Privilege management infraestructures (PMI) arise as an evolution of PKI where not only identity is considered but the privileges or access rights asociates to the diferent roles or individuals in the organizations. This reserach topics is one of the oldest within NICS and was consolidated in the project PRIVILEGE. In this project we worked mainly with X.509 Attribute Certificates. We developed a practical implementation of a Privilege Management Infrastructure (PMI) and a mechanism to perform controlled delegation, making use of the extension fields of the attribute certificates ^{[5] [6]}. Our proposal is based on graphs, including in each certificate a real number ( in the interval [0,1]) that measures the level of confidence of the issuer on the issued certificate. This enables us to compute trust on the granted privileges over the delegation graph. Another relevant area within PMI is supporting dynamic access control policies based on context information ^[7] and include in the decision making process not only roles and identities but also user attributes ^[8].

PMI can also be used for identity verification. Within the OSAMI project we have implemented solution for the distribution of secure code using OpenID and signatures with public key certificates of short duration (created from the OpenID information) ^[9]. In this way, developers can distribute signed code without the need for a long term digital certificate. This solution can be applied to those scenarios in which there is a dynamism in the programming team of these components such as in the open source community.

Privacy and Anonymity

Individual privacy has been recognised as a fundamental human right and it is protected by numerous laws, directives and regulations, such as the European General Data Protection Regulation. Privacy can be regarded as the desire of individuals to retain control over personal data, that is, to keep their ability to decide how much information about themselves and in which circumstances their personal data are shared with others. Simply put, privacy is about preventing third parties from learning personally-sensitive information or keeping these data unlinkable from individuals. Therefore, privacy and identity are two closely intertwined concepts.

One of the first use cases combined privacy and identity management in which NICS has worked is the implementation of a solution for Anonymous Age Verification using the national electronic identity document (DNIe). We developed a prototype using Information Cards for anonymous age verification application that allows a user to demonstrate his age without providing additional data ^[10]. In the process of generating the i-card (Information Card), the DNIe is used. They can later be used when purchasing products online, where they can prove they were old enough to perform the operation without providing additional data strictly necessary to the service provider. In this process, the user must use the DNIe only once (for registration) from his computer. In ^[11] we proposed a solution to enhance the X.509 attribute certificate in such a way that it becomes a conditionally anonymous attribute certificate. After that, we designed a protocol to obtain such certificates in a way that respects users’ anonymity by using a fair blind signature scheme. We also show how to use such certificates and describe a few cases where problems could arise, identifying some open problems.

Obfuscation is also relevant in the protection of the metadata associated with the data itself. Most of the work of NICS Lab in this area is related to network traffic obfuscation in order to prevent leaking relevant information about the network itself or the entities participating in the communication. Although this topic had been extensively studied in computer networks, the development of future internet networks, with resource-constrained devices, demanded new approaches ^[12]. This especially relevant in the context of wireless sensor networks ^[13], where traffic analysis can lead to the identification of relevant assets, such as the entities or elements being monitored by the network ^[14] or the base station ^[15][16]. Later, we also analysed these problems in the context of the Internet of Things ^[17] and provided a solution for controlling the access of personal data from IoT devices ^[18] by taking advantage of edge computing technologies. Furthermore, proxy re-encryption has inspired the definition of a novel mechanism for query privacy in sensing as a service platforms ^[19]. The idea is that a user can query for data to a service provider without revealing the query contents or the location where the data is stored.

Privacy can also be protected by enforcing the controlled release of data. A privacy-by-design solution has been devised in ^[20] by extending a requirements engineering framework. This solution allows software developers to integrate trust and privacy decisions into the software development process and reason about suitable privacy settings for limiting data exposure. Also, in the context of controlled data release NICS Lab has proposed a methodology that integrates privacy into a digital forensics framework ^[21][22] thus promoting user cooperation with digital investigations.

Whenever the service provider needs the identity of the user as well as some personal data to provide the service, the typical approach to privacy protection is data obfuscation. This is the case of Location-based services, where the user attaches location information to the queries issued to the service provider in order to get a personalised service. In this respect, NICS Lab has contributed with the definition of novel properties for location privacy and the definition of a location obfuscation function that satisfies these properties ^[23]. In this context, we have also studied how user mobility impacts the success of the attacker ^[24][25] as a means to determine for how long it is safe for the user to keep using the system as well as a devise new ways of limiting attacks to location privacy. In line with this idea, we also proposed a mechanisms for crowd counting that respect user location privacy ^[26]. Our proposal is based on the DP3T contact tracing approach, already adopted by several countries during the COVID-19 pandemic.

Even though data confidentiality is a mechanism for protecting privacy, data confidentiality alone does not necessarily ensure privacy preservation. Anonymity is another way of protecting privacy by keeping the identity of the individual undisclosed and/or making them indistinguishable from a set of other participants. This is particularly relevant in scenarios where user’s devices interact with one another, potentially leaking their identity and ultimately the identity of the users behind them. Under the umbrella of the OSAMI project we implemented a secure, non-intrusive continuous authentication scheme supported by the use of Wearable Wireless Devices (WWD)^[27], which allow users to gain access to proximity-based services while preserving their privacy using an RF channel. We propose the use of pseudonyms to hide user’s identity while allowing trusted parties to re-identify and authenticate them. This solution can serve as a supporting technology for continuous authentication or even as a complete alternative to biometrics when accessing proximity-based services.