SciTePress - Affiliation Profile

FONDAZIONE BRUNO KESSLER, Italy

Context (please use complete words only)

Field

Sort by

21 Papers

Enhancing National Digital Identity Systems: A Framework for Institutional and Technical Harm Prevention Inspired by Microsoft’s Harms Modeling

Topics: Identity Management; Ethical and Legal Implications of Security and Privacy

Authors: Giovanni Corti ^{1

;

2} , Gianluca Sassetti ^{3

;

1} , Amir Sharif ¹ , Roberto Carbone ¹ and Silvio Ranise ^{4

;

1}

Affiliations: ¹ Center for Cybersecurity, FBK, Trento, Italy , ² Department of Defence Studies, King’s College London, London, U.K. , ³ Department of Informatics, Bioengineering, Robotics and Systems Engineering, University of Genoa, Genoa, Italy , ⁴ Department of Mathematics, University of Trento, Trento, Italy

Digital Object Identifier: 10.5220/0013601400003979

Proceedings of SECRYPT 2025, ISBN: 978-989-758-760-3

Quick Abstract

The rapid adoption of National Digital Identity systems (NDIDs) across the globe underscores their role in ensuring the human right to identity. Despite the transformation potential given by digitization, these systems introduce significant challenges, particularly concerning their safety and potential misuse. When not adequately safeguarded, these technologies can expose individuals and populations to privacy risks as well as violations of their rights. These risks often originate from design and institutional flaws embedded in identity management infrastructures. Existing studies on NDIDs related harms often focus narrowly on technical design issues while neglecting the broader institutional infrastructures that enable such harms. To fill this gap, this paper extends the collection of harms for analysis through a qualitative methodology approach of the existing harm-related literature. Our findings suggest that 80% of NDID-related harms are the product of suboptimal institutions and poor governance models, and that 47.5% of all impacted stakeholders are considered High Risk. By proposing a more accurate harm assessment model, this paper provides academia and the industry with a significant contribution that allows for identifying the possibility of NDID-related harms at an embryonic state and building the necessary infrastructure to prevent them.

Automating Compliance for Improving TLS Security Postures: An Assessment of Public Administration Endpoints

Topics: Web Security and Privacy; Security Verification and Validation; Security and Privacy Policies; Network Security; Security Protocols

Authors: Riccardo Germenia ^{1

;

2} , Salvatore Manfredi ² , Matteo Rizzi ^{1

;

2} , Giada Sciarretta ² , Alessandro Tomasi ² and Silvio Ranise ^{2

;

3}

Affiliations: ¹ Department of Information Engineering and Computer Science, University of Trento, Via Sommarive 9, Trento, Italy , ² Center for Cybersecurity, Fondazione Bruno Kessler, Via Sommarive 18, Trento, Italy , ³ Department of Mathematics, University of Trento, Via Sommarive 14, Trento, Italy

Digital Object Identifier: 10.5220/0012764700003767

Proceedings of SECRYPT 2024, ISBN: 978-989-758-709-2

Quick Abstract

System administrators tasked with configuring TLS servers must make numerous decisions - e.g., selecting the appropriate ciphers, signature algorithms, and TLS extensions - and it may not be obvious, even to security experts, which decisions may expose them to attacks. To address this issue, raise awareness, and establish a security threshold, numerous cybersecurity agencies around the world issue technical guidelines for the use and configuration of TLS. In this paper we carry out an assessment of the TLS security posture of European and US based endpoints in relation to their respective national cybersecurity guidelines. Our results show that a surprisingly high amount of the analyzed websites have a low compliance level when compared to their respective national guideline. We attempt to identify potential causes by presenting a series of observations that may underlie the lack of compliance. The analysis is conducted by employing a TLS analyzer we developed to automate the compliance analysis and the application of the suggested changes, assisting system administrators during this important yet complex task. Our tool and the dataset containing the machine-readable requirements for automating conformity assessment are publicly available, thus making the process auditable and the assets extensible.

A First Appraisal of Cryptographic Mechanisms for the Selective Disclosure of Verifiable Credentials

Topics: Identity Management; Applied Cryptography; Privacy Enhancing Technologies

Authors: Andrea Flamini ¹ , Silvio Ranise ^{1

;

2} , Giada Sciarretta ² , Mario Scuro ¹ , Amir Sharif ² and Alessandro Tomasi ²

Affiliations: ¹ Department of Mathematics, University of Trento, Trento, Italy , ² Center for Cybersecurity, FBK, Trento, Italy

Digital Object Identifier: 10.5220/0012084000003555

Proceedings of SECRYPT 2023, ISBN: 978-989-758-666-8

Quick Abstract

Verifiable credentials are a digital analogue of physical credentials. Their authenticity and integrity are protected by means of cryptographic techniques, and they can be presented to verifiers to prove claims about the holder of the credential itself. One way to preserve privacy during presentation consists in selectively disclosing the attributes in a credential. In this paper we present the most widespread cryptographic mechanisms used to enable selective disclosure of attributes, describing their structure and comparing them in terms of performance, size of the associated verifiable presentations, and the ability to produce predicate proofs and unlinkable presentations.

A Framework for Security and Risk Analysis of Enrollment Procedures: Application to Fully-remote Solutions based on eDocuments

Topics: Identity Management; Risk Assessment; Identification, Authentication and Non-Repudiation; Security Protocols

Authors: Marco Pernpruner ^{1

;

2} , Giada Sciarretta ² and Silvio Ranise ^{3

;

2}

Affiliations: ¹ Department of Informatics, Bioengineering, Robotics and System Engineering, University of Genoa, Genoa, Italy , ² Security & Trust Research Unit, Fondazione Bruno Kessler, Trento, Italy , ³ Department of Mathematics, University of Trento, Trento, Italy

Digital Object Identifier: 10.5220/0010554502220233

Proceedings of SECRYPT 2021, ISBN: 978-989-758-524-1

Quick Abstract

More and more online services are characterised by the need for strongly verifying the real-world identity of end users, especially when sensitive operations have to be carried out: just imagine a fully-remote signature of a contract, and what could happen whether someone managed to perform it by using another person’s name. For this reason, the identity management lifecycle contains specific procedures – called enrollment or onboarding – providing a certain level of assurance on digital users’ real identities. These procedures must be as secure as possible to prevent frauds and identity thefts. In this paper, we present a framework composed of a specification language, a security analysis methodology and a risk analysis methodology for enrollment solutions. For concreteness, we apply our framework to a real use case (i.e., fully-remote solutions relying on electronic documents as identity evidence) in the context of a collaboration with an Italian FinTech startup. Beyond validating the framework, we analyse and highlight the essential role of mitigations on the overall security of enrollment procedures.

Can Data Subject Perception of Privacy Risks Be Useful in a Data Protection Impact Assessment?

Topics: Personal Data Protection for Information Systems; Data Protection

Authors: Salimeh Dashti ¹ , Anderson Santana de Oliveria ² , Caelin Kaplan ² , Manuel Dalcastagnè ³ and Silvio Ranise ^{1

;

3}

Affiliations: ¹ Fondazione Bruno Kessler, Italy , ² SAP Labs France, France , ³ University of Trento, Italy

Digital Object Identifier: 10.5220/0010602608270832

Proceedings of SECRYPT 2021, ISBN: 978-989-758-524-1

Quick Abstract

The General Data Protection Regulation requires, where possible, to seek data subjects perception. Studies showed that people do not have a correct privacy risk perception. In this paper, we study how lay people perceive privacy risks once they are made aware and if experts can differentiate between security and privacy risks.

Cryptographic Enforcement of Access Control Policies in the Cloud: Implementation and Experimental Assessment

Topics: Data Protection; Access Control; Applied Cryptography; Security and Privacy in the Cloud

Authors: Stefano Berlato ^{1

;

2} , Roberto Carbone ² and Silvio Ranise ^{3

;

2}

Affiliations: ¹ DIBRIS, University of Genoa, Genoa, Italy , ² Security and Trust Research Unit, Fondazione Bruno Kessler, Trento, Italy , ³ Department of Mathematics, University of Trento, Trento, Italy

Digital Object Identifier: 10.5220/0010608003700381

Proceedings of SECRYPT 2021, ISBN: 978-989-758-524-1

Quick Abstract

While organisations move their infrastructure to the cloud, honest but curious Cloud Service Providers (CSPs) threaten the confidentiality of cloud-hosted data. In this context, many researchers proposed Cryptographic Access Control (CAC) schemes to support data sharing among users while preventing CSPs from accessing sensitive data. However, the majority of these schemes focuses on high-level features only and cannot adapt to the multiple requirements arising in different scenarios. Moreover, (almost) no CAC scheme implementation is available for enforcement of authorisation policies in the cloud, and performance evaluation is often overlooked. To fill this gap, we propose the toolchain COERCIVE, short for CryptOgraphy killEd (the honest but) cuRious Cloud servIce proVidEr, which is composed of two tools: TradeOffBoard and CryptoAC. TradeOffBoard assists organisations in identifying the optimal CAC architecture for their scenario. CryptoAC enforces authorisation policies in the cloud by deploying the architecture selected with TradeOffBoard. In this paper, we describe the implementation of CryptoAC and conduct a thorough performance evaluation to demonstrate its scalability and efficiency with synthetic benchmarks.

Multi-Stakeholder Cybersecurity Risk Assessment for Data Protection

Topics: Risk Assessment; Personal Data Protection for Information Systems

Authors: Majid Mollaeefar ¹ , Alberto Siena ² and Silvio Ranise ²

Affiliations: ¹ Security and Trust, Fondazione Bruno Kessler, Trento, Italy, DIBRIS, University of Genova, Genova, Italy , ² Security and Trust, Fondazione Bruno Kessler, Trento, Italy

Digital Object Identifier: 10.5220/0009822703490356

Proceedings of SECRYPT 2020, ISBN: 978-989-758-446-6

Quick Abstract

To ensure the effectiveness of the adopted security measures and minimize the impact of security issues on the rights and freedom of individuals, the General Data Protection Regulation (GDPR) requires to carry out a Data Processing Impact Assessment (DPIA). Such an assessment differs from traditional risk analyses in which the actor carrying out the evaluation is also the one interested in reducing its risk. Conflicts may thus arise between the need of protecting data subjects rights and organizations that shall provide adequate security measures while struggling with various types of constraints (e.g., budget). To alleviate this problem, we introduce the Multi-Stakeholder Risk Trade-off Analysis Problem, (MSRToAP) and propose an automated technique to solve their instances. We then show how this can help data controllers make more informed decisions about which security mechanisms allow for a better trade-off between their requirements and those of the data subjects. For concreteness, we illustrate the proposed on a simple yet realistic use case scenario.

Multi-view Data Capture using Edge-synchronised Mobiles

Topics: Entertainment Imaging Applications; Mobile Imaging; Mobile Vision

Authors: Matteo Bortolon , Paul Chippendale , Stefano Messelodi and Fabio Poiesi

Affiliation: Fondazione Bruno Kessler, Trento, Italy

Digital Object Identifier: 10.5220/0008971807300740

Proceedings of VISAPP 2020/VISIGRAPP, ISBN: 978-989-758-402-2

Quick Abstract

Multi-view data capture permits free-viewpoint video (FVV) content creation. To this end, several users must capture video streams, calibrated in both time and pose, framing the same object/scene, from different viewpoints. New-generation network architectures (e.g. 5G) promise lower latency and larger bandwidth connections supported by powerful edge computing, properties that seem ideal for reliable FVV capture. We have explored this possibility, aiming to remove the need for bespoke synchronisation hardware when capturing a scene from multiple viewpoints, making it possible through off-the-shelf mobiles. We propose a novel and scalable data capture architecture that exploits edge resources to synchronise and harvest frame captures. We have designed an edge computing unit that supervises the relaying of timing triggers to and from multiple mobiles, in addition to synchronising frame harvesting. We empirically show the benefits of our edge computing unit by analysing latencies and show the quality of 3D reconstruction outputs against an alternative and popular centralised solution based on Unity3D.

A Tool-assisted Methodology for the Data Protection Impact Assessment

Topics: Personal Data Protection for Information Systems; Data Protection; Privacy; Security and Privacy Policies

Authors: Salimeh Dashti ¹ and Silvio Ranise ²

Affiliations: ¹ Security and Trust-Fondazione Bruno Kessler, Trento, Italy, DIBRIS-University of Genoa, Genoa and Italy , ² Security and Trust-Fondazione Bruno Kessler, Trento and Italy

Digital Object Identifier: 10.5220/0007932202760283

Proceedings of SECRYPT 2019, ISBN: 978-989-758-378-0

Quick Abstract

We propose a pragmatic methodology to the Data Protection Impact Assessment (DPIA) based on a tool capable of assisting users during crucial activities such as data processing specification and risk analysis. Previous work on compliance checking and our experience in developing a DPIA methodology for the Public Administration of the province of Trento in Italy are the basis of this work.

Related Ontology Subjects/Areas/Topics (6)

Data and Application Security and Privacy		Information and Systems Security		Privacy
Data Protection		Personal Data Protection for Information Systems		Security and Privacy Policies

A Wizard-based Approach for Secure Code Generation of Single Sign-On and Access Delegation Solutions for Mobile Native Apps

Topics: Identity Management; Security and Privacy in Mobile Systems; Security Protocols

Authors: Amir Sharif ¹ , Roberto Carbone ² , Silvio Ranise ² and Giada Sciarretta ²

Affiliations: ¹ Fondazione Bruno Kessler, Trento, Italy, DIBRIS- University of Genoa, Genoa and Italy , ² Fondazione Bruno Kessler, Trento and Italy

Digital Object Identifier: 10.5220/0007930502680275

Proceedings of SECRYPT 2019, ISBN: 978-989-758-378-0

Quick Abstract

Many available mobile applications (apps) have poorly implemented Single Sign-On and Access Delegation solutions leading to serious security issues. This could be caused by inexperienced developers who prioritize the implementation of core functionalities and/or misunderstand security critical parts. The situation is even worse in complex API scenarios where the app interacts with several providers. To address these problems, we propose a novel wizard-based approach that guides developers to integrate multiple third-party Identity Management (IdM) providers in their apps, by (i) “enforcing” the usage of best practices for native apps, (ii) avoiding the need to download several SDKs and understanding their online documentations (a list of known IdM providers with their configuration information is embedded within our approach), and (iii) automatically generating the code to enable the communication with the different IdM providers. The effectiveness of the proposed approach has been assessed by implementing an Android Studio plugin and using it to integrate several IdM providers, such as OKTA, Auth0, Microsoft, and Google.

Related Ontology Subjects/Areas/Topics (5)

Data and Application Security and Privacy		Information and Systems Security		Security Protocols
Identity Management		Security and Privacy in Mobile Systems

Topic(s):

Title:
ISBN:
Year:
Acronym:
Subject:

Title:
Author:
Affiliation:
Subject:

Name:
Affiliation:
Country:
Conference:
Subject:

Name:
Country:
Subject:

Affiliation

Filter listed results, by