Search

Marine Protected Areas (MPAs) are essential tools in the protection and conservation of marine ecosystems. However, very few MPAs are effective and meet their conservation objectives mainly due to a lack of coordination, participation or resources. For instance, in the Mediterranean Sea there are about 1062 MPAs, but 72% of them do not have effective regulations to reduce human impacts on biodiversity and current efforts are insufficient in managing human uses for the conservation and protection of marine biodiversity. This makes necessary to seek new ways or instruments for their management. In this sense, digitalization and Information and Communication Technologies (ICT) can provide tools to facilitate the development of MPAs management in a more effective, participatory and efficient manner because automatic agents report their information and digest the data no matter the situation. In the specific case of Spain, one of the main problems identified for MPAs management is the overlapping of different kinds of protected areas in the same territory. In addition, these are managed by different administrations (Regional, National). An example of this situation is the Sierra Helada Marine Natural Park (SHMP) in Alicante. Within its territorial scope there are 3 MPAs with different protection figures that overlap each other, SHMP, the Natura 2000 site of Serra Gelada i la Marina Baixa and a fishing protected area. These MPAs are managed by different regional governmental bodies, and have a natural resources action plan in use, supported by a management collaboration agreement with the town councils in the area and the Altea Nautical Club. In the SHMP, Posidonia oceanica (PO) is one of the most important ecosystems and its presence prompted its creation and declaration. PO is a marine angiosperm endemic to the Mediterranean Sea that forms extensive meadows from the sea surface to 30–40 m depth and which provides essential goods and services: it improves water quality and protect beaches against erosion. PO meadows are recognized as biodiversity hotspots, and as major carbon sinks, but they are very sensitive to human activities. However, although many regulations protect PO, there are still significant threats to their conservation. In this regard, the research presented in this paper is the development of an ICT-based software tool, called Smart MPA, that includes an analysis framework based on management and governance indicators specific for PO and a database on PO that includes and combines different sources of information, including the results obtained of the evaluation of the analytical framework, input from information from citizens or MPA users, for example, by sending photos to report infractions in PO at specific points and from satellite images or underwater UAVs. The main objective of the Smart MPA tool is to offer services applied to PO management, either through the analysis of governance indicators or by facilitating the integration of citizen information to be used in management activities. The tool has been tested and used by the management staff of SHMP to be applied to an annual monitoring of management measures to develop an adaptive management of PO and the SHMP. After that, a semi-structured interview was carried out to collect information on the analytical framework co-developed and a survey was created where management staff of SHMP have given their perception on the usability of the tool and on the environmental problems affecting the conservation of PO in SHMP. According to the results obtained, the management of PO in SHMP is efficient, at a general level, with the lack of adequate funding being a limiting factor. The main threats are boat anchoring and organic pollution. In conclusion, the Smart MPA tool and the analytical framework are instruments that can facilitate the management and promote good environmental governance processes for the conservation of PO meadows in SHMP. At the same time, the importance of exploring mobile apps to increase citizen participation and mitigate threats and impacts on PO have been highlighted., This study forms part of: (1) ThinkInAzul project supported by Ministerio de Ciencia e Innovación with funding from European Union NextGenerationEU (PRTR-C17.I1) and by Comunidad Autónoma de la Región de Murcia-Fundación Seneca; (2) WATERMED4.0 project (Efficient use and management of conventional and non-conventional water resources through intelligent technologies applied to improve the quality and safety of Mediterranean agriculture in semi-arid areas) action 1821 of the PRIMA program of the European Union. The PRIMA program is an Art.185 initiative supported and funded by Horizon 2020 (https://www.watermed-project.eu); and (3) B-Blue (Building the Blue Biotechnology community in the Mediterranean) governance and innovation project co-financed by the European Regional Development Fund through the Interreg Med program (https://b-blue.interreg-med.eu)

The main idea behind this paper is to use the common place building simulator EnergyPlus to understand if it is possible to model a standalone photovoltaic system starting from the simulation of a hybrid photovoltaic system. Our proposal consists of considering the days characterised by a lack of energy stored in the battery system of hybrid photovoltaics as if they were blackout days of a corresponding standalone system.

Demand Response (DR) strategies represent an innovative option to optimise energy management. In particular, smart thermostats have captured the attention of the scientific community for their effectiveness in achieving energy-saving and peak-shaving by lowering HVAC consumption during critical hours of the year. One way of achieving this aim, is to leave the control of the smart thermostat to a third party for the duration of the DR event in the so-called Direct Load Control (DLC) configuration. Most research focuses on thermostat overrides during DR events; in this work, we use real world data from the Donate Your Data dataset to analyse the interaction of users with the thermostat around the DR event. In particular, this work focuses on users that interact with the thermostat before (anticipative behaviour) or during the DR event (reactive behaviour), leading to a lower efficiency of the load control. Through clustering techniques, different categories of users are identified, and some significant cases are simulated on a building energy simulation tool to quantify the missed power reduction and the impact on energy. The study highlights that the behaviour of some users can reduce or even nullify the efficacy of the DLC strategy. In light of the findings and to prevent this issue, we suggest the need for tailored DR events for different archetypes of users as identified in this work through clustering

International audience; The Internet of Things (IoT) is driving research and innovation in the areas of security and device management. The bootstrapping procedure is yet another security problem that needs to be solved. At the bootstrapping period, a newly deployed device is performing a set of actions that allows it to join a network as a trusted party. One of the currently proposed methods in the Internet Engineering Task Force (IETF) EAP Method Update (EMU) Working Group (WG) is employing the Extensible Authentication Protocol (EAP) to enable the authenti-cation of IoT devices in more efficient and scalable ways. In this sense, we select and investigate the suitability one of the newly proposed EAP method in LoRaWAN, a Low-Power Wide-Area Network (LPWAN) technology. EAP-Nimble out-of-band (EAP-NOOB) method works without pre-established configuration and enables an out-of-band channel to improve authentication. In this paper, we analyse how the EAP-NOOB method can be employed in LoRaWAN networks, we then propose the use of two mechanisms that can be used to reduce the message size of the EAP-NOOB exchange.

Security and interoperability are critical factors in Internet of Things (IoT) constrained networks in order to boost their fully integration with the Internet. In particular, secure bootstrapping and long headers compression, e.g., IPv6, are key procedures to enable end-to-end security associations with robust algorithms among cloud platforms and IoT devices. Nevertheless, few efforts are being dedicated to provide secure end-to-end authentication in IoT networks based on the prominent Low Power-Wide Area Network (LP-WAN) paradigm such as LoRaWAN. Thereby, this work discusses the security and interoperability requirements of these systems by means of a realistic use case, namely, smart-agriculture. In order to cope with the identified gaps, we present a novel solution based on the combination of the LP-WAN Static Context Header Compression (SCHC) scheme for IPv6/UDP/CoAP messages and Low-Overhead CoAP-EAP (LO-CoAP-EAP) bootstrapping. This enables the establishment of security association through IoT constrained links. Both protocols, which are two Internet Engineering Task Force (IETF) proposals, are integrated and adapted to be compliant with the LoRaWAN architecture and its stringent communication restrictions. The results show the validity of our approach with different LoRaWAN configurations, which notably increases the robustness of the overall IoT infrastructure.

Internet of Things environments are comprised of heterogeneous devices that are continuously exchanging information and being accessed ubiquitously through lossy networks. This drives the need of a flexible, lightweight and adaptive access control mechanism to cope with the pervasive nature of such global ecosystem, ensuring, at the same time, reliable communications between trusted devices. To fill this gap, this paper proposes a flexible trust-aware access control system for IoT (TACIoT), which provides an end-to-end and reliable security mechanism for IoT devices, based on a lightweight authorization mechanism and a novel trust modelthat has been specially devised for IoT environments. TACIoT extends traditional access control systems by taking into account trust values which are based on reputation, quality of service, security considerations and devices' social relationships. TACIoT has been implemented and evaluated successfully in a real testbed for constrained and non-constrained IoT devices.

Today trust is a key factor in distributed and collaborative environments aimed to model participating [email protected]? behavior, and to foresee their further actions. Yet, prior to the first interaction of a newcomer in the system trust and reputation models face a great challenge: how to assign an accurate initial reputation to a newcomer? The answer needs to tackle two well-known problems: cold-start and reputation bootstrapping. Cold-start is a common issue to any system when newcomers boot for the first time, while reputation bootstrapping especially affects highly distributed scenarios, where mobile entities travel across domains and collaborate with a number of them. In this paper we focus on the two problems, which are addressed through a novel reputation bootstrapping mechanism for newcomers in a collaborative alert system aimed at detecting distributed threats. Experiments confirm the accuracy of our proposal as well as its robustness in the presence of ill-intentioned entities.

In distributed and collaborative attack detection systems decisions are made on the basis of the events reported by many sensors, e.g., Intrusion Detection Systems placed across various network locations. In some cases such events originate at locations over which we have little control, for example because they belong to an organisation that shares information with us. Blindly accepting such reports as real encompasses several risks, as sensors might be dishonest, unreliable or simply having been compromised. In these situations trust plays an important role in deciding whether alerts should be believed or not. In this work we present an approach to maximise the quality of the information gathered in such systems and the resilience against dishonest behaviours. We introduce the notion of trust diversity amongst sensors and argue that detection configurations with such a property perform much better in many respects. Using reputation as a proxy for trust, we introduce an adaptive scheme to dynamically reconfigure the network of detection sensors. Experiments confirm an overall increase both in detection quality and resilience against compromise and misbehaviour.

Distributed and coordinated attacks in computer networks are causing considerable economic losses worldwide in recent years. This is mainly due to the transition of attackers' operational patterns towards a more sophisticated and more global behavior. This fact is leading current intrusion detection systems to be more likely to generate false alarms. In this context, this paper describes the design of a collaborative intrusion detection network (CIDN) that is capable of building and sharing collective knowledge about isolated alarms in order to efficiently and accurately detect distributed attacks. It has been also strengthened with a reputation mechanism aimed to improve the detection coverage by dropping false or bogus alarms that arise from malicious or misbehaving nodes. This model will enable a CIDN to detect malicious behaviors according to the trustworthiness of the alarm issuers, calculated from previous interactions with the system. Experimental results will finally demonstrate how entities are gradually isolated as their behavior worsens throughout the time.

In this paper, we present a solution that reduces the time spent on providing network access in multi-domain mobile networks where the authentication process is based on the Extensible Authentication Protocol (EAP). The goal is to achieve fast and smooth handoffs by reducing the latency added by the authentication process. This process is typically required when a mobile user moves from one authenticator to another regardless of whether the new authenticator is in the same domain (intra-domain) or different domain (inter-domain). To achieve an efficient solution to this problem, it has been generally recognized that a fast and secure key distribution process is required. We propose a new fast re-authentication architecture that employs a secure three-party key distribution protocol which reduces the number of message exchanges during the network access control process. Our approach is proved to preserve security and verified by means of a formal tool. The resulting performance benefits are shown through our extensive simulations.

The Extensible Authentication Protocol (EAP) has been standardized within the Internet Engineering Task Force (IETF) in order to provide flexible mechanisms for authentication and key management for network access control. However, some deficiencies have been revealed and recognized as a major obstacle to achieving secure and seamless handover in mobile scenarios. HOKEY (Handover Keying) Working Group in IETF is standardizing low-latency EAP re-authentication and key distribution protocols to address these deficiencies. This paper provides a critical analysis of the on-going work.

In this paper we present an architecture for fast re-authentication, based on the use of the Kerberos protocol, which allows the reduction in the latency introduced for an authentication process based on the Extensible Authentication Protocol (EAP) when providing network access in mobile networks. The architecture supports two modes of operation, proactive and reactive, to reduce the latency added for the authentication processes which is required when a mobile user changes network points of attachment. Moreover, we provide implementation details on a representative wireless testbed and obtain experimental results from the testbed. Those results are used for simulations to evaluate the performance of the proposed architecture for different deployment scenarios and parameters. We also provide a mathematical analysis to compute authentication delay and validate the simulation results. Performance comparison based on the experiment, simulation and analysis show that the proposed architecture can reduce the authentication delay, compared to other alternatives in typical deployment scenarios.

Network access control mechanisms constitute an increasingly needed service, when communications are becoming more and more ubiquitous thanks to some technologies such as wireless networks or Mobile IP. This paper presents a particular scenario where access rules are based not only on the identity of the different users but also on authorization data related to those users. In order to accomplish this general goal, it will be necessary to add to the traditional system-specific services for authentication and authorization, and also some entities able to manage the information related to identity, roles and permissions. Network access will be based on the 802.1X framework and the Authentication, Authorization, and Accounting (AAA) architecture, as they constitute the basis for most of the existing proposals for limiting the access to a restricted network. These proposals will be extended making use of an authorization infrastructure based on SAML statements, the RBAC model, and XACML as the main language for expressing authorization policies. The solution that we present in this paper is a consequence of an exhaustive and non-trivial analysis of the different mechanisms that could be used to provide this kind of service. As we will see, the correct integration of these different mechanisms leads to the definition of a scalable and versatile network access control system which conforms to the guidelines outlined by the AAA initiative.

The basic job of a public key infrastructure (PKI) is to define the mechanisms used both to allow a recipient of a signed message to trust a digital signature and to allow a sender to find the encryption key for a recipient. It is comprised of those elements needed to manage and enable the effective use of public key cryptography technology, particularly in medium and large-scale. Nowadays, PKIs are considered to be a key element for providing security to new distributed application environments. However, the sole use of a PKI as a mechanism to create a link between an identifier and a public key is not enough to offer effective mechanisms to those environments. New security services based on PKI try to address some existing drawbacks of current distributed systems. On the one hand, they can provide mechanisms to alleviate the lack of support for decentralized and automated management of access control and authorization policies, which are usually configured using inefficient and error-prone methods. On the other hand, new security services can also be used to link authorization information to the public keys being certified by the PKI, therefore enabling new opportunities for distributed access control procedures. In this paper, we describe two of these innovative security services built over our own designed and implemented Java IPv6 PKI: a distributed security policy management architecture and a distributed credential management system.

In this paper we present a solution for reducing the time spent on providing network access in mobile networks which involve an authentication process based on the Extensible Authentication Protocol. The goal is to provide fast handover and smooth transition by reducing the impact of authentication processes when mobile user changes of authenticator. We propose and describe an architecture based on a secure 3-party key distribution protocol which reduces the number of roundtrips during authentication phase, and verify its secure properties with a formal tool.

In this paper we present a solution for providing a fast transition in heterogeneous mobile networks which involve network access control based on the Extensible Authentication Protocol. The goal is to reduce the time spent on providing access and smooth transition, between different technologies which require to perform authentication to allow network access. We propose and describe an architecture and secure protocol, which reduce the number of round trips during authentication phase, and verify its secure properties with a formal tool.

We analyze the problem of reducing packet losses due to the authentication time which is required when an ad hoc node switches across different gateways in a mobile ad hoc network connected to Internet (hybrid MANET). Our goal is to provide a mechanism allowing Internet gateways to accept only authorized traffic without decreasing the overall performance of the system. We propose a solution based on pre-authentication which uses utility-based optimal control to choose with which gateways to pre-authenticate over time. Our simulation results show that the proposed scheme outperforms traditional schemes across a variety of network scenarios and configurations.

The design and implementation of distributed High Performance Computing (HPC) applications is becoming harder as the scale and number of distributed resources and application is growing. Programming abstractions, libraries and frameworks are needed to better overcome that complexity. Moreover, when Quality of Service (QoS) requirements such as load balancing, efficient resource usage and fault tolerance have to be met, the resulting code is harder to develop, maintain, and reuse, as the code for providing the QoS requirements gets normally mixed with the functionality code. Component Technology, on the other hand, allows a better modularity and reusability of applications and even a better support for the development of distributed applications, as those applications can be partitioned in terms of components installed and running (deployed) in the different hosts participating in the system. Components also have requirements in forms of the aforementioned non-functional aspects. In our approach, the code for ensuring these aspects can be automatically generated based on the requirements stated by components and applications, thus leveraging the component implementer of having to deal with these non-functional aspects. In this paper we present the characteristics and the convenience of the generated code for dealing with load balancing, distribution, and fault-tolerance aspects in the context of CORBA-LC. CORBA-LC is a lightweight distributed reflective component model based on CORBA that imposes a peer network model in which the whole network acts as a repository for managing and assigning the whole set of resources: components, CPU cycles, memory, etc.

Network access control mechanisms constitute an increasingly needed service, when communications are becoming more and more ubiquitous thanks to some technologies such as wireless networks or mobile IP. This paper presents a particular scenario where access rules are based not only on the identity of the different users, but also on authorization data related to those users. In order to accomplish this general goal, it will be necessary to add to the traditional systems specific services for authentication and authorization, and also some entities able to manage the information related to identity, roles and permissions. Network access is based on the 802.1X framework and the AAA architecture, as they constitute the basis for most of the existing proposals for limiting the access to a restricted network. Those proposals are extended using an authorization infrastructure based on SAML statements, the RBAC model, and XACML as the language for expressing authorization policies.

New DAC and RBAC certificate-oriented access control systems are based on delegation of privileges. In this paper, we present a survey of different issues related to certificate-based delegation, such as management structures, authority and ownership, anonymity, certificate distribution, and revocation.

Although Grid technology appears as a promising infrastructure for global computation and effective resource sharing, the development of Grid Applications is still based in traditional programming models such as Message Passing Interface (MPI), making it difficult to provide a good level of software reuse and productivity. Moreover, the Grid offers an environment where the component technology can be applied to a greater extent than ever, due to the intrinsic security enforced by the Grid, allowing the creation of a successful component market. Component technology accelerates software development enforcing software reuse and sharing. In this article we present CORBA-\(\mathcal{LC}\) and the design of its Container, that manage components and provides them with non-functional aspects such as security, concurrency, distribution, load balancing, fault tolerance, replication, data-parallelism, etc. Component implementors can thus focus only on the component functionality itself, independently of these aspects, provided by the Container. Furthermore, we identify these non-functional aspects in the Grid Computing domain and show the current status of the implementation.