SPIRS addresses innovative approaches to provide security and data-privacy to future Information and Communications Technology (ICT) elements.

SPIRS encompasses the complete design of a platform, so-called SPIRS platform, which integrates a hardware dedicated Root of Trust (RoT) and a processor core with the capability of offering a full suite of security services. Furthermore, the SPIRS platform will be able to leverage this capability to support privacy-respectful attestation mechanisms and enable trusted communication channels across 5G infrastructures and the respective management domains.

Among the different tasks in SPIRS, GiCP has been involved in:

  • Design of a Privacy Enhancing Technologies (PET) Toolbox
  • Deployment of blockchain protocols to bear privacy respectful trails for identifying security and monitor performance
  • Trusted Network Edge Device (TNED) software design
  • Secure TNED lifecycle
  • Use cases specification and validation plan
  • Off-chain governance schemes and validation of privacy respectful protocols
  • SPIRS ethics requirements: Data Management Plan

Design of a PET Toolbox

GiCP conducted a preliminary Data Protection Impact Assessment (DPIA) in the context of the SPIRS project. The project doesn’t engage in data processing activities that automatically trigger a DPIA under the GDPR, such as large-scale processing of personal data or activities like systematic monitoring. Although a full DPIA is not required, data protection is a must in SPIRS and GiCP have contributed to the implementation of a governance scheme designed to enforce the principle of least privilege and manage identity without traceability or linkability. To further protect privacy in 5G and IoT networks, SPIRS utilises a PET toolbox, which employs syntactic and semantic measures for privacy protection, in conjunction with its Trusted Execution Environment (TEE) and the governance scheme to enhance security and comply with GDPR requirements. In the SPIRS plataform, these elements work together to achieve transparency and traceability, define roles and responsibilities, implement user control measures for data protection, enforce data minimisation, and establish secure data exchange channels based on zero-trust models.

The PET toolbox developed by GiCP consisted of an implementation of the Mondrian algorithm for privacy protection using k-anonymity, and a Group Signature software library.

In SPIRS, GiCP researchers have been actively involved in designing, implementing, and applying group signatures to practical scenarios where privacy and security are paramount. GiCP has been focused on creating usable privacy-enhancing tools based on group signatures, emphasizing a “utility, privacy, and then utility again” paradigm. In specific, GiCP has improved the former version of libgroupsig by IBM. The first version was released in 2015, and the library has continued to evolve through projects with IBM and the H2020 SPIRS project.

Libgroupsig is a software library written in C that implements various group signature schemes. It is designed to be usable and easy to deploy by cryptographic engineers and others involved in implementing secure and privacy-respectful communication protocols. The library aims to bridge the gap between the theory of group signatures and their practical application by providing concrete tools for building systems that balance security, privacy, anonymity, and accountability.

Libgroupsig key features and functionality:

  • Provides a Well-Defined Programming Interface: The library offers a standard set of functions for interacting with group signature schemes, abstracting away the complexities of the underlying cryptography. This makes it easier for developers to integrate group signatures into their applications without needing deep cryptographic expertise.
  • Supports a Variety of Group Signature Schemes: libgroupsig implements multiple group signature schemes: DL21, DL21SEQ (Diaz & Lehmann, 2021), KLAP20 (Kim et al., 2021), GL19 (Garms & Lehmann, 2019), PS16 (Pointcheval & Sanders, 2016), BBS04 (Boneh & Boyen, 2004), CPY06 (Choi et al., 2006), KTY04 (Kiayias et al., 2004).
  • Implements Core Group Signature Operations: The library provides functions for all the fundamental operations of group signatures, including:
    • Setup: Generating group and manager keys.
    • Join: Adding new members to a group.
    • Sign: Issuing group signatures.
    • Verify: Verifying the validity of group signatures.
    • Open: Revealing the identity of the signer of a group signature.
    • Claim: Proving ownership of a group signature.
    • Trace: Checking if a signature was issued by a revoked member.
    • Prove Equality: Demonstrating that a set of signatures were issued by the same signer.
  • Offers Flexibility in Privacy Trade-offs: The library enables developers to choose group signature schemes with different privacy properties, such as anonymity and unlinkability, to meet the specific needs of their applications.
  • Facilitates Integration with Existing Systems: libgroupsig can be used in conjunction with technologies like X.509 certificates and blockchain protocols to implement privacy-respectful identity management solutions that are compatible with existing infrastructure.

Deployment of blockchain protocols to bear privacy respectful trails for identifying security and monitor performance

In SPIRS, GiCP have adapted some previous works of the group as

Evidence Gathering in Smart Grids: Developed a semi-automated evidence collection protocol using:

  • Autoauditor for monitoring activities: https://gitlab.gast.it.uc3m.es/scm/autoauditor.
  • Hyperledger Fabric for public key infrastructure (PKI) management and evidences storage.
  • libgroupsig for handling anonymous identity management.

to implement a series of proof-of-concept to showcase the potential of blockchain in privacy-respectful audit trails:

  1. Anonymous Reporting Protocol: Designed and implemented a protocol for anonymous whistleblowing that integrates:
    • libgroupsig for identity management.
    • Hyperledger Fabric for public key infrastructure (PKI) management and securely store reports on the blockchain. In the reports, a digital envelope scheme is adopted so only authorized recipients can decrypt and access the contents, ensuring confidentiality and privacy.
  2. IoT Firmware Update Verification: Developed a proof-of-concept protocol to verify firmware updates in IoT devices. The protocol employs group signatures for
    • Signature verification.
    • Revocation in cases of anomalous device behavior.
  3. Privacy-respectful recommendation systems for car sharing: stakeholder engagement activity
    • libgroupsig for identity management.
    • Hyperledger BESU to gather all the audit information

Secure TNED lifecycle

GiCP has carried out the following activities associated to the design and implementation of SPIRS TNED component:

  1. Integration of libgroupsig and Mondrian into the TEE: https://gitlab.gicp.es/spirs/tee-integration
    • Customized code was developed for seamless use of libgroupsig within the Trusted Execution Environment (TEE). This included implementing specific applications tailored to the TEE environment.
  2. API Development: An API was created to support key functionalities (https://app.swaggerhub.com/apis/schica/groupsig/1.0.0)
    • Anonymous Group Registration: Simplifying enrollment in anonymous groups.
    • Tracing and Revocation: Enabling these features in schemes that support them.
    • Signature Verification: Allowing group managers to verify digital signatures efficiently.
  3. Python Client Development: Python clients were built to interact with the API, enabling users to utilize its capabilities effortlessly. Additionally, a library mode was implemented for direct integration, streamlining application development.
  4. Docker Containerization: Docker containers were prepared for:
    • Automating the deployment of the TEE.
    • Compiling necessary libraries and modules for libgroupsig and Mondrian.
    • Simplifying client deployment by automating dependency installation for each use case.