Security and privacy in complex, context-aware systems: a comprehensive framework

Abstract Context-aware systems integrate environmental and user-related data to deliver intelligent and adaptive services. Their rising complexity, driven by advances in sensing technologies, Artificial Intelligence (AI), and the Internet of Things (IoT), introduces significant security and privacy challenges. This article presents a framework for the development and assessment of secure, privacy-preserving context-aware systems. Using the ISO/IEC 27002 standard as a foundation, we categorize and analyze common threats and propose a set of comprehensive protection strategies to guide the secure design of context-aware architectures. We further emphasize privacy-preserving practices aligned with ISO/IEC 27701 and the GDPR. To illustrate the applicability of the proposed framework, the smart classroom is presented as a representative example of a complex context-aware environment. The feasibility of implementing the proposed strategies is examined in light of the technological diversity that characterizes such ecosystems. Finally, we discuss the implications of emerging standards, such as ISO/IEC 27090, the European Union AI Act, and the NIST AI Risk Management Framework, and outline future research directions related to enhancing the medium-term resilience of context-aware systems.