The consumer IoT is now prevalent and creates an enormous amount of fine-grained, detailed information about consumers’ everyday actions, personalities, and preferences. Such detailed information brings new and unique privacy challenges. The consumers are not aware of devices that surround them. There is a lack of transparency and absence of support for consumers to control the collection and processing of their personal and sensitive data. This paper reports on a review of state-of-the-art on privacy protection in IoT, with respect to privacy enhancing technologies (PETs) and GDPR-specific privacy principles. Drawing on a thorough analysis of 36 full papers, we identify key privacy challenges in IoT that need to be addressed to provide consumers with transparency and control over their personal data. The privacy challenges we have identified are (1) the lack of technical expertise in privacy notice comprehension, (2) the lack of transparency and control of personal data, and (3) the lack of personalized privacy recommendations.

Abstract Having a sequence diagram specification and a computer system, we need to answer the question: Is the system compliant with the sequence diagram specification in the desired way? We present a procedure for answering this question for sequence diagrams with underspecification and inherent nondeterminism. The procedure is independent of any concrete technology, and relies only on the execution traces that may be produced by the system. If all traces are known, the procedure results in either “compliant” or “not compliant”. If only a subset of the traces is known, the conclusion may also be “likely compliant” or “likely not compliant”.

We investigate how geographic visualization can be used as a means to facilitate understanding of risk in emergency situations. Specifically, we identify the need of decision makers regarding access to risk information; introduce a visualization solution that aims to satisfy these needs; and evaluate this solution in terms of its ability to generate insight. A description of how the solution can be implemented is included. Our findings indicate that geographic visualization is an effective means for facilitating understanding of risk in emergency situations, but that the effectiveness of the concept depends on the visualization design. A set of guidelines towards risk visualization design is proposed.

This article puts forward a pattern language for Safe Adaptive Control Software named SACS. We interpret the term "pattern language" such that a set of patterns, the interconnections between them, and how these are intended to be used make up a language. The pattern language consists of three basic types of patterns, namely the Requirement Pattern, the Design Pattern, and the Safety Case Pattern and an additional Composite Pattern type. The Composite Pattern type facilitates users of the language to specify their own patterns as compositions of basic patterns. The patterns are intended to be used in the context of safety related and safety critical systems, thus the safety aspect is a principal concern. The pattern language may be used as a tool for e.g. safety engineers and system developers to increase effectiveness during conceptual design and facilitate effective evaluation of alternative adaptive design solutions with respect to utilisation in a safety related application by a systematic approach for combining best practices.

The authors present a framework that supports an incremental and modular development process of secure software systems. The framework unifies the treatment of secure information flow properties and their relationship to refinement of underspecification, translation from one level of granularity to another, and composition.

We present an approach for secure information flow property preserving refinement and transformation of UML inspired interaction diagrams.The approach is formally underpinned by trace-semantics.The semantics is sufficiently expressive to distinguish underspecification from explicit nondeterminism. A running example is used to introduce the approach and to demonstrate that it is of practical value.

The main objective of the CORAS project is to provide methods and tools for precise, unambiguous, and efficient risk assessment of security critical systems. To this end, we advocate a model-based approach to risk assessment, and define the required models for this. Whereas traditional risk assessment is performed without any formal description of the target of evaluation or results of the risk assessment, CORAS aims to provide a well defined set of models well suited to (1) describe the target of assessment at the right level of abstraction, (2) as a medium for communication between different groups of stakeholders involved in a risk assessment, and (3) to document risk assessment results and the assumptions on which these results depend. We propose models for each step in a risk assessment process and report results of use.

Abstract. This paper presents a formal specification technique for mobile systems based on input/output relations on streams. We consider networks of components communicating asynchronously via unbounded directed channels. Mobility is achieved by allowing the components to communicate channel ports. We distinguish between many-to-many and two variants of point-to-point communication. The communication paradigms are semantically underpinned by denotational models. The models are formulated in the context of timed non-deterministic data ow networks and presented in a stepwise fashion. The emphasis is on capturing the special kind of dynamic hiding characterising mobile systems. We demonstrate the proposed approach in a number of small examples.

Abstract This paper presents an assumption/commitment specification technique and a refinement calculus for networks of agents communicating asynchronously via unbounded FIFO channels in the tradition of Kahn. We define two types of assumption/commitment specifications, namely simple and general specifications. It is shown that semantically, any deterministic agent can be uniquely characterized by a simple specification, and any nondeterministic agent can be uniquely characterized by a general specification. We define two sets of refinement rules, one for simple specifications and one for general specifications. The rules are Hoare-logic inspired. In particular the feedback rules employ invariants in the style of a traditional while-rule. Both sets of rules have been proved to be sound and also (semantic) relative complete. Conversion rules allow the two logics to be combined. This means that general specifications and the rules for general specifications have to be introduced only at the point in a system development where they are really needed.