% 
% This file was created by the TYPO3 extension
% bib
% --- Timezone: CEST
% Creation date: 2023-09-28
% Creation time: 09-17-39
% --- Number of references
% 10
% 

@Inproceedings { 2023_lohmoeller_transparency,
   title = {Poster: Bridging Trust Gaps: Data Usage Transparency in Federated Data Ecosystems},
   year = {2023},
   month = {11},
   day = {27},
   keywords = {data usage control; data ecosystems; transparency logs},
   url = {https://www.comsys.rwth-aachen.de/fileadmin/papers/2023/2023-lohmoeller-transparency.pdf},
   publisher = {ACM},
   booktitle = {Proceedings of the 2023 ACM SIGSAC Conference on
Computer and Communications Security (CCS ’23), November 26-30, 2023, Copenhagen, Denmark},
   event_place = {Copenhagen, Denmark},
   event_date = {November 26-30, 2023},
   state = {accepted},
   ISBN = {979-8-4007-0050-7/23/11},
   DOI = {doi.org/10.1145/3576915.3624371},
   reviewed = {1},
   author = {Lohm{\"o}ller, Johannes and Vlad, Eduard and Dahlmanns, Markus and Wehrle, Klaus}
}

@Inproceedings { 2023_pennekamp_benchmarking_comparison,
   title = {Designing Secure and Privacy-Preserving Information Systems for Industry Benchmarking},
   year = {2023},
   month = {6},
   day = {15},
   pages = {489-505},
   abstract = {Benchmarking is an essential tool for industrial organizations to identify potentials that allows them to improve their competitive position through operational and strategic means. However, the handling of sensitive information, in terms of (i) internal company data and (ii) the underlying algorithm to compute the benchmark, demands strict (technical) confidentiality guarantees—an aspect that existing approaches fail to address adequately. Still, advances in private computing provide us with building blocks to reliably secure even complex computations and their inputs, as present in industry benchmarks. In this paper, we thus compare two promising and fundamentally different concepts (hardware- and software-based) to realize privacy-preserving benchmarks. Thereby, we provide detailed insights into the concept-specific benefits. Our evaluation of two real-world use cases from different industries underlines that realizing and deploying secure information systems for industry benchmarking is possible with today's building blocks from private computing.},
   note = {Lecture Notes in Computer Science (LNCS), Volume 13901},
   keywords = {real-world computing; trusted execution environments; homomorphic encryption; key performance indicators; benchmarking},
   tags = {internet-of-production},
   url = {https://jpennekamp.de/wp-content/papercite-data/pdf/plv+23.pdf},
   publisher = {Springer},
   booktitle = {Proceedings of the 35th International Conference on Advanced Information Systems Engineering (CAiSE '23), June 12-16, 2023, Zaragoza, Spain},
   event_place = {Zaragoza, Spain},
   event_name = {35th International Conference on Advanced Information Systems Engineering (CAiSE '23)},
   event_date = {June 12-16, 2023},
   ISBN = {978-3-031-34559-3},
   ISSN = {0302-9743},
   DOI = {10.1007/978-3-031-34560-9_29},
   reviewed = {1},
   author = {Pennekamp, Jan and Lohm{\"o}ller, Johannes and Vlad, Eduard and Loos, Joscha and Rodemann, Niklas and Sapel, Patrick and Fink, Ina Berenice and Schmitz, Seth and Hopmann, Christian and Jarke, Matthias and Schuh, G{\"u}nther and Wehrle, Klaus and Henze, Martin}
}

@Article { 2023-circres-wu-comp-ecosystem,
   title = {Use of Computation Ecosystems to Analyze the Kidney-Heart Crosstalk},
   journal = {Circulation research},
   year = {2023},
   month = {4},
   day = {14},
   volume = {132},
   number = {8},
   pages = {1084-1100},
   misc2 = {Online},
   language = {en},
   DOI = {10.1161/CIRCRESAHA.123.321765},
   reviewed = {1},
   author = {Wu, Zhuojun and Lohm{\"o}ller, Johannes and Kuhl, Christiane and Wehrle, Klaus and Jankowski, Joachim}
}

@Inproceedings { 2022_lohmoeller_sovereignty,
   title = {On the Need for Strong Sovereignty in Data Ecosystems},
   year = {2022},
   month = {9},
   day = {5},
   volume = {3306},
   pages = {51-63},
   abstract = {Data ecosystems are the foundation of emerging data-driven business models as they (i) enable an automated exchange between their participants and (ii) provide them with access to huge and heterogeneous data sources. However, the corresponding benefits come with unforeseen risks as also sensitive information is potentially exposed. Consequently, data security is of utmost importance and, thus, a central requirement for the successful implementation of these ecosystems. Current initiatives, such as IDS and GAIA-X, hence foster sovereign participation via a federated infrastructure where participants retain local control. However, these designs place significant trust in remote infrastructure by mostly implementing organizational security measures such as certification processes prior to admission of a participant. At the same time, due to the sensitive nature of involved data, participants are incentivized to bypass security measures to maximize their own benefit: In practice, this issue significantly weakens sovereignty guarantees. In this paper, we hence claim that data ecosystems must be extended with technical means to reestablish such guarantees. To underpin our position, we analyze promising building blocks and identify three core research directions toward stronger data sovereignty, namely trusted remote policy enforcement, verifiable data tracking, and integration of resource-constrained participants. We conclude that these directions are critical to securely implement data ecosystems in data-sensitive contexts.},
   tags = {internet-of-production},
   url = {https://www.comsys.rwth-aachen.de/fileadmin/papers/2022/2022-lohmoeller-deco.pdf},
   publisher = {CEUR Workshop Proceedings},
   booktitle = {Proceedings of the 1st International Workshop on Data Ecosystems (DEco '22), co-located with the 48th International Conference on Very Large Databases (VLDB '22), September 5-9, 2022, Sydney, Australia,},
   event_place = {Sydney, Australia},
   event_name = {International Workshop on Data Ecosystems (DEco '22)},
   event_date = {September 5, 2022},
   ISSN = {1613-0073},
   reviewed = {1},
   author = {Lohm{\"o}ller, Johannes and Pennekamp, Jan and Matzutt, Roman and Wehrle, Klaus}
}

@Inproceedings { 2022_dahlmanns_tlsiiot,
   title = {Missed Opportunities: Measuring the Untapped TLS Support in the Industrial Internet of Things},
   year = {2022},
   month = {5},
   day = {31},
   pages = {252-266},
   abstract = {The ongoing trend to move industrial appliances from previously isolated networks to the Internet requires fundamental changes in security to uphold secure and safe operation. Consequently, to ensure end-to-end secure communication and authentication, (i) traditional industrial protocols, e.g., Modbus, are retrofitted with TLS support, and (ii) modern protocols, e.g., MQTT, are directly designed to use TLS. To understand whether these changes indeed lead to secure Industrial Internet of Things deployments, i.e., using TLS-based protocols, which are configured according to security best practices, we perform an Internet-wide security assessment of ten industrial protocols covering the complete IPv4 address space.
Our results show that both, retrofitted existing protocols and newly developed secure alternatives, are barely noticeable in the wild. While we find that new protocols have a higher TLS adoption rate than traditional protocols (7.2 \% vs. 0.4 \%), the overall adoption of TLS is comparably low (6.5 \% of hosts). Thus, most industrial deployments (934,736 hosts) are insecurely connected to the Internet. Furthermore, we identify that 42 \% of hosts with TLS support (26,665 hosts) show security deficits, e.g., missing access control. Finally, we show that support in configuring systems securely, e.g., via configuration templates, is promising to strengthen security.},
   keywords = {industrial communication; network security; security configuration},
   tags = {internet-of-production},
   url = {https://www.comsys.rwth-aachen.de/fileadmin/papers/2022/2022-dahlmanns-asiaccs.pdf},
   publisher = {ACM},
   booktitle = {Proceedings of the 2022 ACM on Asia Conference on Computer and Communications Security (ASIACCS '22), May 30-June 3, 2022, Nagasaki, Japan},
   event_place = {Nagasaki, Japan},
   event_name = {ASIACCS '22},
   event_date = {May 30-June 3, 2022},
   ISBN = {978-1-4503-9140-5/22/05},
   DOI = {10.1145/3488932.3497762},
   reviewed = {1},
   author = {Dahlmanns, Markus and Lohm{\"o}ller, Johannes and Pennekamp, Jan and Bodenhausen, J{\"o}rn and Wehrle, Klaus and Henze, Martin}
}

@Inproceedings { 2021_mitseva_sequences,
   title = {POSTER: How Dangerous is My Click? Boosting Website Fingerprinting By Considering Sequences of Webpages},
   year = {2021},
   month = {11},
   day = {17},
   pages = {2411-2413},
   abstract = {Website fingerprinting (WFP) is a special case of traffic analysis, where a passive attacker infers information about the content of encrypted and anonymized connections by observing patterns of data flows. Although modern WFP attacks pose a serious threat to online privacy of users, including Tor users, they usually aim to detect single pages only. By ignoring the browsing behavior of users, the attacker excludes valuable information: users visit multiple pages of a single website consecutively, e.g., by following links. In this paper, we propose two novel methods that can take advantage of the consecutive visits of multiple pages to detect websites. We show that two up to three clicks within a site allow attackers to boost the accuracy by more than 20\% and to dramatically increase the threat to users' privacy. We argue that WFP defenses have to consider this new dimension of the attack surface.},
   keywords = {Traffic Analysis; Website Fingerprinting; Web Privacy},
   url = {https://www.comsys.rwth-aachen.de/fileadmin/papers/2021/2021-mitseva-fingerprinting-sequences.pdf},
   publisher = {ACM},
   booktitle = {Proceedings of the 28th ACM SIGSAC Conference on Computer and Communications Security (CCS '21), November 15-19, 2021, Seoul, Korea},
   event_place = {Seoul, Korea},
   event_date = {November 15-19, 2021},
   ISBN = {978-1-4503-8454-4/21/11},
   DOI = {10.1145/3460120.3485347},
   reviewed = {1},
   author = {Mitseva, Asya and Pennekamp, Jan and Lohm{\"o}ller, Johannes and Ziemann, Torsten and Hoerchner, Carl and Wehrle, Klaus and Panchenko, Andriy}
}

@Thesis { 2021_lohmoeller_industrial_tls,
   title = {An lnternet-Wide Study on TLS Usage in lndustrial Control Systems},
   year = {2021},
   month = {6},
   school = {RWTH Aachen University},
   type = {Master Thesis},
   author = {Lohm{\"o}ller, Johannes}
}

@Inproceedings { 2020-dahlmanns-imc-opcua,
   title = {Easing the Conscience with OPC UA: An Internet-Wide Study on Insecure Deployments},
   year = {2020},
   month = {10},
   day = {27},
   pages = {101-110},
   abstract = {Due to increasing digitalization, formerly isolated industrial networks, e.g., for factory and process automation, move closer and closer to the Internet, mandating secure communication. However, securely setting up OPC UA, the prime candidate for secure industrial communication, is challenging due to a large variety of insecure options. To study whether Internet-facing OPC UA appliances are configured securely, we actively scan the IPv4 address space for publicly reachable OPC UA systems and assess the security of their configurations. We observe problematic security configurations such as missing access control (on 24\% of hosts), disabled security functionality (24\%), or use of deprecated cryptographic primitives (25\%) on in total 92\% of the reachable deployments. Furthermore, we discover several hundred devices in multiple autonomous systems sharing the same security certificate, opening the door for impersonation attacks. Overall, in this paper, we highlight commonly found security misconfigurations and underline the importance of appropriate configuration for security-featuring protocols.},
   keywords = {industrial communication; network security; security configuration},
   tags = {internet-of-production},
   url = {https://www.comsys.rwth-aachen.de/fileadmin/papers/2020/2020-dahlmanns-imc-opcua.pdf},
   publisher = {ACM},
   booktitle = {Proceedings of the Internet Measurement Conference (IMC '20), October 27-29, 2020, Pittsburgh, PA, USA},
   event_place = {Pittsburgh, PA, USA},
   event_name = {ACM Internet Measurement Conference 2020},
   event_date = {October 27-29, 2020},
   ISBN = {978-1-4503-8138-3/20/10},
   DOI = {10.1145/3419394.3423666},
   reviewed = {1},
   author = {Dahlmanns, Markus and Lohm{\"o}ller, Johannes and Fink, Ina Berenice and Pennekamp, Jan and Wehrle, Klaus and Henze, Martin}
}

@Inproceedings { 2019_lohmoeller_fiware,
   title = {Application of the open-source cloud platform FIWARE for future building energy management systems},
   year = {2019},
   month = {11},
   publisher = {IOP Publishing},
   booktitle = {Journal of Physics: Conference Series 1343},
   event_place = {EPFL Lausanne},
   event_name = {CISBAT 2019},
   event_date = {4-6 September 2019},
   DOI = {10.1088/1742-6596/1343/1/012063},
   extern = {1},
   author = {Storek, Thomas and Lohm{\"o}ller, Johannes and K{\"u}mpel, Alexander and Baranski, Mark and M{\"u}ller, Dirk}
}

@Thesis { 2019_lohmoeller_fingerprinting,
   title = {Exploiting User Sessions for Website Fingerprinting},
   year = {2019},
   month = {3},
   school = {RWTH Aachen University},
   institute = {Communication and Distributed Systems},
   type = {Bachelor Thesis},
   author = {Lohm{\"o}ller, Johannes}
}