Event-based systems lie at the heart of many cloud-based Internet-of-Things (IoT) platforms. This combination of the Broker architectural style and the Publisher-Subscriber design pattern provides a way for smart devices to communicate and coordinate with one another. The present design of these cloud-based IoT frameworks lacks measures to (i) protect devices against malicious cloud disconnections, (ii) impose information flow control among communicating parties, and (iii) enforce coordination protocols in the presence of compromised devices. In this work, we propose to extend the modular event-based system architecture of , to incorporate brokering policies and execution monitors, in order to address the three protection challenges mentioned above. We formalized the operational semantics of our protection scheme, explored how the scheme can be used to enforce BLP-style information flow control and RBAC-style protection domains, implemented the proposal in an open-source MQTT broker, and evaluated the performance impact of the protection mechanisms.
Also relevant to this work are attempts to add content-based access control to MQTT @cite_47 . A technical challenge is to meet the hungry throughput demand of IoT applications. Our implementation of history-tracking execution monitors is a first step towards realizing high-throughput, content-based event processing in a messaging system ( --).
@cite_47
2807534683 2093223549 2151771412 2535446776
Confidentiality and privacy of data managed by IoT ecosystems is becoming a primary concern. This paper targets the design of a general access control enforcement mechanism for MQTT-based IoT ecosystems. The proposed approach is presented with ABAC, but other access control models can be similarly supported. The solution is based on an enforcement monitor that has been designed to operate as a proxy between MQTT clients and an MQTT server. The monitor enforces access control constraints by intercepting and possibly manipulating the flow of exchanged MQTT control packets. Early experimental evaluations have overall shown low enforcement overhead. In this paper, a low-complexity delay-aware cross-layer scheduling algorithm for two-hop relay communication systems is proposed. The complex interactions of the queues at the source node and the M relay nodes (RSs) are modeled as an infinite horizon average reward Markov decision process (MDP), whose state space involves the joint queue state information (QSI) of the queues at the source node and the M RSs as well as the joint channel state information (CSI) of all S-R and R-D links. To address the curse of dimensionality, an equivalent MDP formulation is first proposed, where the system state depends only on global QSI. Furthermore, using approximate MDP and stochastic learning, an auction-based distributed online learning algorithm is derived, where each node iteratively estimates a per-node value function based on real-time observations of the local CSI and local QSI as well as signaling between relays. The combined distributed learning converges almost surely to a global optimal solution for large arrivals. Finally, it is showed by simulations that the proposed scheme achieves significant gain compared with various baselines such as the conventional CSIT-only control and the throughput optimal control (in stability sense). Machine-to-machine (M2M) communications have many applications, such as in smart grid, health monitoring alerting, and intelligent transportation. Due to unique characteristics that are different from the traditional human-to-human communications, numerous design challenges have to be tackled in M2M. A critical issue is that of dealing with the massive access of machine-type communication (MTC) devices while guaranteeing the desired quality of service (QoS). In this paper, we group MTC devices into clusters based on their QoS requirement. By utilizing the time-controlled M2M feature, we formulate the problem of massive access with QoS guarantee as a queuing problem. We derive an overflow probability estimation model by applying a large deviation principle and then propose an online-measurement-based adaptive massive access management for deciding the amount of resources allocated for each cluster. The proposed method bases the decision on the observed traffic workload with no prior knowledge of its statistics. We conduct the simulations in multicluster scenarios with distinct maximum tolerable delay and corresponding acceptable probability in a long-term evolution system. The simulation results show the adaptability of the proposed massive access management regime to the variations in the traffic workload; thus, it is capable of accommodating dynamic propagation conditions and unknown traffic characteristics, particularly in burst-by-burst communications. Measurement-Based Probabilistic Timing Analysis (MBPTA) derives WCET estimates for tasks running on processors comprising high-performance features such as caches. MBPTA's correct application requires the system to exhibit certain timing properties, which can be achieved by injecting randomisation in the timing behaviour of the task under analysis. However, existing software-randomisation techniques require costly modifications in the industrial production toolchain (compiler, linker, runtime or hardware) in terms of development and certification. In this paper we present TASA, a new software randomisation tool that relies on source-code transformations of the application (i) requiring no changes in existing toolchains, which heavily reduces tool qualification and implementation costs; and (ii) achieving competitive WCET estimates that we assess on a gcc- and a llvm-based compilation toolchain on a real board.