Search

Real time location systems (RTLSs) are becoming more relevant in a more data driven economy and society due to their wide range of application cases. When the location of an object needs to be tracked with high accuracy, ultra wideband (UWB) technology is usually the best option. Nevertheless, UWB ranging estimates are not completely immune to some sources of error such as non line of sight (NLOS) or multipath conditions. Thus, this paper proposes a real-time classification model based on machine learning (ML) to predict if received ranging estimates are in line of sight (LOS) or NLOS conditions and discard those in NLOS. However, it is also shown that classifying measurements as LOS or NLOS does not guarantee detecting inaccurate ranging estimates, since LOS measurements can also yield large errors. As an example, the ranging root mean square error (RMSE) of the data labelled as LOS in a UWB based localization system database in the literature is of 0.714 m, significantly higher than the theoretical accuracy of a UWB system. Thus, a novel ML-based classification model is proposed to predict the magnitude of the ranging error. After applying the proposed classification model in the same data, the ranging RMSE of those ranging samples classified as most accurate is of only 0.183 m, significantly lower than the best RMSE we can obtain on the classical LOS/NLOS classification approach.

5G is a new technology that can provide more services, due to the improvement in performance, than the current mobile technologies. Because of that, it is selected as a possible technology for automotive transportation systems. Nevertheless, nowadays the 5G technology is in the deployment phase, which could present bugs requiring improvements in the network. Therefore, a tool capable of measuring some of the most relevant features of the 5G, as some of the requirements for the transportation system, is presented. The measurements with the specified tool were carried out in a specific line from the bus company in the San Sebastián city center with the aim of finding out the services that could be improved. Afterward, the results from the different measurements are shown, compared, and discussed. Finally, some conclusions about the obtained results and the services to use the target technology are presented.

On the current environment, companies face risks and threats to the systems they need to operate often known as cyber threats. Most of these companies are small and medium-sized enterprises (SMEs) and they are exposed to these cyber threats. To mitigate the risks and be able to thrive with as little disruption as possible, SMEs require cyber resilience capabilities. However, due to their limited resources, SMEs usually have no dedicated personnel for cyber resilience operationalization and thus lack the experience this discipline requires to implement. To aid SMEs in their cyber resilience operationalization, the current literature offers several kinds of solutions, but these solutions are usually targeted for companies with more resources than SMEs and do not aid in the complete process of assessing their current cyber resilience, deciding actions to improve it and prioritizing these actions. To aid companies in this systematic process to operationalize or implement cyber resilience, this article develops and tests an operational web-based tool in which companies can follow the complete process described before. To achieve this, a cyber resilience framework with the essential policies for SMEs, descriptions of their natural progressions in a progression model and a prioritization of these policies have been developed. In this article, this framework, progression model and prioritization are later transformed into one cyber resilience self-assessment tool (CR-SAT) and are tested in three case studies to qualitatively evaluate the tool by trying to ascertain its usefulness and completeness as well as improving it with the feedback from the end-users.

Communication technologies are in continuous evolution and as well, the different applications making use of them. In order to succeed with the roll-out of the communication-based applications, it is required that the communications technologies are intensively tested and validated before deployment. Current strategies for testing and validation cover field tests and laboratory tests. Railways is also taking advantage of the communication technologies evolution, and therefore, there is a need for having testing and validation strategies adapted to the railway environment, especially for safety-critical applications. Field tests and laboratory tests also apply in Railways. In the frame of laboratory tests, this paper includes an overview of different network emulators existing currently in the market. Furthermore, an analysis of the gaps of the network emulators with regards to the needs of the railways environment is also included. The goal of this paper is to show that network emulators are a flexible cost-effective solution for communication technologies testing purposes. Additionally, this paper also shows that there is a need to adapt current emulators to the railway environment in order to test and validate the future railway applications based on communication technologies.

The constantly evolving cyber threat landscape is a latent problem for today's companies. This is especially true for the Small and Medium-sized Enterprises (SMEs) because they have limited resources to face the threats but, as a group, represent an extensive payload for cybercriminals to exploit. Moreover, the traditional cybersecurity approach of protecting against known threats cannot withstand the rapidly evolving technologies and threats used by cybercriminals. This study claims that cyber resilience, a more holistic approach to cybersecurity, could help SMEs anticipate, detect, withstand, recover from and evolve after cyber incidents. However, to operationalize cyber resilience is not an easy task, and thus, the study presents a framework with a corresponding implementation order for SMEs that could help them implement cyber resilience practices. The framework is the result of using a variation of Design Science Research in which Grounded Theory was used to induce the most important actions required to implement cyber resilience and an iterative evaluation from experts to validate the actions and put them in a logical order. Therefore, this study proposes that the framework could benefit SME managers to understand cyber resilience, as well as help them start implementing it with concrete actions and an order dictated by the experience of experts. This could potentially ease cyber resilience implementation for SMEs by making them aware of what cyber resilience implies, which dimensions it includes and what actions can be implemented to increase their cyber resilience.

Maintenance is one of the major concerns of the industrial sector. Acquiring better levels of maintenance maturity is one of the objectives to be achieved. Therefore, prescriptive maintenance is one of the areas of recent research. Current works in literature are focused on specifics of maintenance strategies (from preventive to prescriptive), usually related to a fixed asset. No previous work has been identified regarding the methodology and guidelines to be followed to be able to evolve within the different strategies from a generic perspective. To address the lack of a methodology that shows a more evolutionary path between maintenance strategies, this paper presents Maintenance Maturity Model M3: a maturity model that identifies three areas of action, four levels of maturity, and the activities to be carried out in each of them to make progress in the maturity level of maintenance strategies. The implementation of prescriptive maintenance should be done in a gradual way, starting at the lowest levels. M3 approaches the problem from a broader perspective, analyzing the 18 different domains and the different levels of prior maturity to be considered for prescriptive maintenance. A study has also been carried out on the different maintenance actions and the applicability of the proposed M3 maturity model to the railway infrastructure maintenance is discussed. In addition, this paper also highlights future research lines and open issues.

Security is the main challenge of the Modbus IIoT protocol. The systems designed to provide security involve solutions that manage identity based on a centralized approach by introducing a single point of failure and with an ad hoc model for an organization, which handicaps the solution scalability. Our manuscript proposes a solution based on self-sovereign identity over hyperledger fabric blockchain, promoting a decentralized identity from which both authentication and authorization are performed on-chain. The implementation of the system promotes not only Modbus security, but also aims to ensure the simplicity, compatibility and interoperability claimed by Modbus.

It is necessary to verify the faults tolerance of the European Train Control System (ETCS) on-board unit even if these faults are uncommon. Traditional test methods defined and used in ETCS do not allow to check this, so it is necessary to develop a new mechanism of tests. This paper presents the design and implementation of a saboteur applied to the railway sector. The main purpose of the saboteur is the fault injection in the communication interfaces. By means of a virtual laboratory it is possible to simulate actual train journeys to test the ETCS on-board unit. Making use of the saboteurs and the virtual laboratory it is possible to analyse the behaviour of the train in the presence of unexpected faults, and to verify that the decisions taken are correct to ensure the required safety level. Therefore, this work shows a testing strategy based on different kinds of train journeys when faults are injected, and the analysis of the results.

Due to the hazardous current cyber environment, cyber resilience is more necessary than ever. Companies are exposed to an often-ignored risk of suffering a cyber incident. This places cyber incidents as one of the main risks for companies in the past few years. On the other hand, the literature meant to aid on the operationalization of cyber resilience is mostly focused on listing the policies required to operationalize it, but is often lacking on how to prioritize these actions and how to strategize their implementation. Therefore, the usage of the current literature in this state is not optimal for companies. Thus, this study proposes a progression model to help companies strategize and prioritize cyber resilience policies by proposing the natural evolution of the policies over time. To develop the model, this study used semi-structured interviews and an analysis of the data obtained from the interviews. Through this methodology, this study found the starting points for each cyber resilience policy and their natural progression over time. These results can help companies in their cyber resilience building process by giving them insights on how to strategize the implementation of the cyber resilience policies.

Industrial Control Systems (ICS) and Supervisory Control systems and Data Acquisition (SCADA) networks implement industrial communication protocols to enable their operations. Modbus is an application protocol that allows communication between millions of automation devices. Unfortunately, Modbus lacks basic security mechanisms, and this leads to multiple vulnerabilities, due to both design and implementation. This issue enables certain types of attacks, for example, man in the middle attacks, eavesdropping attacks, and replay attack. The exploitation of such flaws may greatly influence companies and the general population, especially for attacks targeting critical infrastructural assets, such as power plants, water distribution and railway transportation systems. In order to provide security mechanisms to the protocol, the Modbus organization released security specifications, which provide robust protection through the blending of Transport Layer Security (TLS) with the traditional Modbus protocol. TLS will encapsulate Modbus packets to provide both authentication and message-integrity protection. The security features leverage X.509v3 digital certificates for authentication of the server and client. From the security specifications, this study addresses the security problems of the Modbus protocol, proposing a new secure version of a role-based access control model (RBAC), in order to authorize both the client on the server, as well as the Modbus frame. This model is divided into an authorization process via roles, which is inserted as an arbitrary extension in the certificate X.509v3 and the message authorization via unit id, a unique identifier used to authorize the Modbus frame. Our proposal is evaluated through two approaches: A security analysis and a performance analysis. The security analysis involves verifying the protocol’s resistance to different types of attacks, as well as that certain pillars of cybersecurity, such as integrity and confidentiality, are not compromised. Finally, our performance analysis involves deploying our design over a testnet built on GNS3. This testnet has been designed based on an industrial security standard, such as IEC-62443, which divides the industrial network into levels. Then both the client and the server are deployed over this network in order to verify the feasibility of the proposal. For this purpose, different latencies measurements in industrial environments are used as a benchmark, which are matched against the latencies in our proposal for different cipher suites.

The growing adoption of Radio-frequency Identification (RFID) systems, particularly in the healthcare field, demonstrates that RFID is a positive asset for healthcare institutions. RFID offers the ability to save organizations time and costs by enabling data of traceability, identification, communication, temperature and location in real time for both people and resources. However, the RFID systems challenges are financial, technical, organizational and above all privacy and security. For this reason, recent works focus on attribute-based access control (ABAC) schemes. Currently, ABAC are based on mostly centralized models, which in environments such as the supply chain can present problems of scalability, synchronization and trust between the parties. In this manuscript, we implement an ABAC model in RFID systems based on a decentralized model such as blockchain. Common criteria for the selection of the appropriate blockchain are detailed. Our access control policies are executed through the decentralized application (DApp), which interfaces with the blockchain through the smart contract. Smart contracts and blockchain technology, on the one hand, solve current centralized systems issues as well as being flexible infrastructures that represent the relationship of trust and support essential in the ABAC model in order to provide the security of RFID systems. Our system has been designed for a supply chain environment with an use case suitable for healthcare systems, so that assets such as surgical instruments containing an associated RFID tag can only access to specific areas. Our system is deployed in both a local and Testnet environment in order to stablish a deep comparison and determining the technical feasibility.

The Internet of Things (IoT) provides the ability to digitize physical objects into virtual data, thanks to the integration of hardware (e.g., sensors, actuators) and network communications for collecting and exchanging data. In this digitization process, however, security challenges need to be taken into account in order to prevent information availability, integrity, and confidentiality from being compromised. In this paper, security challenges of two broadly used technologies, RFID (Radio Frequency Identification) and Bluetooth, are analyzed. First, a review of the main vulnerabilities, security risk, and threats affecting both technologies are carried out. Then, open hardware and open source tools like: Proxmark3 and Ubertooth as well as BtleJuice and Bleah are used as part of the practical analysis. Lastly, risk mitigation and counter measures are proposed.