Innovative Security Solutions for Information Technology and Communications: 12th International Conference, SecITC 2019, Bucharest, Romania, November 14–15, 2019, Revised Selected Papers

Autonomy and mobility are keystones technologies for the design of future highly adaptive communicating systems. Deploying existing data security solutions to the autonomous mobile communicating systems is not straightforward because of systems heterogeneity, highly evolving and possibly unprotected or hostile environments, and required large scale deployment. Communication protocols used, data security, availability, and quality are other critical areas fore such applications. Developing comprehensive security and privacy solutions for autonomous mobile objects requires revisiting almost all security techniques we may think of. Encryption protocols need to be engineered so to be efficient and scalable for deployment on large-scale systems and devices with limited computational resources. In addition, scalability of such protocols is critical, in that in many safety-sensitive applications encryption operations must be kept very efficient. Addressing such problems may require new techniques based, for instance, on embedded security mechanisms and integrated and proved co-design in the deployment of secure applications. In this talk, after outlining key challenges in data security and privacy for mobility, we summarize research directions for securing data in various fine-grained devices (IoT, mobile terrestrial and space vehicles, etc.), including efficient and scalable encryption protocols, software protection techniques for small devices, efficient generic embedded security protocols, provable security protocols, etc. As a case study of critical communicating systems, IoT has become in the last few years a very widely emerging spread concept for secure applications. The reason for this is mainly the need to control most of the surrounding objects and have access to data required for environment understanding in real time. As stated for instance in [12–14], IoT systems are often highly dynamic, and continuously change because of their mobility or networking reconfigurability. They are also highly heterogeneous with respect to communication medium and protocols, platforms, and devices involved. IoT systems, or parts of them, may be physically unprotected and attacks, against which there are established defense techniques in the context of conventional information systems and mobile environments, are thus much more difficult to protect against in the IoT. The OWASP Internet of Things Project [10, 11] has identified the most common IoT vulnerabilities and has shown that many such vulnerabilities arise because of the lack of adoption of well-known security techniques, such as encryption, authentication, access control,... Therefore, developing comprehensive security and privacy solutions for IoT requires revisiting almost all security techniques we may think of. The EU’s CyPhERS (Cyber-physical European Roadmap and Strategy; www.cyphers.eu/project) project has been investigating the relationship between cyber-physical and IoT systems. Some techniques developed for cyber-physical systems can be the source of good practices for software engineering for the IoT. However, some factors, such as mobility, reconfigurability and safety/reliability, still require attention. In this sense, IoT systems tend to be extremely dynamic, where different devices can be added or removed in a specific IoT ecosystem during runtime while maintaining reliable communications. Finally privacy introduces new challenges, including how to prevent personal devices from acquiring and/or transmitting information depending on the user location and other personal context information, and how to allow users to understand risks and advantages in sharing their personal data! Software running on such devices must be secured by design. Major challenges here arise from the fact that many devices are based on dedicated heterogeneous processors which have differences in the instruction sets with respect to support for security. Such diversity has an implication for example on the techniques for protecting software from attacks (e.g. run-time software to be secured from memory vulnerabilities). Cybersecurity techniques using provable effects are therefore required. Availability requires among other things to make sure that relevant data is not lost. Addressing such requirement entails designing protocols for data acquisition and transmission that have data loss minimization as a key security goal. Finally privacy and anonymity introduce new challenges, including how to prevent personal devices from acquiring and/or transmitting information depending on the user location and other context information, and how to allow users to understand risks and advantages in sharing unprotected personal data. This remain also an ethical, deontological, critical requirement for the existing mass-products (f-booking!, googling!, binging!...) and their possible disastrous effects on society and fundamental human rights.