ResearchMy research interest is in security and privacy for wireless resource-constrained mobile devices (WSNs, RFIDs, and smartphones); computer system security; computer forensics; access control; distributed and networked systems.
- European Commission, FP7-PEOPLE, Marie Curie Fellowship - PRISM-CODE: Privacy and Security for Mobile Cooperative Devices, 2012-2016 (Principal Investigator)
- European Commission, H2020-ICT30-2015 (Internet of Things and Platforms for Connected Smart Objects), TagItSmart! - Smart Tags driven service platform for enabling ecosystems of connected objects, 2016-2018 (Local Principal Investigator)
- European Commission, EU-India Research and Innovation Partnership, REACH - Rural broadband internEt Access using Cooperative mesh networking in witHe spectrum, 2014-2017 (Local Principal Investigator)
European Commission, ICT COST Action IC1403, Cryptanalysis of ubiquitous computing systems (CRYPTACUS), 2014-2018 (Participant)
Italian Ministry of Research, PRIN, TENACE: Protecting National Critical Infrastructures From Cyber Threats, 2013-2016 (Participant)
Intel, Scalable IoT Management and Key security aspects in 5G systems, 2016-2017 (Principal Investigator)
- University of Padua, University Project (Junior Grant 2015), Content Centric Networking: Security and Privacy Issues, 2016-2018 (Principal Investigator)
- University of Padua, University Project (Junior Grant 2014), Physical-Layer Security for Wireless Communication, 2016-2018 (Principal Investigator)
- University of Padua, University Project (PRAT 2013), Tackling Mobile Malware with Innovative Machine Learning Techniques, 2014-2016 (Principal Investigator)
- University of Padua, University Project (PRAT 2015), EDU4SEC: Effective Education for Improving Data Security Awareness, 2016-2018 (Collaborator)
- German DAAD - Mobile Security, 2013 (Principal Investigator)
- Italian-French University, Galileo Programme, Secure Distributed Protocols in Wireless Environments, 2014 (Italian Principal Investigator)
- University of Padua, University Project, Accessibility and Inclusion through Web Squared Technology, 2011-2012 (Participant)
- University of Trento, Italy - SIMPAT Project, 2011 (Participant)
- STW/Sentinels - S-MOBILE: Security of Software ad Services for Mobile Systems, 2007-2011
- US Department of the Air Force - Advanced Cyber Attack Modeling, Analysis, and Visualization, 2008 (Participant)
- Italian Ministry of Research, FIRB - WEB MINDS: Wide-scalE Broadband Middleware for Network Distributed Services, 2002-2006 (Participant)
Some Research Topics
Smartphones Security, Privacy, and Forensics. In the world, there is an average of almost one mobile telephone per human being
(one for each inhabitant in developed countries, one for every two inhabitants in developing countries).
Computational capabilities of mobile devices have increased significantly,
and they are commonly used as personal device to store private data.
However, their specific characteristics
(user mobility, storage of personal information, communication features, among others)
make the security and privacy of these devices particularly exposed.
Our contribution in this field has been the proposal of CRePE, a Context-Related Policy Enforcing for Android [C16], a new biometric mechanism to transparently authenticate the user [C19], and MOSES, a MOdes-of-use SEparation for Smartphones [C23, C25].
More info on CRePE (including the source code and a demo video) can be found HERE.
More info on MOSES (including the source code and a demo video) can be found HERE.
Future Internet Security and Privacy.
The Internet is an amazing success story, connecting hundreds of millions of users. However, in the last decade, there has been a growing realization that the current Internet Protocol is reaching the limits of its senescence. In fact, the way people access and utilize it has changed radically since the 1970-s when its architecture was conceived. This has prompted several research efforts that aim to design potential next-generation Internet architectures. In particular, Content-Centric Networking (CCN) is an emerging networking paradigm being considered as a possible replacement for the current IP-based host-centric Internet infrastructure. CCN focuses on content distribution, which is arguably not well served by IP.
We strongly suggest to see the videos by Van Jacobson for an understanding of this novel paradigma.
Named-Data Networking (NDN) is an example of CCN. NDN is also an active research project under the NSF Future Internet Architectures (FIA) program. FIA emphasizes security and privacy from the outset and by design. To be a viable Internet architecture, NDN must be resilient against current and emerging threats. We contributed to the mitigation of several possible security threats in NDN such as Interest Flooding Attacks, Cache poisoning, and Privacy Threats.
Privacy in Social Networks.
Social Networking Sites (SNSs) are Internet-based applications that allow
for user-generated content to be published and accessed easily by a global audience.
Some of the SNSs are the most visited sites on the Internet.
The number of users of Facebook surpassed the population of all the European Union.
While SNSs offer many functionalities, they might expose private users' data for several reasons:
carelessness of users in privacy setting; potential malicious SNS; SNS being subject of attack;
inference (of private attributes) by joining public data in different SNSs.
To mitigate this privacy issues, we introduced the concept of Virtual Private Social Network [C19]. We also implemented this concept in Facebook: FaceVPSN. More info (including our Firefox add-on, and a demo video) can be found HERE.
Wireless Sensor Networks (WSNs) Security and Privacy.
WSNs are networks made of thousands of very tiny nodes (also called "smart dust") with sensing capabilities.
Applications of these networks can be found both in militar and civil contexts (e.g. environmental monitoring).
Due to their strict constraints (e.g. limited battery, computation, and communication)
the design of secure and privacy-preserving WSNs is very challenging.
For example, nodes are usually non tamper proof
and they cannot widely use public key encryption.
We proposed several fundamental protocols for privacy and security in WSNs: secure key establishment [J1]; node replica detection [C4, J7]; node capture detection [C6]; secure data aggregation [C7]; privacy in data aggregation [J3]; privacy of events [C20].
RFID Security and Privacy.
Radio Frequency IDentification (RFID) technologies
is spreading. For instance, in good's logistics
it overcomes the bar-code technology by introducing
more features, such as the ability to remotely query
the good's tag identifier. The typical RFID architecture
can be shortly summarized: a beckoned server
stores a database associating many information to various tags IDs;
a wireless reader can query the tags and
forward the reply to the server; when queried, the tag replies with its own ID.
Current RFID system expose user's privacy: a user
can be traced by tracing the RFID tags she carries with her
(e.g. the RFID tag hidden in modern passports).
We proposed mechanism to protect the privacy of users in RFID systems [J5].
Privacy in Location Based Services.
Location Based Services (LBSs) can be defined as services that add value to a
user integrating his mobile device's location with additional information.
Gartner identified LBSs among the
most promising consumer mobile services.
However, the over exposure of private information
(e.g. see this news article)
can hinder the diffusion of these services.
In this field, we identified significant problems in current proposal for protecting user privacy. In particular, we proved that in several practical scenarios current solutions do not actually provide to the user the "promised" level of privacy [C17].