[ [ Inter-Trust Interoperable Trust Assurance Infrastructure Project Presentation

INTER-TRUST Project2 Inter-Trust is a project financed by the EC within the FP7 THEME [ICT ] Trustworthy ICT Grant agreement no:

INTER-TRUST Project3 Inter-Trust Objectives 3

INTER-TRUST Project4 Project Overall Objectives Develop a dynamic and scalable framework to support trustworthy services and applications in heterogeneous networks and devices based on the enforcement of interoperable and changing security policies Addressing the needs of developers, integrators and operators to develop and operate systems in a secure trusted manner dictated by negotiated security policies through dynamic SLA 4

INTER-TRUST Project5 Objectives in detail Sw development/test/integration/deployment Design a dynamic and scalable framework that allows creating and deploying critical services and applications that can easily adapt to different security, privacy, interoperability, legal, social and economic constraints Establishing a common security policy via negotiation to assure the interoperation among devices and systems with different security policies Using advanced vulnerability detection techniques (active and fuzz testing) to avoid security vulnerabilities introduced by the dynamic adaptation of the systems involved Design privacy-preserving negotiation and delegation mechanisms for the interoperability of security policies, even in the presence of scarce resources Analyse and assess legal, social and normative aspects 5

INTER-TRUST Project6 Objectives in detail System operation and maintenance To enable the run-time management of security policies including dynamic negotiation of security and trust parameters online deployment during registration and operation. To provide features for the automatic testing and monitoring of security policies increasing trust in the resulting systems by empowering the user and enabling intrusion detection, prevention and reaction 6

INTER-TRUST Project7 Objectives Validation Validate the architecture, techniques and tools developed using two completely different case studies with complex, high- demanding critical services 7

INTER-TRUST Project8 Use Cases Electronic Voting Remote multi-channel e-voting requiring the support of heterogeneous and highly distributed devices with strict security and privacy concerns. Vehicle-to-Vehicle and Vehicle-to- Infrastructure Communications / ITS A set of services, accessed by remote nomad devices or OBU terminals using wireless communications (UMTS, Wi-Fi, …) requiring highly adaptable, distributed security. 8

INTER-TRUST Project9 Use Cases Electronic Voting The security concerns must be fulfilled despite the used voting channel => Negotiation mechanisms must provide Authentication, Security and Delegation policies according to the capabilities of the voting device. Security needs: Confidentiality Integrity Message authenticity Access control Privacy 9

INTER-TRUST Project10 Use Cases V2V and V2I / ITS Security needs: Confidentiality Integrity Message authenticity Timeliness Access control Privacy (anonymity + un-linkability) Security constraints will change with the normal operation of the services, as will the range of end- devices that connect to the services and the coverage of the wireless networks => Adaptability needs

INTER-TRUST Project11 Inter-Trust Approach 11

INTER-TRUST Project12 Challenges Security has to be designed in an autonomous and spontaneous way in all the steps of modeling and deployment of security specification deployment component configuration redeployment in case of environmental changes, in particular when an intrusion is detected 12

INTER-TRUST Project13 Challenges The interoperability security policy is seen as a set of contracts (i.e. security SLAs), negotiated between the involved parties Networks and systems change dynamically, the policy deployment must be able to adapt to these changes 13

INTER-TRUST Project14 Technical approach Dynamic adaptation separate the security concerns compose them later when needed To this end Inter-Trusts adopts protection mechanisms based on Aspect Oriented Programming (AOP) supervision techniques based on monitoring as well as active testing techniques 14

INTER-TRUST Project15 Technical approach Aspect Oriented Programming (AOP) enable to add/implement security “ sub- concerns ” to application components f.i. availability, authentication, access control, integrity, encryption, enrolment...) used to “ weave ” security-related concerns and properties “on the fly” each party can dynamically adapt its behaviour to the negotiated security contracts 15

INTER-TRUST Project16 Technical approach Formal-based monitoring techniques to detect changes in the environment to check whether the involved parties actually respect the negotiated contracts information will be fed back to the framework and the involved parties they will adapt themselves to new threats and constraints that may arise 16

INTER-TRUST Project17 Technical approach Active and fuzz testing will complete the approach by performing conformance and robustness testing Active testing will be used to verify that the implementation of security policies respects the interoperability requirements Fuzz testing will be used to check the robustness of the interoperability of security policies 17

INTER-TRUST Project18 The Global Architecture 18

INTER-TRUST Project19 Modelling security policies

INTER-TRUST Project20 Negotiating security policies

INTER-TRUST Project21 Dynamically generates aspects to be woven Based on the negotiated policy

INTER-TRUST Project22 Interprets the negotiated policy aspects woven into the application

INTER-TRUST Project23 Injects code Captures application events Detects non compliance of security requirements

INTER-TRUST Project24 Performs protection and mitigation strategies

INTER-TRUST Project25 Stand-alone monitoring and testing tools

INTER-TRUST Project26 The Partners INTER-TRUST Partners 1.Softeco Sismat Srl (Coordinator) 2.Montimage EURL 3.Institut Telecom 4.Universitat Rovira i Virgili 5.Search-Lab 6.Universidad de Malaga 7.University of Reading 8.Universidad de Murcia 9.Scytl Secure Electronic Voting 10.INDRA Sistemas

INTER-TRUST Project27 Dates and milestones INTER-TRUST started on November 2012 The project will last 30 months Four Milestones M1 specifications at M6 M2 first prototype at M12 M3 second prototype at M26 M4 final delivery and demo at M30

INTER-TRUST Project28 Contacts Project Coordinator Enrico Morten Softeco Sismat enrico.morten(at)softeco(dot)it Project Technical Manager Edgardo Montes de Oca Montimage edmo(at)wanadoo(dot)fr Project Exploitation and Dissemination Manager Antonio F. Skarmeta Gómez Dept. Ingeniería de la Información y las Comunicaciones Facultad de Informática, Universidad de Murcia skarmeta(at)um(dot)es

INTER-TRUST Project29 End… 29