Smart cities are increasingly relying on information and communication technologies to cope with today's challenges, including increasing population, heterogeneous economic growth, and environmental legislation hardening. The use of Unmanned Aerial Vehicles (UAVs) generates a growing interest in coping with such challenges, along with new business opportunities. As a result, it is expected to see the number of drone-based applications to rise at a very fast pace, entailing new cybersecurity risks to emerge. In this paper, we propose to tackle the problem of secure communication among untrusting parties with a certificateless-group authenticated key agreement (CL-GAKA) scheme. The intent is to enable confidentiality, message integrity, and authenticity in UAV-to-UAV communication. Provisioning untrusted UAV networks with trusted communication will provide ground for further research and applications, such as collaborative cybersecurity deterrence, network extension using trusted relay nodes, collaborative mission exercise in time-critical applications, or anonymous communication for user privacy. Moreover, in order to fill the gap of technology awareness, we provide an implementation and demonstrate that the generation of a session key between two users can be performed in approximately 600ms on a Raspberry Pi 3 Model B+ system-on-chip (1.4GHz Cortex-A53). Finally, the protocol is formally evaluated with the Scyther tool.

Interconnected everyday objects, either via public or private networks, are gradually becoming reality in modern life - often referred to as the Internet of Things (IoT) or Cyber-Physical Systems (CPS). One stand-out example are those systems based on Unmanned Aerial Vehicles (UAVs). Fleets of such vehicles (drones) are prophesied to assume multiple roles from mundane to high-sensitive applications, such as prompt pizza or shopping deliveries to the home, or to deployment on battlefields for battlefield and combat missions. Drones, which we refer to as UAVs in this paper, can operate either individually (solo missions) or as part of a fleet (group missions), with and without constant connection with a base station. The base station acts as the command centre to manage the drones' activities; however, an independent, localised and effective fleet control is necessary, potentially based on swarm intelligence, for several reasons: 1) an increase in the number of drone fleets; 2) fleet size might reach tens of UAVs; 3) making time-critical decisions by such fleets in the wild; 4) potential communication congestion and latency; and 5) in some cases, working in challenging terrains that hinders or mandates limited communication with a control centre, e.g. operations spanning long period of times or military usage of fleets in enemy territory. This self-aware, mission-focused and independent fleet of drones may utilise swarm intelligence for a), air-traffic or flight control management, b) obstacle avoidance, c) self-preservation (while maintaining the mission criteria), d) autonomous collaboration with other fleets in the wild, and e) assuring the security, privacy and safety of physical (drones itself) and virtual (data, software) assets. In this paper, we investigate the challenges faced by fleet of drones and propose a potential course of action on how to overcome them.

Digital forensics is becoming an important feature for many embedded devices. In automotive systems, digital forensics involves multiple electronic control units (ECUs) used to support the connected and intelligent vehicle's technology. Digital evidence from these ECUs can be used in forensics investigation and analysis. Such a mechanism can potentially facilitate crash investigation, insurance claims and crime investigation. Issues related to forensics include the authenticity, integrity and privacy of the data. In this paper, the security of the forensic process and data in automotive systems is analysed. We propose an efficient, secure, privacy-preserving and reliable mechanism to provide a forensics data collection and storage process. A diagnostic application for smart phones, DiaLOG, is incorporated in the proposed process that uses a secure protocol to communicate the collected forensic data to a secure cloud storage. The proposed protocol for communicating forensic data is implemented to measure performance results and formally analysed using Scyther and CasperFDR with no known attack found.

At a time when society is in constant transition to keep up with technological advancement, we are seeing traditional paradigms being increasingly challenged. The fundamentals of governance are one such paradigm. As society's values have shifted, so have expectations of government shifted from the traditional model to something commonly referred to as `open governance'. Though a disputed term, we take open governance to mean a concept, which encourages and facilitates openness, accountability, and responsiveness to citizens. For the success of open governance initiatives, there are some technologies, such as the internet, that are crucial. These technologies enable access to both the data and to engagement activities between citizens and government. There are also other technologies, like blockchain and smart contacts, which could be utilised to assist open governance. A sound starting point would be moving from a system where information is tediously released by a government, on an `as they please' basis, to an infrastructure where critical actions are captured with strong integrity, non-repudiation and evidential guarantees. With an added dimension that facilitates these actions record be accessible to public scrutiny in near real-time. One candidate technology for capturing such actions is blockchain. Initially, blockchains were mainly used to facilitate cryptocurrencies as a record of transactions. The notable example being bitcoin. However, in recent years, blockchains utility is being recognised through smart contracts - potentially a vital building block to realising open and transparent government activities. In this paper, we employ the concept of smart contracts to government tendering activities. The proposed scheme is based on smart contracts, enabling a fair, transparent and independently verifiable (auditable) government tendering scheme. The scheme is then implemented on the Ethereum platform to evaluate the performance and financial cost implications, along with an evaluation of the potential security and auditability challenges.

This paper provides the first analysis on the feasibility of Return-Oriented programming (ROP) on RISC-V, a new instruction set architecture targeting embedded systems. We show the existence of a new class of gadgets, using several Linear Code Sequences And Jumps (LCSAJ), undetected by current Galileo-based ROP gadget searching tools. We argue that this class of gadgets is rich enough on RISC-V to mount complex ROP attacks, bypassing traditional mitigation like DEP, ASLR, stack canaries, G-Free and some compiler-based backward-edge CFI, by jumping over any guard inserted by a compiler to protect indirect jump instructions. We provide examples of such gadgets, as well as a proof-of-concept ROP chain, using C code injection to leverage a privilege escalation attack on two standard Linux operating systems. Additionally, we discuss some of the required mitigations to prevent such attacks and provide a new ROP gadget finder algorithm that handles this new class of gadgets.

Smart cards have been proliferated into many aspects of modern life. Historically, the ownership of smart cards has remained with the smart card issuers. Although this ownership model is favored by a wide range of industries and service providers, it does not provide optimum convenience and flexibility to cardholders. One potential solution could be to shift the control of smart cards from the smart card issuers to the smart card users. In this paper, we will analyze the feasibility of an ownership model that delegates the ownership of a smart card to its user. The operational and security requirements of the proposed ownership model will be provided. In addition, principal research questions are identified that would merit further in-depth analysis to test the viability of this ownership model.