INDECT Advanced Security Requirements

This paper reviews the requirements for the security mechanisms that are currently being developed in the framework of the European research project INDECT. An overview of features for integrated technologies such as Virtual Private Networks (VPNs), Cryptographic Algorithms, Quantum Cryptography, Federated ID Management and Secure Mobile Ad-hoc networking are described together with their expected use in INDECT.

💡 Research Summary

The paper presents a comprehensive set of security requirements for the European research project INDECT (Integrated European Network for Detection and Counter‑Terrorism), which aims to build a large‑scale, real‑time urban surveillance and data‑analysis platform. The authors structure the discussion around five core technology domains—Virtual Private Networks (VPNs), cryptographic algorithms, quantum key distribution (QKD), federated identity management, and secure mobile ad‑hoc networking (MANET)—and describe how each must be adapted to meet the unique operational, privacy, and resilience demands of the project.

In the VPN section, the authors argue that traditional IPsec‑based tunnels are insufficient for the highly dynamic, multi‑tenant environment envisioned for INDECT. They propose a software‑defined networking (SDN)‑enabled tunneling architecture that can instantiate, re‑configure, and tear down VPN slices on demand. Each slice carries its own encryption layer, quality‑of‑service policies, and traffic‑padding mechanisms to hide metadata. Key exchange is realized through a hybrid approach that combines Elliptic‑Curve Diffie‑Hellman (ECDH) with post‑quantum key‑exchange algorithms (e.g., Kyber, NTRU) to future‑proof the system against quantum adversaries.

The cryptographic algorithms segment recommends retaining AES‑256 and SHA‑3 as baseline primitives while simultaneously evaluating lattice‑based (Kyber, NTRU) and code‑based (McEliece) schemes for long‑term confidentiality. The paper stresses the importance of algorithm agility, key‑lifecycle management, and the separation of data‑at‑rest and data‑in‑transit protection layers. It also outlines a key‑rotation schedule aligned with the expected lifespan of quantum‑resistant algorithms, ensuring that the system can transition smoothly as standards evolve.

Quantum cryptography requirements focus on deploying fiber‑based BB84 QKD links across the city’s backbone network. The authors detail the necessary parameters: photon‑error rates, error‑correction codes, privacy‑amplification procedures, and authentication of the classical channel. They also explore free‑space optical (FSO) QKD for mobile assets such as drones and emergency vehicles, providing models for atmospheric loss and real‑time key synchronization. The goal is to generate symmetric session keys that are provably secure against any computational attack, including those from future quantum computers.

Federated identity management is approached from a privacy‑by‑design perspective. The paper proposes a decentralized identifier (DID) framework built on blockchain technology, combined with Zero‑Knowledge Proof (ZKP) protocols for attribute verification. This architecture enables multiple public agencies to authenticate the same individual without exposing personal data to a central repository. Policy‑based access control (PBAC) and dynamic delegation mechanisms are defined to allow real‑time adjustment of permissions in response to evolving threat levels. Inter‑agency trust is established through mutual certificate exchange and a hierarchical trust anchor model.

The secure MANET component addresses the need for resilient communication among mobile units (e.g., police cars, UAVs) operating in contested or infrastructure‑denied environments. The authors introduce a Secure Cluster‑Based Routing Protocol (SCBRP) that incorporates self‑healing capabilities, multi‑path routing, and an on‑the‑fly temporary public‑key infrastructure (TPKI) for peer authentication. A behavior‑based trust evaluation system is described to detect and isolate compromised nodes, while cryptographic protection of routing messages relies on the same post‑quantum primitives selected for the broader INDECT ecosystem.

Finally, the paper emphasizes integration: common data formats, standardized APIs, and unified security‑event logging are prescribed to ensure that each subsystem can interoperate without introducing gaps. By aligning the technical specifications across VPN, cryptography, quantum key distribution, identity management, and MANET, the authors aim to deliver a scalable, future‑proof security fabric that can be deployed across European cities to support the INDECT mission of enhanced public safety and counter‑terrorism capabilities.