Single-Sign-On (SSO) protocols enable companies to establish a federated environment in which clients sign in the system once and yet are able to access to services offered by different companies. The OASIS Security Assertion Markup Language (SAML) 2.0 Web Browser SSO Profile is the emerging standard in this context. In this paper we provide formal models of the protocol corresponding to one of the most applied use case scenario (the SP-Initiated SSO with Redirect/POST Bindings) and of a variant of the protocol implemented by Google and currently in use by Google's customers (the SAML-based SSO for Google Applications). We have mechanically analysed these formal models with SATMC, a state-of-the-art model checker for security protocols. SATMC has revealed a severe security flaw in the protocol used by Google that allows a dishonest service provider to impersonate a user at another service provider. We have also reproduced this attack in an actual deployment of the SAML-based SSO for Google Applications. This security flaw of the SAML-based SSO for Google Applications was previously unknown.

The instructional design of meaningful experimental activities completely integrated into on- line Engineering courses is still a significant challenge, by following the sustainable development goal of the United Nations for quality education, the SDG number 4. Remote and virtual laboratories can be a solution to improve this design in distance methodology. This fact has been more noticeable during the COVID-19 pandemic and its consequences with respect to education. Its transparent integration into the learning process and the inclusion of learning analytic features are essential features of these kinds of technologies. Without them, lecturers cannot track the performance and the satisfaction of their students. Our LoT@UNED (Laboratory-of-Things@UNED) platform has been implemented to include all these educational features for IoT environments, ranging from edge to cloud computing. Taking the advantages of the IoT paradigm, this platform involves acquiring practical competences within IoT and edge-cloud programming topics, among others. Furthermore, its flexibility allows us to host other areas, such as cybersecurity. Specifically, our platform incorporates a set of sustainable capabilities (scalability, availability, and security), so contributing to the SDG 4 challenge with a low-complex and efficient solution for quality distance education. To analyze the impact of our proposed solution, this work also focuses on studying the influence among several acceptance UTAUT/TAM factors during the students’ learning and teaching process. To achieve this goal, both exploratory and confirmatory analyses have been conducted. The reliability and validity of data are also analyzed. An improved structural equation model has also been studied, satisfying several statistical indicators according to the recommended thresholds in the current literature. The usefulness of our platform, easing the users’ attitude and having a high availability of resources affect positively the intention of use our IoT cloud solution and, as a consequence, the great quality of the education process.

The employment of modern technologies is widespread in our society, so the inclusion of practical activities for education has become essential and useful at the same time. These activities are more noticeable in Engineering, in areas such as cybersecurity, data science, artificial intelligence, etc. Additionally, these activities acquire even more relevance with a distance education methodology, as our case is. The inclusion of these practical activities has clear advantages, such as (1) promoting critical thinking and (2) improving students’ abilities and skills for their professional careers. There are several options, such as the use of remote and virtual laboratories, virtual reality and game-based platforms, among others. This work addresses the development of a new cloud game-based educational platform, which defines a modular and flexible architecture (using light containers). This architecture provides interactive and monitoring services and data storage in a transparent way. The platform uses gamification to integrate the game as part of the instructional process. The CyberScratch project is a particular implementation of this architecture focused on cybersecurity game-based activities. The data privacy management is a critical issue for these kinds of platforms, so the architecture is designed with this feature integrated in the platform components. To achieve this goal, we first focus on all the privacy aspects for the data generated by our cloud game-based platform, by considering the European legal context for data privacy following GDPR and ISO/IEC TR 20748-1:2016 recommendations for Learning Analytics (LA). Our second objective is to provide implementation guidelines for efficient data privacy management for our cloud game-based educative platform. All these contributions are not found in current related works. The CyberScratch project, which was approved by UNED for the year 2020, considers using the xAPI standard for data handling and services for the game editor, game engine and game monitor modules of CyberScratch. Therefore, apart from considering GDPR privacy and LA recommendations, our cloud game-based architecture covers all phases from game creation to the final users’ interactions with the game.

Presently, the ever-increasing use of new technologies helps people to acquire additional skills for developing an applied critical thinking in many contexts of our society. When it comes to education, and more particularly in any Engineering subject, practical learning scenarios are key to achieve a set of competencies and applied skills. In our particular case, the cybersecurity topic with a distance education methodology is considered and a new remote virtual laboratory based on containers will be presented and evaluated in this work. The laboratory is based on the Linux Docker virtualization technology, which allows us to create consistent realistic scenarios with lower configuration requirements for the students. The laboratory is comparatively evaluated with our previous environment, LoT@UNED, from both the points of view of the students’ acceptance with a set of UTAUT models, and their behavior regarding evaluation items, time distribution, and content resources. All data was obtained from students’ surveys and platform registers. The main conclusion of this work is that the proposed laboratory obtains a very high acceptance from the students, in terms of several different indicators (perceived usefulness, estimated effort, social influence, attitude, ease of access, and intention of use). Neither the use of the virtual platform nor the distance methodology employed affect the intention to use the technology proposed in this work.

The digital revolution is renewing many aspects of our lives, which is also a challenge in judicial processes, such as the Chain-of-Custody (CoC) process of any electronic evidence. A CoC management system must be designed to guarantee them to maintain its integrity in court. This issue is essential for digital evidence’s admissibility and probative value. This work has built and validated a real prototype to manage the CoC process of any digital evidence. Our technological solution follows a process model that separates the evidence registry and any evidence itself for scalability purposes. It includes the development of an open-source smart contract under Quorum, a version of Ethereum oriented to private business environments. The significant findings of our analysis have been: (1) Blockchain networks can become a solution, where integrity, privacy and traceability must be guaranteed between untrustworthy parties; and (2) the necessity of promoting the standardization of CoC smart contracts with a secure, simple process logic. Consequently, these contracts should be deployed in consortium environments, where reliable, independent third parties validate the transactions without having to know their content.