-01},

urldate = {2012-02-01},

journal = {IEEE TRANSACTIONS ON CONSUMER ELECTRONICS},

volume = {58},

issue = {1},

pages = {95-103},

abstract = {Consumer cloud computing paradigm has emerged as the natural evolution and integration of advances in several areas including distributed computing, service oriented architecture and consumer electronics. In this complex ecosystem, security and identity management challenges have cropped up, given their dynamism and heterogeneity. As a direct consequence, dynamic federated identity management with privacy improvements has arisen as an indispensable mechanism to enable the global scalability and usability that are required for the successful implantation of Cloud technologies. With these requirements in mind, we present an IdM architecture based on privacy and reputation extensions compliance with the SAMLv2/ID-FF standards.},

keywords = {authentication, Cloud computing, Computer architecture, context, desarrollodespliegue, privacy, Protocols},

pubstate = {published},

tppubtype = {article}

}

@article{almenarez002,

title = {fedTV: Personal Networks Federation for IdM in Mobile DTV},

author = {Florina Almenárez and Patricia Arias and Daniel Díaz-Sánchez and Andrés Marín and Rosa Sánchez.},

url = {https://ieeexplore.ieee.org/document/5955185

https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=5955185},

doi = {https://doi.org/10.1109/TCE.2011.5955185},

issn = {0098-3063},

year  = {2011},

date = {2011-05-03},

urldate = {2011-05-03},

journal = {IEEE TRANSACTIONS ON CONSUMER ELECTRONICS},

volume = {57},

issue = {2},

pages = {499 - 506},

abstract = {Mobile Social TV and Mobile Video Blogging are new challenging scenarios arising from mobile and online DTV. They will allow for new interactions, and dynamically share content and delegate services. That requires the dynamic discovery, joining, and establishing new federations, emerging the trust management as an important facet for that. Such trust management should be autonomous, user-centric, and dynamic to cope with forthcoming applications. We propose an enhanced mobile client to support federated environments for cooperation in mobile DTV scenarios. Our proposal extends the Enhanced Client Profile defined in SAML v2, incorporating a trust management layer inside user's consumer electronic devices' software.},

keywords = {anot, anotacionsemantica, authentication, Digital TV, identity management, Mobile communication, Mobile computing, mobile DTV, Mobile handsets, Personal Network Federation, SAML, Trust management},

pubstate = {published},

tppubtype = {article}

}

@article{marin001,

title = {Pervasive authentication and authorization infrastructures for mobile users},

author = {Jordi Forné and Francisca Hinarejos and Andrés Marín and Florina Almenárez and Javier Lopez and Jose A. Montenegro and Marc Lacoste and Daniel Díaz},

url = {https://www.sciencedirect.com/science/article/pii/S0167404809000911?via%3Dihub},

doi = {https://doi.org/10.1016/j.cose.2009.09.001},

issn = {0167-4048},

year  = {2009},

date = {2009-09-25},

urldate = {2009-09-25},

journal = {COMPUTERS & SECURITY},

volume = {29},

issue = {4},

pages = {501-514},

abstract = {Network and device heterogeneity, nomadic mobility, intermittent connectivity and, more generally, extremely dynamic operating conditions, are major challenges in the design of security infrastructures for pervasive computing. Yet, in a ubiquitous computing environment, limitations of traditional solutions for authentication and authorization can be overcome with a pervasive public key infrastructure (pervasive-PKI). This choice allows the validation of credentials of users roaming between heterogeneous networks, even when global connectivity is lost and some services are temporarily unreachable. Proof-of-concept implementations and testbed validation results demonstrate that strong security can be achieved for users and applications through the combination of traditional PKI services with a number of enhancements like: (i) dynamic and collaborative trust model, (ii) use of attribute certificates for privilege management, and (iii) modular architecture enabling nomadic mobility and enhanced with reconfiguration capabilities.},

keywords = {authentication, Authorization, ITACA, security architecture, trust, Ubiquitous computing, Ubisec},

pubstate = {published},

tppubtype = {article}

}