The recent approval of the General Data Protection Regulation (GDPR) imposes new data protection requirements on data controllers and processors with respect to the processing of European Union (EU) residents' data. This requirements consist of a single set of rules that have binding legal status and should be enforced in all EU member states. In light of these requirements, we propose in this paper the use of a blockchain-based approach to support data accountability and provenance tracking. Our approach relies on the use of publicly auditable contracts deployed in a blockchain that increase the transparency with respect to the access and usage of data. We identify and discuss three different models for our approach with different granularity and scalability requirements where contracts can be used to encode data usage policies and provenance tracking information in a privacy-friendly way. From these three models we designed, implemented, and evaluated a model where contracts are deployed by data subjects for each data controller, and a model where subjects join contracts deployed by data controllers in case they accept the data handling conditions. Our implementations show in practice the feasibility and limitations of contracts for the purposes identified in this paper.JRC.E.3-Cyber and Digital Citizens' Securit

In recent years, several research studies have investigated the identification of electronic devices through their physical components and properties, both from a theoretical point of view and through extensive experimental studies. Results have shown that, in many cases, a very high identification accuracy can be obtained by exploiting imperfections and small differences in the electronic components, which are called fingerprints in this context. Part of these studies have focused on a specific category of electronic device, the mobile phone or smartphone, which is usually equipped with components, such as radio frequency frontends, cameras, micro-electro-mechanical systems, microphones, and speakers that are likely to reveal fingerprints in their digital outputs and then allow the identification of the component and of the mobile phone itself. Keeping the focus on mobile phones, this paper provides a survey of the different techniques for mobile phone identification on the basis of their built-in components. This paper describes the methodology, the classification algorithms, and the types of features that are typically used in literature. Outstanding challenges and research issues are also identified and described, together with an overview of the potential applications of mobile phone fingerprinting. In addition, this paper analyzes the potential privacy risks associated to the tracking of the mobile phone on the basis of its fingerprints and the related mitigation techniques. Finally, it summarizes the main issues and identifies research opportunities and potential future trends for mobile phone fingerprinting.

The control and protection of user data is a very important aspect in the design and deployment of the Internet of Things (IoT). The heterogeneity of IoT technologies, the large number of devices and systems, and the different types of users and roles create important challenges in this context. In particular, requirements of scalability, interoperability, trust and privacy are difficult to address even with the considerable amount of existing work both in the research and standardization community. In this paper we propose a Model-based Security Toolkit, which is integrated in a management framework for IoT devices, and supports specification and efficient evaluation of security policies to enable the protection of user data. Our framework is applied to a Smart City scenario in order to demonstrate its feasibility and performance.JRC.G.6-Digital Citizen Securit

According to the European Union data protection legislation, privacy is a fundamental right that should be protected in the interaction of the citizen with the digital world. In the evolution of Internet towards new paradigms like Internet of Things (IoT), protection of privacy can be a challenging task because IoT connected objects can generate an enormous amount of data, some of which actually constitute personal data. In addition, it is difficult to control the flow of data when there is no user interface or adequate tools for the user. In this paper we describe an efficient solution to enforcement security policy rules that addresses this challenge, and takes a more general enterprise architecture approach for security and privacy engineering in IoT. This enforcement solution is based on a Model-based Security Toolkit named SecKit, and its integration with the MQ Telemetry Transport (MQTT) protocol layer, which is a widely adopted technology to enable the communication between IoT devices. In this paper, we describe the motivation and design of our enforcement solution, demonstrating its feasibility and the performance results in a case study.

With the continuous development of distributed ledger and blockchain technologies, new use cases apart from cryptocurrencies have come into the spotlight. In this article, we evaluate whether an e-government service could be a suitable candidate for a blockchain transformation. We selected as a reference test system an existing cross-border e-government service that is used for supporting goods exchanges across the European Union. We show how such an indicative paradigm can be transformed into a blockchain system. In order to do so, we deployed it in an emulated architecture for evaluating its performance under various realistic conditions. Our results show that the deployed system is able to meet the requirements, both in terms of throughput and transaction speed. Moreover, it shows clear advantages in terms of usability and synchronization between all entities.