Dan Garcia-Carrillo

Network access authentication performed by constrained devices is a cornerstone of security in Internet of Things (IoT) environments. In this regard, the Internet Engineering Task Force (IETF) has recently standardised CoAP-EAP (RFC 9820), an authentication service that transports the Extensible Authentication Protocol (EAP) over Constrained Application Protocol (CoAP), thus bringing this authentication framework to the IoT realm. This paper analyses and provides a comprehensive overview of CoAP-EAP, explaining the main design decisions made throughout its standardisation, describing its applicability across different network infrastructures, and presenting a proof-of-concept implementation that has been evaluated in a realistic IoT testbed.

ADAS (Advanced Driver Assistance Systems) are becoming increasingly popular in on-road vehicles due to their safety, productivity, and cost savings. In the same way, off-road vehicles can benefit from ADAS systems to improve the security of drivers and workers in industrial settings. In this work, we study, design, and develop a novel security system to be integrated into industrial vehicles. This system is built to provide one-way Human Computer Interaction, from the computer to the human, so providing, through the interaction with the ADAS system, feedback to drivers about their surroundings, such as nearby workers, and thus helping to avoid collisions and prevent incidents. The study evaluates the quality of different feedback mechanisms, with the goal of designing the ADAS that produces the best User eXperience (UX). These feedback mechanisms are generated by LEDs in different display formats and colors, as well as with haptic feedback. We created a hybrid testbed using a realistic ADAS and a forklift simulator, integrating the system into a physical structure that resembles an industrial vehicle (a forklift) and used a computer-based simulation of a warehouse to gather the information from users. We performed a study with 36 people for the evaluation of the different feedback mechanisms tested, evaluating the results both from an objective point of view based on the results of the simulation, and a subjective point of view through a questionnaire and the stress of the users in each test.

The use of remote desktop applications has increased greatly in recent years, mainly because of the generalization of telecommuting due to the COVID-19 pandemic. This process has been carried out in a very controlled manner in some companies, but in other organizations it has been introduced in a more anarchic way. The direct use of on-premises company computers and resources from the internet without the necessary protection mechanisms, including VPNs, has increased the risk of data exfiltration. Apart from other types of data exfiltration, there are cases in which employees transfer files using encrypted communications, consciously or unconsciously, producing a leak of information undetected by data loss prevention systems. In this paper we analyse the question of whether a forensic investigation may answer questions about data exfiltrations; questions such as those regarding the when, what and who (or to whom) and the use of application logs and other available tools. The answers to these questions may form the basis of solid digital evidence for legal purposes, though they may only deliver a partial response to said questions. Other complementary sources are necessary to build a complete answer and accurate digital evidence. Nevertheless, we have identified and analysed several use cases that may help to raise an early alarm that can offer warning about certain behaviours in encrypted traffic that may be detected via network monitoring.

Factories and industrial warehouses are environments in which accidents can be easily produced. People on foot work in the same place where heavy machinery is operating. Therefore, when accidents occur, they frequently have severe consequences. To reduce the number of accidents and their effects, there are strict regulations on the workplace and workers participate in regular training activities. In recent years, there has been a great evolution in Advanced Driver Assistance Systems (ADAS) specially in public road vehicles. With the proper design, these systems may also help to improve safety in industrial environments. For example, an ADAS may warn industrial drivers about nearby pedestrians. Nevertheless, the development of ADAS in this context is complex because industrial environments and their machines are very heterogeneous. Hence, this paper describes a testbed developed to assess the design of ADAS for industrial vehicles. The testbed includes all the elements needed to evaluate an industrial ADAS: hardware, an event management system, a simulator of a warehouse and, an evaluation methodology. To determine the effectiveness of the testbed, the assessment of an ADAS designed to warn industrial drivers about nearby obstacles has also been performed. The assessment includes a subjective evaluation of the testbed and of the cognitive load generated during the evaluation. The results of this assessment are very promising. They show that the testbed is realistic and that it is effective for ADAS designers to analyse the reactions of drivers to the signals produced by the assistance systems under evaluation.

The defence-in-depth (DiD) methodology is a defensive approach usually performed by network administrators to implement secure networks by layering and segmenting them. Typically, segmentation is implemented in the second layer using the standard virtual local area networks (VLANs) or private virtual local area networks (PVLANs). Although defence in depth is usually manageable in small networks, it is not easily scalable to larger environments. Software-defined networks (SDNs) are emerging technologies that can be very helpful when performing network segmentation in such environments. In this work, a corporate networking scenario using PVLANs is emulated in order to carry out a comparative performance analysis on defensive strategies regarding CPU and memory usage, communications delay, packet loss, and power consumption. To do so, a well-known PVLAN attack is executed using simulated attackers located within the corporate network. Then, two mitigation strategies are analysed and compared using the traditional approach involving access control lists (ACLs) and SDNs. The results show the operation of the two mitigation strategies under different network scenarios and demonstrate the better performance of the SDN approach in oversubscribed network designs.