The Internet of Things (IoT) creates new technological opportunities for a wide range of systems, such as industrial control systems, smart power grids, vehicular networks (VNs) and intelligent transportation systems, body area networks and healthcare monitoring and control systems and smart homes. At the same time, IoT also increases the threat surface for potential adversaries targeting critical interconnected systems that may depend on embedded IoT systems, such as supervisory control and data acquisition (SCADA) systems. At this point, attackers could take advantage from the incorporation of the paradigm to exploit new security gaps, probably caused by unforeseen interoperability and adaptability problems. Indeed, the deployment of Internet-enabled embedded devices that are distributed over major critical domains may create indirect and nonobvious interconnections with the underlying critical infrastructures (CIs). There is a need to further explore the security issues related to IoT technologies and to assure the resilience of CIs against advanced IoT-enabled attacks. The focus of this special issue is therefore to provide readers with the latest advances in securing the interaction between embedded IoT devices and CIs in order to increase their resilience to advanced IoT-enabled threats.

In certain applications, the locations of events reported by a sensor network need to remain anonymous. That is, unauthorized observers must be unable to detect the origin of such events by analyzing the network traffic. Known as the source anonymity problem, this problem has emerged as an important topic in the security of wireless sensor networks, with variety of techniques based on different adversarial assumptions being proposed. In this work, we present a new framework for modeling, analyzing, and evaluating anonymity in sensor networks. The novelty of the proposed framework is twofold: first, it introduces the notion of "interval indistinguishability” and provides a quantitative measure to model anonymity in wireless sensor networks; second, it maps source anonymity to the statistical problem of binary hypothesis testing with nuisance parameters. We then analyze existing solutions for designing anonymous sensor networks using the proposed model. We show how mapping source anonymity to binary hypothesis testing with nuisance parameters leads to converting the problem of exposing private source information into searching for an appropriate data transformation that removes or minimize the effect of the nuisance information. By doing so, we transform the problem from analyzing real-valued sample points to binary codes, which opens the door for coding theory to be incorporated into the study of anonymous sensor networks. Finally, we discuss how existing solutions can be modified to improve their anonymity.

This series of Workshops is organized by ERCIM (European Research Consortium in Informatics and Mathematics) Working Group on Security and Trust Management, that was established in 2005 to foster collaborative work on all theoretical and practical aspects of security, trust and privacy in ICT within the European research community and to increase co-operation of the research community with the European industry.The four articles in this Special Issue were selected from the 17 papers that were accepted for presentation at the Workshop, out of 40 submissions.The articles cover representative topics of STM, such as access control, privacy, security and trust policies, or formal methods.The paper "Scalable automated symbolic analysis of administrative role-based access control policies by SMT solving" by Armando and Ranise considers the problem of automatically analysing administrative role based access control (ARBAC) policies.Such analyses are extremely useful to understand the subtle implications of complex combinations of authorizations, and more generally to ensure that ARBAC systems are scalable and can evolve gracefully.Authors isolate a new class of properties (user-role reachability) for ARBAC policies and leverage state-of-the-art SMT solvers to check automatically their validity.Finally, the strength of their approach is demonstrated through extensive experimental evaluation.In their paper "Stateful authorization logic -proof theory and a case study", Garg and Pfenning embark on the proof-theoretical study of logics for stateful authorization policies; that is, policies that depend on externally controlled conditions.They introduce an expressive logic, called BL, for reasoning about stateful authorization policies.The expressiveness of the logic is achieved through the adoption of a modal connective that allows delegation, and through an explicit modeling of time.Thanks to a careful design that crisply separates between the validity of state predicates and BL judgments, the authors provide an elegant treatment of the meta-theory of BL, and prove that it enjoys admissibility of cut, an essential property that entails consistency.The BL logic is empirically validated through a detailed case study of the US authorization policies for accessing to sensitive intelligence information.The paper "Modeling and preventing inferences from sensitive value distributions in data release" by Bezzi, De Capitani di Vimercati, Foresti, Livraga, Samarati and Sassi considers the following setting: assume a database contains many entries, each of which in its own is considered non-sensitive and can be declassified, but some

In RFID literature, most “privacy-preserving” protocols require the reader to search all tags in the system in order to identify a single tag. In another class of protocols, the search complexity is reduced to be logarithmic in the number of tags, but it comes with two major drawbacks: it requires a large communication overhead over the fragile wireless channel, and the compromise of a tag in the system reveals secret information about other, uncompromised, tags in the same system. In this work, we take a different approach to address time complexity of private identification in large-scale RFID systems. We utilize the special architecture of RFID systems to propose a symmetric-key privacy-preserving authentication protocol for RFID systems with constant-time identification. Instead of increasing communication overhead, the existence of a large storage device in RFID systems, the database, is utilized for improving the time efficiency of tag identification.

In RFID literature, most “privacy-preserving” protocols require the reader to search all tags in the system in order to identify a single tag. In another class of protocols, the search complexity is reduced to be logarithmic in the number of tags, but it comes with two major drawbacks: it requires a large communication overhead over the fragile wireless channel, and the compromise of a tag in the system reveals secret information about other, uncompromised, tags in the same system. In this work, we take a different approach to address time-complexity of private identification in large-scale RFID systems. We utilize the special architecture of RFID systems to propose the first symmetric-key privacy-preserving authentication protocol for RFID systems with constant-time identification. Instead of increasing communication overhead, the existence of a large storage device in RFID systems, the database, is utilized for improving the time efficiency of tag identification.

In this work, we investigate the security of anonymous wireless sensor networks. To lay down the foundations of a formal framework, we develop a new model for analyzing and evaluating anonymity in sensor networks. The novelty of the proposed model is twofold: first, it introduces the notion of ``interval indistinguishability" that is stronger than existing notions; second, it provides a quantitative measure to evaluate anonymity in sensor networks. The significance of the proposed model is that it captures a source of information leakage that cannot be captured using existing models. By analyzing current anonymous designs under the proposed model, we expose the source of information leakage that is undetectable by existing models and quantify the anonymity of current designs. Finally, we show how the proposed model can lead to a general and intuitive direction for improving the anonymity of current designs.