Davide Ferraris

The work described in this website has been conducted within the project NeCS. This project has received funding from the European Union’s Horizon 2020 (H2020) research and innovation programme under the Grant Agreement no 675320. This website and the content displayed in it do not represent the opinion of the European Union, and the European Union is not responsible for any use that might be made of its content.

Topic: 
Metrics for cyber-security
Links: 
Linkedin Profile
Partner: 
Universidad De Malaga
Research work: 

The main topic of research of ESR3 is “metrics for cybersecurity”. This work will deal in particular with trust metrics for the Internet of Things. The vision of the Internet of Things (IoT) is founded on the following premise: it is possible to create a world-wide network of interconnected objects, or things, which will probably be readable, recognizable, locatable, addressable, and/or controllable via the Internet. Billions of devices are foreseen to be connected by 2020, so trust issues will grow exponentially. Trust is necessary in a system such as IoT because the entities involved should know the other entities they have to interact with. The problem of finding a suitable way to establish trust becomes more complicated in IoT due to its heterogeneity. Trust management systems have been used during the decision-making process in order to assist entities that have to interact with others in a system. How to measure trust then becomes a key issue for IoT systems as all the heterogeneous entities will use their own trust management systems and this is challenging.

ESRs Publications

An Analysis of Trust in Smart Home Devices
Description:

In recent times, smart home devices like Amazon Echo and Google Home have reached mainstream popularity. These devices are intrinsically intrusive, being able to access user’s personal information.There are growing concerns about indiscriminate data collection and invasion of user privacy in smart home devices. Improper trust assumptions and security controls can lead to unauthorized access of the devices,which can have severe consequences (i.e. safety risks). In this paper, we analysed the behaviour of smart home devices with respect to trust relationships. We set up a smart home environment to evaluate how trust is built and managed. Then, we performed a number of interaction tests with different types of users (i.e. owner, guests). As a result, we were able to assess the effectiveness of the provided security controls and identify some relevant security issues. To address them, we defined a trust model and proposed a solution based on it for securing smart home devices.

TrUStAPIS: A Trust Requirements Elicitation Method for IoT
Links:
Link to the Article
Description:

The Internet of Things (IoT) is an environment of interconnected entities, which are identifiable, usable and controllable via the Internet. Trust is useful for a system such as the IoT as the entities involved would like to know how the other entities they have to interact with are going to perform.
When developing an IoT entity, it will be desirable to guarantee trust during its whole life cycle. Trust domain is strongly dependent on other domains such as security and privacy.
To consider these domains as a whole and to elicit the right requirements since the first phases of the System Development Life Cycle (SDLC) is a key point when developing an IoT entity.
This paper presents a requirements elicitation method focusing on trust plus other domains such as security, privacy and usability that increase the trust level of the IoT entity developed. To help the developers to elicit the requirements, we propose a JavaScript Notation Object (JSON) template containing all the key elements that must be taken into consideration.
We emphasize on the importance of the concept of traceability. This property permits to connect all the elicited requirements guaranteeing more control on the whole requirements engineering process.

A Segregated Architecture for a Trust-based Network of Internet of Things
Description:

With the ever-increasing number of smart home devices, the issues related to these environments are also growing. With an ever-growing attack surface, there is no standard way to protect homes and their inhabitants from new threats. The inhabitants are rarely aware of the increased security threats that they are exposed to and how to manage them. To tackle this problem, we propose a solution based on segmented architectures similar to the ones used in industrial systems. In this approach, the smart home is segmented into various levels, which can broadly be categorised into an inner level and external level. The external level is protected by a firewall that checks the communication from/to the Internet to/from the external devices. The internal level is protected by an additional firewall that filters the information and the communications between the external and the internal devices. This segmentation guarantees a trusted environment between the entities belonging to the internal network. In this paper, we propose an adaptive trust model that checks the behaviour of the entities and, through this model, in case the entities violate trust rules they can be put in quarantine or banned from the network.

A Trust-by-Design Framework for the Internet of Things
Links:
Conference