Jó Ueyama

Rodrigo Dutra Garcia, Gowri Sankar Ramachandran, Raja Jurdak et al.

Real-world applications in healthcare and supply chain domains produce, exchange, and share data in a multi-stakeholder environment. Data owners want to control their data and privacy in such settings. On the other hand, data consumers demand methods to understand when, how, and who produced the data. These requirements necessitate data governance frameworks that guarantee data provenance, privacy protection, and consent management. We introduce a decentralized data governance framework based on blockchain technology and proxy re-encryption to let data owners control and track their data through privacy-enhancing and consent management mechanisms. Besides, our framework allows the data consumers to understand data lineage through a blockchain-based provenance mechanism. We have used Digital e-prescription as the use case since it has multiple stakeholders and sensitive data while enabling the medical fraternity to manage patients' prescription data, involving patients as data owners, doctors and pharmacists as data consumers. Our proof-of-concept implementation and evaluation results based on CosmWasm, Ethereum, and pyUmbral PRE show that the proposed decentralized system guarantees transparency, privacy, and trust with minimal overhead.

Tiago V. Ortiz, Bruno Kimura, Jó Ueyama et al.

The software defined networking paradigm relies on the programmability of the network to automatically perform management and reconfiguration tasks. The result of adopting this programmability feature is twofold: first by designing new solutions and, second, by concurrently making room for the exploitation of new security threats. As a malfunction in the controller software may lead to a collapse of the network, assessing the security of solutions before their deployment, is a major concern in SDNs. In light of this, we have conducted a comprehensive review of the literature on the experimental security analysis of the control plane in SDNs, with an emphasis on vulnerabilities of the controller software. Additionally, we have introduced a taxonomy of the techniques found in the literature with regard to the experimental security analysis of SDN controller software. Furthermore, a comparative study has been carried out of existing experimental approaches considering the security requirements defined by the Open Network Foundation (ONF). As a result, we highlighted that there is a need for a standardization of the methodologies employed for automated security analysis, that can meet the appropriate requirements, and support the development of reliable and secure software for SDNs.