Secure Information Access in Distributed Systems

Future networks require new security concepts in order to meet the citizen’s demand for ubiquitous, secure and trusted communication and information access.

This research field deals with specific problems related to secure information access in distributed service architectures on different levels, such as those employed in the context of complex business and communication processes. New security policies must be adequate for protecting infrastructures and business processes across borders and administrative domains that involve dozens of different stakeholders, each conforming to disparate legislation and/or having their own security policies.

Therefore we develop:

  • Generic secure architectures and services for discovery, integration and assessment of information (e.g. sensor data) combining complex heterogeneous information sources to obtain new insights for politics and society.

  • Next generation security solutions that address the vulnerabilities and threats emerging in the future Internet in order to protect the end-users, their interactions and transactions, their privacy, their devices, content and data against any malicious behaviour.

Complex ICT systems need to be engineered with security “built in” from the beginning. A research focus within the ICT security program is to develop methodologies, techniques, and tools to facilitate secure and efficient system design and implementation. Research includes ICT security of currently operational as well as future systems. The developed methodologies leverage existing technologies such as cryptography and federated identity management as well as innovative approaches such as model-driven security for ensuring confidentiality, integrity, and availability of large-scale distributed systems (e.g., SOA-based Austrian eGovernment system or global geospatial information systems). 

A system is as secure as its weakest link. So security engineering tools have to make it easier for system engineers to adhere to security requirements in different stages of the software development lifecycle like design, implementation and testing. Research initiatives also include the development of “security by design” architectures and supporting tools for secure software development lifecycles.