André Zúquete

With the recent growth of Internet of Things (IoT), cloud platforms and, consequently, the exponential increase in online exchanges encompassing sensitive information pertinent to users, it has become necessary to implement strong authentication methods to minimize the risk of user impersonation and, consequently, enhancing the protection of private information. In this paper, a solution is proposed which employs risk assessment aligned with a Multi-Factor Authentication (MFA) system, in a platform that can be easily integrated in applications in order to delegate the authentication process to an external platform. While pushing forward the concept of Adaptive Authentication as a Service, the main goal is to protect against user impersonation and illegitimate access to accounts, while keeping the intrinsic protection of MFA systems and rendering phishing attacks inconsequential with the aid or risk-based adaptability.

Background: The shipping industry is widely regarded as a slow adapting industry, for any innovation to be made there needs to be a real demand. One of these innovations is the electronic Bill of Lading. The need for an alternative to the expensive and slow traditional Bill of Lading has been rising since the beginning of the century. Now the digital revolution naturally introduced the electronic Bill of Lading, but its unclear legal status and different regulations in different countries make it hard to establish a worldwide solution. Nevertheless, there has been progress and the current focus on standardization along with the many advantages of blockchain technology may take it a step closer to a worldwide adoption. Methods: This paper aims to provide information about the most relevant providers of electronic bills of lading, with a clear focus on the underlying technology, in order to make a grounded analysis about each technological solution individually and in general. Results and Conclusions: The information presented was gathered by searching existing literature and public information from the technology providers, focusing on the technology and avoiding law matters.

LoRa is one of the most prominent LPWAN technologies due to its suitable characteristics for supporting large-scale IoT networks, as it offers long-range communications at low power consumption. The latter is granted mainly because end-nodes transmit directly to the gateways and no energy is spent in multi-hop transmissions. LoRaWAN gateways can successfully receive simultaneous transmissions on multiple channels. However, such gateways can be costly when compared to simpler single-channel LoRa transceivers, and at the same time they are configured to operate with pure-ALOHA, the well-known and fragile channel access scheme used in LoRaWAN. This work presents a fair, control-based channel hopping-based medium access scheme for LoRa networks with multiple single-channel gateways. Compared with the pure-ALOHA used in LoRaWAN, the protocol proposed here achieves higher goodput and fairness levels because each device can choose its most appropriate channel to transmit at a higher rate and spending less energy. Several simulation results considering different network densities and different numbers of single-channel LoRa gateways show that our proposal is able to achieve a packet delivery ratio (PDR) of around 18% for a network size of 2000 end-nodes and one gateway, and a PDR of almost 50% when four LoRa gateways are considered, compared to 2% and 6%, respectively, achieved by the pure-ALOHA approach.

This article addresses the adoption and use of Hypertext Transfer Protocol Secure (HTTPS) in the entry pages of the official websites of all (308) Portuguese municipalities. This is relevant because such websites are typically used to provide transactional services to citizens, and citizens need to trust that websites are authentic and that confidentiality and integrity of the information exchanged is assured in the communication process. Automated and, whenever needed, manual analyses were used to investigate the entry pages. Specifically, we checked for the existence of an HTTPS site; the correctness of website certificates and their certification chain; coherence between contents of the HTTP and HTTPS versions of websites; redirection from the HTTP version of a website to its HTTPS version; the existence of resources fetched using HTTP in HTTPS versions of websites; and exploitation of HSTS. A Quality Indicator was then defined and a classification of the municipalities into quality groups was produced. Possible determinants for the results obtained by the municipalities were also investigated. The general conclusion is that there is still much to be done to assure that citizens can communicate securely with the websites of all Portuguese municipalities, since only 3.6% of the municipalities were considered good, while 46.1% do not guarantee the minimum conditions. We argue that these results are associated with the fact that most Portuguese municipalities do not have the critical technical and managerial mass to correctly implement and maintain their websites. To mitigate this limitation, we propose the dissemination of technical instructions on how to correctly configure and deploy municipal HTTPS websites and the creation of shared services between the smaller municipalities.

Healthcare data for primary use (diagnosis) may be encrypted for confidentiality purposes; however, secondary uses such as feeding machine learning algorithms requires open access. Full anonymity has no traceable identifiers to report diagnosis results. Moreover, implicit and explicit consent routes are of practical importance under recent data protection regulations (GDPR), translating directly into break-the-glass requirements. Pseudonymisation is an acceptable compromise when dealing with such orthogonal requirements and is an advisable measure to protect data. Our work presents a pseudonymisation protocol that is compliant with implicit and explicit consent routes. The protocol is constructed on a (t,n)-threshold secret sharing scheme and public key cryptography. The pseudonym is safely derived from a fragment of public information without requiring any data-subject's secret. The method is proven secure under reasonable cryptographic assumptions and scalable from the experimental results.