In recent years, the rise of blockchain technology and its applications has led the software development industry to consider blockchain-powered Decentralized Applications (dApps) as serverless REST APIs. However, to engage with dApps, users require a blockchain wallet. This tool facilitates the generation and secure storage of a user's private key and verifies their identity, among other functionalities. Despite their utility, blockchain wallets present significant challenges, such as reliance on trusted third parties, vulnerability to adversaries observing and potentially linking user interactions, key recovery issues, and synchronization of cryptographic keys across multiple devices. This paper addresses these challenges by introducing a fully decentralized multi-platform wallet that leverages blockchain and InterPlanetary File System (IPFS) technologies for managing asymmetric keys and enabling key recovery. This novel approach empowers users to interact with dApps built on blockchain smart contracts while preserving their privacy and ensuring seamless key recovery in the case of device theft or damage. The proposed system is economically viable, with in-depth cost analysis, and demonstrates resilience against security and privacy attacks. A comparative analysis highlights the advantages of the new scheme over existing mainstream and state-of-the-art solutions. Finally, a preliminary prototype implementation is presented to validate the system's feasibility.

In recent years, the implementation of vehicle restricted areas (e.g., Low Emission Zones or Congestion Charge Zones) has proven effective in addressing urban traffic congestion and environmental pollution. Traditionally, these zones have been enforced using the highly centralized and infrastructure-expensive panoptic model. However, recent advancements in smart vehicle technology have enabled a shift towards decentralized, infrastructure-free approaches such as the lateral surveillance model. While offering significant advantages, this novel model also presents relevant security and privacy challenges, including potential misuse and widespread surveillance. This paper introduces a novel autonomous, decentralized, and infrastructure-free solution aligned with the lateral surveillance model. Leveraging Blockchain technology and privacy preservation measures, the system ensures user anonymity during fee pricing and payment processes, and it is capable of detecting and sanctioning dishonest drivers. To assess the applicability of the new scheme in real-world scenarios, it was implemented and tested in controlled environments as well as a low-traffic street. The evaluation included an assessment of the gas costs associated with the smart contracts and a detailed scalability analysis. The theoretical and experimental results demonstrate the feasibility of the proposed solution.

New digital technologies generate large amounts of information. This data is processed by Service Providers in order to improve and develop new services and products, but also to fund themselves. However, processing personal data may result in the extraction of sensitive information, which, in turn, may lead to jeopardizing the users’ privacy. To mitigate this significant risk, the European Parliament and Council of the European Union elaborated the General Data Protection Regulation (GDPR). This regulation forces Service Providers to obtain Data Subjects’ explicit consent prior to collecting and processing their personal data. Nevertheless, the GDPR’s legislative text does not define how Service Providers must transparently demonstrate that they already have these consents. Moreover, most individuals do not know the rights they have over their personal data, neither does this regulation provide them with efficient methods to be aware of what third parties are doing with such data. In order to address this situation, we propose a lightweight blockchain-based GDPR-compliant personal data management platform. The new solution provides public access to immutable evidences that reflect the reached agreements between Data Subjects and Service Providers. In this way, Service Providers can effectively demonstrate that they are fulfilling the regulation, and Data Subjects are able to control and manage their personal data according to their legitimate rights. We have implemented the new system, and we have performed a detailed study which includes: GDPR-compliance, provided functionality, security and privacy issues, and the cost in terms of gas and US dollars of the different operations to be run on the blockchain.

Low Emission Zones (LEZ)s are areas where access restrictions to polluting vehicles are enforced. These infrastructures have become a main mechanism in large cities to deal with urban traffic and environmental pollution. A main problem of practical LEZs is that they generally depend on a camera network that identifies users and jeopardizes their privacy. In the literature, there are some privacy-preserving works that rely on camera-free approaches; however, they still suffer from a major issue: they depend on centralized entities to manage the vehicles’ accesses/departures and their corresponding fee payment. Those centralized entities represent a critical single point of failure in the system, endangering its security and availability. In order to address this situation, this paper proposes a new scheme that decentralizes the LEZ management, dealing with vehicle accesses as blockchain transactions, and pricing and charging them using smart contracts. In order to validate the deployability of the new scheme in real scenarios, it has been implemented and tested in both a controlled environment and a low-traffic street. The evaluation of the smart contracts’ costs in terms of gas has been included in the performed tests. The results obtained are satisfactory and show the feasibility of the new proposal.

Abstract Touristic City Cards are managed by some city councils in order to make a step toward the SmartCity concept. Touristic City Cards enable the integration of different touristic services so as to facilitate the access to transport, cultural sites and touristic attractions to visitors. In this paper, we introduce a secure mobile system called mCityPASS that allows the smart management and secure access to this kind of service. We have implemented the system in a smartphone platform in such a way that the mobile device contains the purchased access element that holds a set of e-tickets that enables the visitors of a city to make use of the specified touristic services. The paper presents the details of the whole implementation of the system and an evaluation of the performance and the effectiveness of it. Also, an analysis of the privacy and the security properties of the presented scheme has been conducted. As a result, we can assure that the system preserves the privacy of the tourists and fulfills the more challenging security properties: fairness, non-overspending, exculpability, unsplittability and selective reusability.

Car Sharing is an innovative transport concept that has emerged to contribute to efficient use of vehicles in urban areas that nowadays suffer from traffic congestion or parking unavailability. Several companies such as vehicle manufacturers have identified the business opportunities related with the Car Sharing market and realized the potential of providing this service to end-users under a private car sharing scenario. However, remaining technical challenges related with the secure management of digital permissions that grant access to vehicles must be addressed. In this paper, we propose a key management system that enables car-sharing use cases, based on a central key management server and a distributed management of the PKI infrastructure. Our system out-stands by providing accountability on the actor's and being resilient to internal attackers that attempt to impersonate system entities, provide false credentials to honest users or illegally take over a vehicle.

The traffic control system proposed in this article has as its main objectives the security, the reliability and the anonymity of the vehicle access to traffic-restricted urban zones. The aim of these zones is to reduce atmospheric pollution in urban centers. The presented approach makes use of smartphones as a communication device between the user and the virtual barrier, which acts as electronic validator and controls the access to the restricted zone. The access is fast (it does not require the complete stop of the vehicle) and is less invasive when compared to existing systems that are based on video camera recording. This is a versatile and cost-efficient system that can be adapted to other access-controlled urban settings: parking lots, sport event access zones, festivals, etc.

Great cities try to prevent from high levels of pollution and traffic jams by restricting the access of vehicles to centric zones, also known as Low-Emission Zones (LEZ). Depending on the topology of the city and also on the traffic patterns and contamination levels, the LEZ can be divided in multiple zones with different prices, obtaining a Multifare Low Emission Zone. Multifare LEZs must manage not only entrances and departures but also changes of zone. Some of the most important issues of LEZs are the risk of losing privacy of the citizen who drive through the LEZ and a significant error percentage on detection of fraudulent drivers. In this article, an Electronic Road Pricing (ERP) system designed specifically for cities with multifare Low-Emission Zones is proposed. Its aim is to detect fraud and to preserve driver's privacy. Using revocable anonymity only fraudulent drivers lose their privacy.

The high levels of pollution and traffic congestion present in almost all major cities around the world have brought solutions such as the deployment of electronic toll systems in some of these cities. The main purpose of those electronic toll systems is to restrict the access of vehicles to certain city areas, named low emission zones. Since its adoption, this solution has proven to be quite promising. However, current proposals are still far from being ideal. More specifically, current schemes still introduce a significant error percentage in the detection of fraudulent drivers. Moreover, they usually require toll systems to be equipped with cameras that take pictures of all the vehicles that pass through the control points. This behavior may represent a serious privacy threat for the drivers. In this article, a new electronic toll system is proposed. The aim of the new proposal is to detect fraud while preserving drivers privacy. More concretely, it provides a non-probabilistic fraud control, and the control points only take pictures of the vehicles that misbehave. Last but not least, the proposed system applies an enhanced dynamic pricing that can help the authorities to better distribute traffic over the road network. Copyright © 2016 John Wiley & Sons, Ltd.

It is quite common that companies and organizations require of releasing and exchanging information related to individuals. Due to the usual sensitive nature of these data, appropriate measures should be applied to reduce the risk of re-identification of individuals while keeping as much data utility as possible. Many anonymization mechanisms have been developed up to present, even though most of them focus on structured/relational databases containing numerical or categorical data. However, the anonymization of transactional data, also known as set-valued data, has received much less attention. The management and transformation of these data presents additional challenges due to their variable cardinality and their usually textual and unbounded nature. Current approaches focusing on set-valued data are based on the generalization of original values; however, this suffers from a high information loss derived from the reduced granularity of output values. To tackle this problem, in this paper we adapt a well-known microaggregation anonymization mechanism so that it can be applied to set-valued data. Moreover, since the utility of textual data is closely related to their meaning, special care has been put in improving the preservation of data semantics. To do so, semantic similarity and aggregation functions are proposed. Experiments conducted on a real set-valued data set show that our proposal better preserves data utility in comparison with non-semantic approaches.

Automatic Fare Collection (AFC) systems calculate the fare that the users must pay depending on the time of service (time-based) or the points of entrance and exit of the system (distance-based). The progressive introduction of Information and Communication Technologies (ICT) allows the use of electronic tickets, which helps to reduce costs and improve the control of the infrastructures. Nevertheless, these systems must be secure against possible fraud and they must also preserve users’ privacy. Therefore, we have studied the security requirements for the timebased and distance-based systems and we have proposed a protocol for each of the AFC systems. The protocols offer strong privacy for honest users, i.e., the service provider is not able to disclose the identity of its users and, moreover, different journeys of the same user are not linkable between them. However, anonymity for users could be revoked if they misbehave. The protocols have been implemented in the Android mobile platform and its performance has been evaluated in two Android smartphones. The results remark that protocols are suitable to be used on AFC system with a medium class mobile device although they offer a better experience with a high-class smartphone. The appearance in the market of more powerful mobile devices suggests a better usability of our proposal in a near future.

Web search engines profile their users by storing and analyzing their past searches. Profiles reflect the interests of the users and enable web search engines to offer a better service. In this way, search results are personalized to fulfill the expectations of each individual user. Nevertheless, this service is not provided without cost. User profiles contain information that can be considered private and personal. This represents a serious privacy threat which must be addressed. Several privacy-preserving techniques which try to prevent this situation can be found in the literature. In this paper, we focus on those that work directly in the computer of the users without requiring any external entity. More specifically, we propose a new single-party scheme that addresses the trade-off between privacy and quality of service but it does not require any change at the server side. The performance of this new method has been evaluated using real search queries extracted from the AOL's files. The results achieved show that our proposal works as expected and it can be considered a proper option for those users who are concerned about their privacy.

Automatic Fare Collection (AFC) systems calculate the fare that the user must pay which depends on the points of entrance and exit of the system. These systems were paper-based, but the progressive introduction of Information and Communication Technologies (ICT) allows the use of electronic tickets which helps to reduce costs and it improves the control of the infrastructures. Nevertheless, these systems must be secure against possible fraud, and they must also preserve users' privacy. We propose an AFC system that offers strong privacy for honest users. The service provider can not disclose the identity of its users and, moreover, different journeys of the same user are unlinkable. However, anonymity for users could be revoked if they misbehave. This system has been designed in order to use personal mobile devices.

We present design guidelines for a cryptographic scheme destined for an electronic survey software system developed in view of application in higher-education institutions By using commercial-grade sqftware, we can provide a user-friendly environment that, on the other hand, can also ensure anonyymous participation. We describe the implementation of such a system with the Java programming language and the steps taken for its installation and use.

Secure electronic exams are one of the most difficult challenges in e-learning security. The relevance of the examination process for any academic institution implies that different security mechanisms must be applied in order to preserve some security properties during different examination stages. In this paper, we present a secure e-exam management system where all exam related information is in digital format. We propose a cryptographic scheme that has to be executed in order to achieve the desired security levels at every exam stage.

Data mining aims at extracting knowledge from data. Sometimes this requires the data owner to make data available to the data analyst. Unless the analyst is trusted by the data owner, the latter may wish to have his intellectual property rights protected. Watermarking is a way to provide some protection, not only for multimedia data, but also for numerical data. It consists of imperceptibly embedding a secret mark into the data to be protected. The mark can later be used to resolve any subsequent disputes on data ownership. This paper presents a watermarking method that embeds a watermark into each attribute of a multivariate continuous numerical dataset. This watermarking method is shown to be robust against random noise addition attacks. Data quality is assured to the extent that the watermarked data nearly preserve the attribute means and the covariance matrix from the original dataset. Our proposal is the first known watermarking system for multivariate numerical datasets with such robustness and quality properties.