A Versatile Security Layer for AutomationML The XMLbased data format AutomationML enables vendorindependent exchange of design data between disciplinespecific design tools. It is based on Computer Aided Engineering Exchange (CAEX) and hence, compatible with the W3C standards XMLEnc (XML encryption) and XMLDsig (XML signatures). However, despite the importance of protecting engineering data, so far no concept has been presented to ensure and control on a finegrained level the confidentiality, authenticity and accessibility of information stored in AutomationML files. In this paper, we introduce a basic access control scheme for AutomationML that enables to define user read and write access for each component. Furthermore, the scheme supports nonrepudiation based on a change history and socalled signature chains. It is also capable of supporting views and restricted access to components. The scheme is based on cryptographic measures xe2x80x93 i.e. cryptographic hashing, symmetric encryption, signatures, and asymmetric encryption xe2x80x93 and enforces its access control mechanisms through encryption to protect against unauthorized reading, and through signature chains to protect against unauthorized manipulation and to ensure nonrepudiation. This approach has the benefit to be independent of the underlying file and operating system, storage location, etc., and it keeps full CAEXconformity by extending AutomationML.This concept can serve as basis for software tools that support AutomationML and want to integrate access control features directly into AutomationML.

Vallum: Privacy, Confidentiality and Access Controlfor Sensitive Data in Cloud Environments Managing sensitive data in shared environments such as public clouds is an enduring challenge. While several approaches exist to protect data at rest such as endtoend encryption, there exist only a few solutions such as homomorphic encryption that offer secure data processing. Unfortunately, these solutions cannot be used in practice as they incur nonnegligible runtime overheads and security risks. Moreover, as the majority of data management systems were designed to operate in private cloud environments, which are under the control of the data owner, they often lack appropriate mechanisms for access control as well as privacy assurance. In this paper we propose Vallum, a data access and protection layer that closes these gaps while enabling users to operate data management systems in shared environments such securely as public clouds. Vallum utilizes Intel SGX and remote attestation to ensure confidentiality and integrity of the data being stored and processed. Furthermore, it provides access protection and privacy assurance through a extensible architecture. Our performance evaluation indicates that the overhead introduced by Vallum makes it viable to be deployed in cloud infrastructures.