Event-based systems lie at the heart of many cloud-based Internet-of-Things (IoT) platforms. This combination of the Broker architectural style and the Publisher-Subscriber design pattern provides a way for smart devices to communicate and coordinate with one another. The present design of these cloud-based IoT frameworks lacks measures to (i) protect devices against malicious cloud disconnections, (ii) impose information flow control among communicating parties, and (iii) enforce coordination protocols in the presence of compromised devices. In this work, we propose to extend the modular event-based system architecture of , to incorporate brokering policies and execution monitors, in order to address the three protection challenges mentioned above. We formalized the operational semantics of our protection scheme, explored how the scheme can be used to enforce BLP-style information flow control and RBAC-style protection domains, implemented the proposal in an open-source MQTT broker, and evaluated the performance impact of the protection mechanisms.
Also relevant to this work are attempts to add content-based access control to MQTT @cite_47 . A technical challenge is to meet the hungry throughput demand of IoT applications. Our implementation of history-tracking execution monitors is a first step towards realizing high-throughput, content-based event processing in a messaging system ( --).
@cite_47
2807534683
Confidentiality and privacy of data managed by IoT ecosystems is becoming a primary concern. This paper targets the design of a general access control enforcement mechanism for MQTT-based IoT ecosystems. The proposed approach is presented with ABAC, but other access control models can be similarly supported. The solution is based on an enforcement monitor that has been designed to operate as a proxy between MQTT clients and an MQTT server. The monitor enforces access control constraints by intercepting and possibly manipulating the flow of exchanged MQTT control packets. Early experimental evaluations have overall shown low enforcement overhead.