Privacy and Security

USI – Privacy and Security

Partners:
USI		 Role in MYRTUS:
Privacy and security functionalities for applications running across the continuum

Description

The privacy and security framework of the MYRTUS Reference Infrastructure provides the mechanisms to secure data and transactions between computing nodes and to authenticate components. It does not impose a single security configuration: it offers a common set of functionalities and security levels, with interchangeable implementations.

Each application states the sensitivity and integrity of the data it handles, which determines the functionality and level it needs. The implementation used on each node then depends on what the node can provide and on its execution time and energy.

Security functionalities and levels

Four functionalities are available, each at three security levels: from lightweight algorithms for constrained nodes, where throughput and energy matter most, to post-quantum algorithms for data that must stay protected over a long time.

Functionality Highpost-quantum secure Mediumbalanced Lowlightweight
EncryptionAES-256AES-128ASCON-128
AuthenticationCRYSTALS-Dilithium, FALCON, SPHINCS+DSA, RSA, ECDSALightweight schemes, e.g. ECDSA
Key exchangeCRYSTALS-Kyber (ML-KEM)RSALightweight schemes
HashingSHA-512SHA-256ASCON-Hash

Examples of primitives for each level. The level of a primitive is not fixed: it can be revised if the primitive is no longer considered secure, and new quantum-resistant primitives can be added to the catalogue.

Privacy and Security Docker

As for any software in the MYRTUS continuum, the primitives are packaged in a container, the P&S Docker, attached to the nodes as a sidecar. It can be added to an existing application in a Kubernetes cluster and hides the cryptographic details, so the infrastructure calls a security functionality without depending on a specific implementation. Several implementations of the same primitive are characterised by execution time and energy, so the most suitable one can be chosen for each node.

Native P&S Docker

Built from primitive source code provided by the designer, profiled on the node and called explicitly by the application.

Transparent P&S Docker

Includes a catalogue of established open-source cryptographic libraries and adds security to existing components by intercepting their connections, without modifying them.

Beyond security, the P&S Docker also offers homomorphic encryption as a privacy functionality, which lets applications compute on encrypted data. A model developed in MYRTUS predicts the execution time and energy of a homomorphic encryption program, to choose the most suitable back-end and configuration without running the program on each of them.

Across the MYRTUS pillars

The infrastructure provides the catalogue of primitives; the other two pillars decide which ones are used and where.

Design timeDPESelects the functionality, level and primitive for each software component, from the sensitivity of its data and the characteristics of the target node.
DeploymentMIRTO · P&S ManagerRecommends the nodes able to provide the required functionality, preferring trusted nodes.
RuntimeMIRTO · P&S ManagerCan ask the P&S Docker to switch primitive when requirements or conditions change, without moving the workload.

References

  • S. Thakur, S. Banik, F. Regazzoni, “Energy Analysis of Cryptographic Algorithms in Server Environment”, in Proc. 2024 Cloud Computing Security Workshop (CCSW), 2024.
  • S. Banik, F. Regazzoni, “Efficient Time Share Masking of AES”, in Security, Privacy, and Applied Cryptography Engineering (SPACE 2025), LNCS 16406, Springer, 2025. Zenodo
Competenze

Postato il

10 Novembre 2026