IoT developers face a very fragmented landscape made of very different devices, from bare metal devices with few KB of RAM and limited or no security protection to devices equipped with powerful support for AI and with built-in hardware (HW) to implement Root of Trust (RoT) and Trusted Execution Environments (TEE). Such different devices coexist, and it is an open challenge to guarantee an acceptable level of security across the whole system to avoid “easy” entry points for attackers. The complexity is further exacerbated by the existence of many HW platforms, general purpose but also domain specific, each implementing proprietary instances of RoT and TEE that prevent or make it very difficult for applications and security services to interoperate. CROSSCON aims at addressing all these issues by designing a new open, flexible, highly portable and vendor independent IoT security stack that can run across a variety of different edge devices and multiple HW platforms to offer a consistent security baseline across an entire IoT system. A high-level assurance is guaranteed by the formal verification of the stack specifications. CROSSCON stack offers a unified set of trusted APIs to the layers above. It is modular and among all the security features it offers is possible to configure only the ones needed depending on the underlined HW and firmware. It leverages the security features already implemented in the layers below. In case such security features are missing, like in bare metal devices, the stack offers an entire TEE implementation suitable for such devices. As devices are getting more powerful and use cases more complex, there is the need to add new trusted services as building blocks to implement security at the higher levels, such as protection of the models given in input to ML engines embedded in HW or support for biometrics and template protections. CROSSCON provides the open specifications of the stack along with an open-source reference implementation.

Artificial intelligence (AI) has lately proved to be a coin with two sides. On the one hand, it can be leveraged as a powerful defensive mechanism to improve system preparedness and response against cyber incidents and attacks, and on the other hand, it can be a formidable weapon attackers can use to damage, compromise or manipulate systems. AI4CYBER ambitions to provide an Ecosystem Framework of next-generation trustworthy cybersecurity services that leverage AI and Big Data technologies to support system developers and operators in effectively managing robustness, resilience, and dynamic response against advanced and AI-powered cyberattacks. The project will deliver a new breed of AI-driven software robustness and security testing services that significantly facilitates the testing experts work, through smarter flaw identification and code fixing automation. Moreover, the project will provide cybersecurity services for comprehension, detection and analysis of AI-powered attacks to prepare the critical systems to be resilient against them. Incident response support by AI4CYBER will offload security operators from complex and tedious tasks offering them mechanisms to optimize the orchestration of the most appropriate combination of security protections, and continuously learn from system status and defences’ efficiency. The AI4CYBER framework will ensure fundamental rights and values-based AI technology in its services, through the integration of demonstrable explainability, fairness and technology robustness (security) capabilities in the AI4CYBER components. The ecosystem will be validated in three scenarios: i) Detection and Mitigation of AI-powered Attacks against the Energy Sector, ii) Robustness and autonomous adaptation of Banking applications to face AI-powered attacks and iii) Resilient hospital services against advanced and AI-powered cyber-physical attacks.