What is the format of the ICCNS conference?

The ICCNS is an international conference, indicating a global participation and a focus on presenting and discussing research in cryptography and network security.

When does the ICCNS conference occur?

The conference is scheduled to take place in April.

International Conference on Cryptography and Network Security (ICCNS) 2027

Name: International Conference on Cryptography and Network Security (ICCNS) 2027
Start: 2027-04-03T00:00:00Z
End: 2027-04-04T00:00:00Z
Location: Mexico City

Apr 3–4, 2027Mexico City, MexicoIn-person

Registration open

The International Conference on Cryptography and Network Security (ICCNS) will convene in Mexico City, MEX, bringing together researchers, engineers, and academics to present and discuss advancements in cryptography and network security. This event serves as a crucial platform for the exchange of ideas and the exploration of new research directions in these rapidly evolving fields. Participants will engage with cutting-edge developments and foster collaborations that address contemporary challenges in digital protection.

Committees & topics

Topics
Access Control in Modern Information Systems · Applied Cryptography · Automated Analysis of Cryptographic Protocols · Biometric Security and Privacy · Security of Complex and Cyber-Physical Systems · Critical Infrastructure Protection · Cryptographic Primitives and Protocols · Data Protection in a Cross-Border Environment

Why it matters

In an increasingly interconnected world, the integrity and confidentiality of digital information are paramount. The ICCNS addresses this critical need by focusing on the foundational principles and practical applications of cryptography and network security. Discussions at the conference are vital for shaping the future of secure digital environments, impacting everything from personal privacy to national infrastructure.

The location of the conference in Mexico City, MEX, highlights the growing importance of cybersecurity expertise and infrastructure development in North America. This regional focus underscores the global nature of cyber threats and the necessity for international cooperation in developing robust defense mechanisms. The insights shared at ICCNS contribute directly to strengthening digital resilience across various sectors and geographies.

How to prepare

Delegates preparing for the ICCNS should focus on understanding the diverse perspectives that shape the discourse around cryptography and network security. Consider the varying national priorities and technological capabilities across countries like USA, GBR, DEU, and CHN, which often influence research and policy in this domain. Understanding these different approaches can enrich discussions on global cybersecurity standards and collaborative defense strategies.

To effectively engage with the conference topics, it is beneficial to analyze the motivations behind different cryptographic techniques and network security protocols. Exploring concepts like "understanding motivations" can help in discerning the strategic implications of various security architectures. Additionally, identifying "hidden stakeholders" in cybersecurity discussions, such as private sector entities or non-state actors, can provide a more comprehensive view of the challenges and opportunities in the field. A "stakeholder mapping workshop" approach could be valuable in preparing to understand the complex web of actors involved in shaping the future of digital security.

Country perspectives

Where the most-relevant 5 countries stand on the core issues in play. Click through for the full country profile.

Mexico

Host nation with growing cybersecurity focus.

Role in topic

As the host nation, MEX plays a significant role in facilitating international dialogue on cryptography and network security, underscoring its commitment to advancing digital protection within North America and globally.

United States

Leading innovator and key policy influencer.

Role in topic

The USA is a major contributor to research and development in cryptography and network security, often setting global standards and influencing international policy through its technological advancements and strategic initiatives.

China

Significant player in cyber technology and policy.

Role in topic

CHN is a prominent actor in the development and application of cyber technologies, with a strong focus on national cybersecurity strategies and a rapidly expanding digital infrastructure that impacts global security discussions.

Germany

Strong advocate for data privacy and secure digital infrastructure.

Role in topic

DEU emphasizes robust data protection laws and the development of secure digital infrastructures, contributing significantly to discussions on privacy-enhancing technologies and resilient network architectures.

United Kingdom

Key contributor to cybersecurity research and international cooperation.

Role in topic

The GBR is a leader in cybersecurity research and actively participates in international efforts to combat cyber threats, contributing expertise in areas such as intelligence sharing and critical infrastructure protection.

Topics & background

The background behind each topic and the actors that shape it.

Access Control in Modern Information Systems

Access control — the discipline of determining who or what may interact with which resources under what conditions — has evolved from the discretionary and mandatory models codified in the 1983 U.S. Department of Defense 'Orange Book' to today's attribute-based, risk-adaptive, and zero-trust architectures. The 1990s saw role-based access control (RBAC) standardized by NIST, while the 2000s introduced XACML and attribute-based access control (ABAC) to handle federated and cloud environments. The proliferation of mobile devices, SaaS, and APIs has since dissolved the traditional network perimeter, making identity itself the new control surface. The core dispute today is how to balance usability, scalability, and assurance. Enterprises and governments are migrating to zero-trust architectures (formalized in NIST SP 800-207, 2020) that require continuous verification rather than one-time authentication. At the same time, supply-chain attacks such as SolarWinds (2020) and identity-provider breaches at Okta and Microsoft have shown that compromised credentials and over-privileged service accounts remain the leading vector for intrusions. Debates persist over machine identity governance, just-in-time privilege, decentralized identifiers (W3C DIDs), and how to reconcile access control with cross-border data sovereignty requirements.

Key players

Applied Cryptography

Applied cryptography concerns the engineering of cryptographic theory into deployable systems — TLS, Signal, disk encryption, payment networks, and increasingly post-quantum and privacy-preserving constructions. The field matured rapidly after the 1976 Diffie–Hellman paper and the 1977 publication of RSA, accelerated by the 'crypto wars' of the 1990s over export controls and key escrow (Clipper chip). The 2013 Snowden disclosures revealed extensive state interception and triggered a wave of default end-to-end encryption across consumer platforms. The contemporary agenda is dominated by three threads: the migration to post-quantum cryptography following NIST's 2024 finalization of ML-KEM, ML-DSA, and SLH-DSA; the deployment of privacy-enhancing technologies such as fully homomorphic encryption, secure multiparty computation, and zero-knowledge proofs in finance and identity; and a renewed political confrontation over 'lawful access' to encrypted communications, exemplified by the EU's Chat Control proposal and the UK Online Safety Act. The applied community must reconcile cryptographic assurance with side-channel resistance, implementation correctness, and increasingly with regulatory mandates that touch the algorithms themselves.

Key players

Automated Analysis of Cryptographic Protocols

Cryptographic protocols have a long history of subtle flaws — the 1995 Lowe attack on the Needham–Schroeder protocol demonstrated that informal reasoning is insufficient even for short message exchanges. This catalyzed the development of formal verification tools: ProVerif, Tamarin, CryptoVerif, EasyCrypt, and Maude-NPA. Such tools were used to vet TLS 1.3 before its 2018 publication, identifying weaknesses in early drafts, and have since been applied to Signal, Noise, WireGuard, EMV payment protocols, and 5G AKA. The state of the field today blends symbolic and computational models, with growing demand to verify implementations — not only abstract protocols — using frameworks such as HACL*, F*, and the Project Everest stack. Open challenges include scaling to large, stateful protocols (post-quantum hybrid TLS, MLS group messaging, OAuth/OIDC flows), modeling side channels and downgrade attacks, and integrating verification into continuous-integration pipelines. Governments are beginning to require formal evidence in high-assurance procurement, raising questions about tool maturity, reproducibility, and the gap between verified specifications and shipped code.

Key players

Biometric Security and Privacy

Biometrics — fingerprints, iris, face, voice, gait, vein, and behavioral signals — have moved from forensic niches to ubiquitous authentication, anchored by smartphone sensors, e-passports compliant with ICAO Doc 9303, and population-scale identity systems such as India's Aadhaar (over 1.3 billion enrollments). Standards bodies ISO/IEC JTC 1/SC 37 and SC 27 have built out a framework covering data interchange, performance testing, and presentation-attack detection. The central tensions are irrevocability and surveillance. Unlike passwords, compromised biometric templates cannot be reissued, fueling research into cancelable biometrics, fuzzy extractors, and homomorphic matching. Meanwhile, the proliferation of live facial recognition by law enforcement has driven regulatory pushback: the EU AI Act (2024) restricts real-time remote biometric identification in public spaces, U.S. cities have banned municipal use, and Clearview AI has faced fines across multiple jurisdictions. Generative AI now enables high-quality deepfake presentation attacks, forcing rapid evolution of liveness detection. Debates continue over consent, function creep, cross-border template sharing, and whether biometric data warrants a separate legal category beyond general personal data.

Key players

Security of Complex and Cyber-Physical Systems

Modern infrastructures — power grids, vehicles, medical devices, satellite constellations, industrial control systems, and the cloud platforms that orchestrate them — are 'systems of systems' whose security cannot be reduced to the sum of their components. The 2010 Stuxnet operation against Iranian centrifuges demonstrated that cyber attacks can produce physical destruction; the 2015 and 2016 attacks on the Ukrainian grid, the 2017 NotPetya supply-chain incident, the 2021 Colonial Pipeline ransomware event, and the 2024 CrowdStrike update failure each illustrated cascading failures across interconnected systems. Research focuses on emergent vulnerabilities arising from feedback loops, AI/ML components, legacy OT protocols (Modbus, DNP3, IEC 61850), and the convergence of IT and OT. Standards such as IEC 62443, NIST SP 800-82, and the EU NIS2 and Cyber Resilience Act regimes attempt to impose baseline assurance, but face the challenges of long device lifecycles, opaque firmware supply chains, and the difficulty of patching safety-critical equipment. A live debate concerns the role of software bills of materials (SBOMs), mandatory incident reporting, and liability for insecure products.

Key players

Critical Infrastructure Protection

The concept of critical infrastructure protection (CIP) emerged in the United States with PDD-63 (1998) and was globalized after 9/11 and the rise of state-sponsored cyber operations. Sectors typically designated as critical — energy, water, finance, transport, health, telecommunications, and increasingly digital infrastructure such as cloud and DNS — are governed by overlapping national regimes: U.S. PPD-21 and the 2023 National Cybersecurity Strategy, the EU's NIS2 Directive and CER Directive (both 2023), Japan's Economic Security Promotion Act, and China's Critical Information Infrastructure Protection Regulations (2021). The contemporary picture is one of contested infrastructure. Sabotage of the Nord Stream pipelines (2022), repeated cuts to subsea cables in the Baltic and Red Sea, GPS jamming over Eastern Europe, and ransomware against hospitals and pipelines have blurred the line between crime, espionage, and armed conflict. The UN OEWG on ICT has produced non-binding norms discouraging attacks on critical infrastructure, but enforcement and attribution remain weak. Key disputes involve the scope of 'critical' designations, mandatory incident reporting thresholds, cross-border information sharing, the security of foreign-supplied equipment (notably 5G and cloud), and whether some cyber operations against essential services should be treated as uses of force under international law.

Key players

Cryptographic Primitives and Protocols

Cryptographic primitives — block and stream ciphers, hash functions, MACs, public-key schemes, and the protocols that compose them — form the substrate of digital security. Their evolution tracks public competitions and standardization: DES (1977) gave way to AES via the 1997–2000 NIST process; SHA-3 was selected through the 2007–2012 Keccak competition; the CAESAR competition (2014–2019) advanced authenticated encryption; and NIST's lightweight cryptography process concluded in 2023 with Ascon. The post-quantum standardization, finalized in 2024 with FIPS 203/204/205, marks the most consequential primitive transition in a generation. Current priorities include hybrid classical/post-quantum key exchange (now deployed in Chrome, Cloudflare, and AWS), threshold and distributed cryptography (NIST's ongoing threshold project), advanced primitives such as verifiable delay functions, indistinguishability obfuscation, and succinct non-interactive arguments (SNARKs/STARKs) underpinning rollups and verifiable computation. Open questions concern the long-term security of lattice assumptions, the cost of migration for embedded and legacy systems, the standardization of FHE and MPC, and ensuring that primitive choices in standards bodies remain free of undisclosed backdoors — a concern revived by the Dual_EC_DRBG episode.

Key players

Data Protection in a Cross-Border Environment

Data protection as a distinct legal field traces to the 1980 OECD Privacy Guidelines and Council of Europe Convention 108, but the modern era began with the EU's General Data Protection Regulation (GDPR, 2018), which set extraterritorial standards, large fines, and a template now echoed in Brazil's LGPD, India's DPDP Act (2023), China's PIPL (2021), and U.S. state laws led by California's CCPA/CPRA. Technical complements — encryption, pseudonymization, differential privacy, confidential computing, and privacy-preserving analytics — have moved from research into mainstream deployment. The defining disputes are transatlantic data flows (after Schrems I and II, the 2023 EU–U.S. Data Privacy Framework remains under litigation), data localization mandates (Russia, China, India, Vietnam), government access to data held by cloud providers under instruments such as the U.S. CLOUD Act, and the tension between AI training on personal data and rights to erasure, rectification, and explanation. Emerging frontiers include children's data, neurodata, biometric and health data categories, and the interaction between data-protection law and AI-specific regulation such as the EU AI Act. The technical research agenda — efficient FHE, federated learning with provable guarantees, and verifiable data deletion — directly shapes whether legal obligations can be implemented at scale.

Key players