ERATOSTHENES
Secure management of IoT devices lifecycle through identities and distributed ledgers.
Providing core cybersecurity features to be adopted by IoT solution providers and manufacturers as baseline certification elements in the production of devices and throughout their entire lifecycle.
Vision.
To devise, implement and evaluate a novel distributed, automated, auditable, yet privacy-respectful, Trust and Identity Management Framework intended to dynamically and holistically manage the lifecycle of IoT devices, strengthening trust, identities, privacy and resilience in the entire IoT ecosystem, supporting the enforcement of the NIS directive, GDPR and Cybersecurity Act.
We have the ambition to channel the potential of AI towards the Europe’s sustainability goals by implementing an AI-ready data space. An AI-ready data space is a data management framework designed to support the use of AI techniques.
The challenge.
The widespread inclusion of IoT devices in all aspects of human life is bound to lead to a huge attack surface, as well as substantial security and privacy risks. Almost every day, the media reports cybersecurity attacks involving devices ranging from toys to medical equipment. The current research has identified a variety of difficulties centred on confidentiality, access control, privacy for users and objects, and the reliability or compliance of devices. ERATOSTHENES believes that user needs should drive IoT cybersecurity research.
Cyber-Threats
Privacy Risks
IoT Cybersecurity
Approach & solutions.
To address this challenge, ERATOSTHENES will develop, implement, and assess a novel distributed, automated, auditable, yet privacy-respecting Trust and Identity Management Framework designed to dynamically and holistically manage the lifecycle of IoT devices, thereby strengthening trust, identities, privacy, and resilience across the entire IoT ecosystem and assisting in the enforcement of the NIS directive, GDPR, and Cybersecurity Act.
The project will use a number of innovative solutions to achieve this:
- The first-ever encapsulation of cybersecurity features in IoT devices through the deployment of the Trust Agents.
- Decentralised identity management tools that balance self-sovereignty and privacy protection in a distributed and transparent trust model.
- Self-encryption/decryption at device-level with an automated recovery process.
- Threat-analysis models based on federated learning and edge execution to constantly track devices and detect attacks.
- Collaborative IoT threat intelligence sharing across ledgers to enhance detection and defense mechanism.
- Integration of Physical Unclonable Functions in trust framework and distributed ledgers.
Pilots
The technical innovations brought by ERATOSTHENES assessed in real-life scenarios.
Three pilots (Connected Vehicles, Smart Health, Disposal IDs in Industry 4.0) will be used to develop and validate ERATOSTHENES's readiness level by widely deploying it in real-world circumstances. The goal is to put it through its paces in realistic and diverse operational scenarios.
The project will support CSA and NIS directive enforcement with a security information sharing mechanism based on inter-ledger technologies to support the exchange of trust information and security information among stakeholders, enhancing collaboration, responsible vulnerability disclosure, and secure software updates.
Our role.
Apart from driving the project coordination, Inlecom Innovation also leads the Lifecycle Management, Inter-ledger Cyber-Threat Information Sharing, Smart Contracts and Recovery Solutions operations, as well as the commercialization and innovation activities including the IP management and the patent filling for the project. Inlecom is also responsible for developing the AI threat analysis models, the Use Case Methodological Framework and setting the Ethics Requirements.
This project has received funding from the Horizon Europe research and innovation programme under GA 101020416. Funded by the European Union. Views and opinions expressed are however those of the author(s) only and do not necessarily reflect those of the European Union or European Commission. Neither the European Union nor the granting authority can be held responsible for them.
