Page 23 - U4SSC Data and API requirements for centralized smart city platforms

Privacy: the SCHub reference architecture must maintain a balance between the privacy of the
collected data, which may include personal identifiable information, while at the same time allowing
the use of data by services and integrators which will create additional value and insights that will
be for the benefit of the SC.

On the other hand, the key design principles of an SC reference architecture concern the following:

API-first design: The design of all components at all levels of the architecture must be focused on
providing a standardized method for machine-to-machine communication. This can be achieved
by making sure that each component provides clear and standardized APIs that will allow the
integration among them.

Baked-in security: Each component of the architecture is designed with security “baked-in” as
opposed to “bolted-on”. The scale and complexity of a SCHub has, by definition, an extensive attack
surface. In addition, the city itself can become a very attractive target for cyberattacks as the attack
surface grows and the integration of more devices and services increases with the adoption of an
increasing number of smart services by the citizens. This evolution makes it imperative that each
component operates in a secure way because the entire system is as secure as its weakest link. A
zero-trust design approach to each device and service is mandatory, in addition to the security
measures that will be enforced on the entire system.

Privacy by default: The added value of SCHub will eventually come from the innovative and
creative ways the generated data will be used to create new services for the citizen. As the size
of the data increases so their use for malicious purposes will make it increasingly attractive to
cybercriminal groups. For this reason, all the data generated by the devices in the SCHub must be
designed in such a way as to make sure any data sent to the SCHub are tamper-resistant, encrypted
and anonymized.

Any metadata that can be generated by correlation to provide value added services must not reveal
the identity or other private information of individual citizens. The following Figure 8 presents the
system overview highlighting the key elements:

IoT Devices: The IoT devices collect information from the city. They act as the sensing part of the
SCHub that generates the data which will be used by the higher layers of the architecture. The IoT
devices can be simple sensors that measure some physical property of intelligent edge devices
that can make calculations based on the data they collect at the IoT device level before sending
them to the SCHub.

Labor and workforce dimensions: Establishing and managing a Smart City Hub requires skilled
personnel who understand the technical and the managerial aspects of the system. This involves
training existing municipal staff or potentially recruiting new professionals with expertise in IoT, data
management and urban planning. Compliance with regulations and standards must be enforced
through structured oversight and regular audits, necessitating clear guidelines and accountability
mechanisms. Additionally, the creation of new roles or departments within the government may

13