Editor-in-Chief

Kai Rannenberg, Goethe University Frankfurt, Germany

Editorial Board Members

TC 1 – Foundations of Computer Science
Luís Soares Barbosa*†, University of Minho, Braga, Portugal

TC 2 – Software: Theory and Practice
Michael Goedicke, University of Duisburg-Essen, Germany

TC 3 – Education
Arthur Tatnall*‡, Victoria University, Melbourne, Australia

TC 5 – Information Technology Applications
Erich J. Neuhold, University of Vienna, Austria

TC 6 – Communication Systems
Burkhard Stiller, University of Zurich, Zürich, Switzerland

TC 7 – System Modeling and Optimization
Fredi Tröltzsch, TU Berlin, Germany

TC 8 – Information Systems
Jan Pries-Heje, Roskilde University, Denmark

TC 9 – ICT and Society
David Kreps*§, National University of Ireland, Galway, Ireland

TC 10 – Computer Systems Technology
Ricardo Reis*¶, Federal University of Rio Grande do Sul, Porto Alegre, Brazil

TC 11 – Security and Privacy Protection in Information Processing Systems
Steven Furnell*∥, Plymouth University, UK

TC 12 – Artificial Intelligence
Eunika Mercier-Laurent*∥, University of Reims Champagne-Ardenne, Reims, France

TC 13 – Human-Computer Interaction
Marco Winckler*∥, University of Nice Sophia Antipolis, France

TC 14 – Entertainment Computing
Rainer Malaka, University of Bremen, Germany
IFIP – The International Federation for Information Processing

IFIP was founded in 1960 under the auspices of UNESCO, following the first World Computer Congress held in Paris the previous year. A federation for societies working in information processing, IFIP's aim is two-fold: to support information processing in the countries of its members and to encourage technology transfer to developing nations. As its mission statement clearly states:

> IFIP is the global non-profit federation of societies of ICT professionals that aims at achieving a worldwide professional and socially responsible development and application of information and communication technologies.

IFIP is a non-profit-making organization, run almost solely by 2500 volunteers. It operates through a number of technical committees and working groups, which organize events and publications. IFIP's events range from large international open conferences to working conferences and local seminars.

The flagship event is the IFIP World Computer Congress, at which both invited and contributed papers are presented. Contributed papers are rigorously refereed and the rejection rate is high.

As with the Congress, participation in the open conferences is open to all and papers may be invited or submitted. Again, submitted papers are stringently refereed.

The working conferences are structured differently. They are usually run by a working group and attendance is generally smaller and occasionally by invitation only. Their purpose is to create an atmosphere conducive to innovation and development. Refereeing is also rigorous and papers are subjected to extensive group discussion.

Publications arising from IFIP events vary. The papers presented at the IFIP World Computer Congress and at open conferences are published as conference proceedings, while the results of the working conferences are often published as collections of selected and edited papers.

IFIP distinguishes three types of institutional membership: Country Representative Members, Members at Large, and Associate Members. The type of organization that can apply for membership is a wide variety and includes national or international societies of individual computer scientists/ICT professionals, associations or federations of such societies, government institutions/government related organizations, national or international research institutes or consortia, universities, academies of sciences, companies, national or international associations or federations of companies.

More information about this series at https://link.springer.com/bookseries/6102
Michael Friedewald · Stephan Krenn ·

Ina Schiering · Stefan Schiffner (Eds.)

Privacy and Identity
Management

Between Data Protection and Security

16th IFIP WG 9.2, 9.6/11.7, 11.6/SIG 9.2.2

International Summer School, Privacy and Identity 2021

Virtual Event, August 16–20, 2021

Revised Selected Papers

<figure><img src="image_1.png" /></figure>

Springer
Editors

Michael Friedewald

Fraunhofer ISI

Karlsruhe, Germany

Ina Schiering

Ostfalia University of Applied Sciences

Wolfenbüttel, Germany

Stephan Krenn

AIT Austrian Institute of Technology

Vienna, Austria

Stefan Schiffner

University of Münster

Münster, Germany

ISSN 1868-4238

ISSN 1868-422X (electronic)

IFIP Advances in Information and Communication Technology

ISBN 978-3-030-99099-2

ISBN 978-3-030-99100-5 (eBook)

https://doi.org/10.1007/978-3-030-99100-5

© IFIP International Federation for Information Processing 2022

This work is subject to copyright. All rights are reserved by the Publisher, whether the whole or part of the material is concerned, specifically the rights of translation, reprinting, reuse of illustrations, recitation, broadcasting, reproduction on microfilms or in any other physical way, and transmission or information storage and retrieval, electronic adaptation, computer software, or by similar or dissimilar methodology now known or hereafter developed.

The use of general descriptive names, registered names, trademarks, service marks, etc. in this publication does not imply, even in the absence of a specific statement, that such names are exempt from the relevant protective laws and regulations and therefore free for general use.

The publisher, the authors and the editors are safe to assume that the advice and information in this book are believed to be true and accurate at the date of publication. Neither the publisher nor the authors or the editors give a warranty, expressed or implied, with respect to the material contained herein or for any errors or omissions that may have been made. The publisher remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.

This Springer imprint is published by the registered company Springer Nature Switzerland AG

The registered company address is: Gewerbestrasse 11, 6330 Cham, Switzerland
Preface

This volume contains the proceedings of the 16th IFIP Summer School on Privacy and Identity Management, which took place during August 16–20, 2021. While planned to be held in Esch-sur-Alzette, Luxembourg, the summer school finally had to be held as a fully virtual event, due to the ongoing COVID-19 pandemic and associated uncertainties.

The 16th IFIP Summer School was a joint effort among IFIP Working Groups 9.2, 9.6/11.7, 11.6, and Special Interest Group 9.2.2, in co-operation with the European Union’s cybersecurity competence network pilot projects SPARTA<fnref n="1" />, CyberSec4Europe<fnref n="2" />, and CONCORDIA<fnref n="3" />. The summer school was also supported by Forum Privatheit<fnref n="4" /> and the EnCaViBS project<fnref n="5" />. This IFIP Summer School brought together more than 40 junior and senior researchers and practitioners from different parts of the world from many disciplines, including many young entrants to the field. They met to share their ideas, build a network, gain experience in presenting their research, and have the opportunity to publish a paper through these proceedings.

As in previous years, one of the goals of the IFIP Summer School was to encourage the publication of thorough research papers by students and emerging scholars. To this end, it had a three-phase review process for submitted papers. In the first phase, authors were invited to submit short abstracts of their work. Abstracts within the scope of the call were selected for presentation at the school. After the school, authors were encouraged to submit full papers of their work, which received two to three reviews by members of the Program Committee. They were then given time to revise and resubmit their papers for inclusion in these post-proceedings, and were offered in-depth shepherding where necessary.

In total, 23 abstracts were submitted, out of which 20 were presented at the virtual conference, and nine were finally accepted for publication. Insightful keynote talks were given by Kai Kimppa (“Ethical social engineering penetration testing – can it be done?”), Sebastian Pape (“Serious Games for Security and Privacy Awareness”), François Thill (“Information Security Risk Management”), and Jakub Čegan (“Training Development in KYPO Cyber Range Platform”). Finally, a total of five workshops and tutorials on topics related to privacy and identity management complemented a diverse and educational program.

We are grateful to all contributors of the summer school and especially to the Program Committee for reviewing the abstracts and papers as well as advising the

<footnote n="1">¹ https://www.sparta.eu/.</footnote>

<footnote n="2">² https://cybersec4europe.eu.</footnote>

<footnote n="3">³ https://www.concordia-h2020.eu/.</footnote>

<footnote n="4">⁴ https://www.forum-privatheit.de/.</footnote>

<footnote n="5">⁵ https://encavibs.uni.lu/.</footnote>
authors on their revisions. Our thanks also go to all supporting projects, the Steering
Committee for their guidance and support, and all participants and presenters.

February 2022

Michael Friedewald

Stephan Krenn

Ina Schiering

Stefan Schiffner
# Organization

## General Chair

Stefan Schiffner

University of Luxembourg, Luxembourg

## Program Chairs

Michael Friedewald

Fraunhofer ISI, Germany

Stephan Krenn

AIT Austrian Institute of Technology, Austria

Ina Schiering

Ostfalia University of Applied Sciences, Germany

## Program Committee

Florian Adamsky

Hof University of Applied Sciences, Germany

Rose-Mharie Åhlfeldt

University of Skövde, Sweden

Sébastien Canard

Orange Labs, France

José M. Del Álamo

Universidad Politécnica de Madrid, Spain

Jana Dittmann

Otto von Guericke University Magdeburg, Germany

Josep Domingo-Ferrer

Universitat Rovira i Virgili, Italy

Simone Fischer-Hübner

Karlstad University, Sweden

Jan Hajny

VUT Brno, Czech Republic

Marit Hansen

Unabhängiges Landeszentrum für Datenschutz
Schleswig-Holstein, Germany

Paula Helm

University of Tuebingen, Germany

Dominik Herrmann

University of Bamberg, Germany

Demosthenes Ikonomou

ENISA, Greece

Galina Ivanova

University of Ruse, Bulgaria

Meiko Jensen

Kiel University of Applied Sciences, Germany

Stefan Katzenbeisser

University of Passau, Germany

Kai Kimppa

University of Turku, Finland

Jani Koskinen

University of Turku, Finland

Christiane Kuhn

Karlsruhe Institute of Technology, Germany

Bertrand Lathoud

Securitymadein.lu, Luxembourg

Joachim Meyer

Tel Aviv University, Israel

Sebastian Pape

Goethe University Frankfurt, Germany

Robin Pierce

Tilburg University, The Netherlands

Jo Pierson

Vrije Universiteit Brussel, Belgium

Henrich C. Pöhls

University of Passau, Germany

Maria Grazia Porcedda

Trinity College Dublin, Ireland

Tobias Pulls

Karlstad University, Sweden

Charles Raab

University of Edinburgh, UK

Delphine Reinhardt

University of Göttingen, Germany
<table><tr><td>Kjetil Rommetveit</td><td>University of Bergen, Norway</td></tr><tr><td>Arnold Roosendaal</td><td>Privacy Company, The Netherlands</td></tr><tr><td>Denis Royer</td><td>Ostfalia University of Applied Sciences, Germany</td></tr><tr><td>Sandra Schmitz</td><td>University of Luxembourg, Luxembourg</td></tr><tr><td>Stefan Strauss</td><td>Austrian Academy of Sciences, Austria</td></tr><tr><td>Regina Valutytė</td><td>Mykolas Romeris University, Lithuania</td></tr><tr><td>Simone van der Hof</td><td>Leiden University, The Netherlands</td></tr></table>
# Contents

## Keynote Papers

<table><tr><td>Challenges for Designing Serious Games on Security and Privacy Awareness<br><i>Sebastian Pape</i></td><td>3</td></tr><tr><td>Information Security Risk Management<br><i>François Thill</i></td><td>17</td></tr></table>

## Workshop and Tutorial Papers

<table><tr><td>Conceptualising the Legal Notion of ‘State of the Art’ in the Context of IT Security<br><i>Sandra Schmitz</i></td><td>25</td></tr><tr><td>Privacy-Preserving Identity Management and Applications to Academic Degree Verification<br><i>Jorge Bernal Bernabe, Jesús García-Rodríguez, Stephan Krenn, Vasia Liagkou, Antonio Skarmeta, and Rafael Torres</i></td><td>33</td></tr><tr><td>The State of Surveillance – An Overall Account of Surveillance?<br><i>Felix Bieker</i></td><td>47</td></tr></table>

## Selected Student Papers

<table><tr><td>Bringing Privacy, Security and Performance to the Internet of Things Through Usage Control and Blockchains<br><i>Nathanael Denis, Sophie Chabridon, and Maryline Laurent</i></td><td>57</td></tr><tr><td>SynCare: An Innovative Remote Patient Monitoring System Secured by Cryptography and Blockchain<br><i>Claudio Pighini, Alessio Vezzoni, Simone Mainini, Andrea G. Migliavacca, Alessandro Montanari, Maria R. Guarneri, Enrico G. Caiani, and Ambra Cesareo</i></td><td>73</td></tr><tr><td>Taxpayers’ Rights, the Right to Data Protection and Cybersecurity in the EU<br><i>Mylana Pfeiffer</i></td><td>90</td></tr><tr><td>Usable Privacy and Security from the Perspective of Cognitive Abilities<br><i>Joakim Kävrestad, Allex Hagberg, Robert Roos, Jana Rambusch, and Marcus Nohlberg</i></td><td>105</td></tr></table>
Cloud Native Privacy Engineering through DevPrivOps. 122
Elias Grünewald

Gamification in mHealth - Opportunities and Privacy Risks 142
Ramona Schmidt and Ina Schiering

Exploration of Factors that Can Impact the Willingness of Employees
to Share Smart Watch Data with Their Employers. 160
Alexander Richter, Patrick Kühtreiber, and Delphine Reinhardt

Public Education, Platformization and Cooperative Responsibility:
The Case of the Privacy Covenant in the Netherlands 180
Marco Houben and Jo Pierson

Observing Road Freight Traffic from Mobile Network Signalling Data
While Respecting Privacy and Business Confidentiality 195
Rémy Scholler, Oumaïma Alaoui-Ismaili, Jean-François Couchot,
Eric Ballot, and Denis Renaud

Author Index 207