Publish-subscribe Model Research Articles

Blockchain-Assisted Keyword Search Scheme for SWIM Service Based on Improved CSC-Cuckoo Filter

With the rapid development of the civil aviation industry, the demand for secure sharing of civil aviation data is increasing. As a global platform for secure sharing of civil aviation data, the security of the System Wide Information Management (SWIM) system is of great concern. SWIM adopts a service-oriented architecture and realizes the interaction of civil aviation data through a publish-subscribe model. To protect the service privacy while enabling subscribers to subscribe to the service quickly and securely, this paper proposes an efficient Circular Shift and Coalesce-Cuckoo Filter (CSC-CF)-based service Keyword Search (CCKS) scheme assisted by blockchain. This scheme uses the Symmetric-key Hidden Vector Encryption (SHVE) algorithm to encrypt and match service indexes and trapdoors to protect service privacy; the CSC-CF structure is applied to keyword search, which can effectively improve the efficiency of SWIM user subscription service. To improve search accuracy and space utilization, we propose the improved CCKS (ICCKS) scheme by optimizing the query algorithm of CSC-CF and setting a threshold for the number of keyword query failures. ICCKS improves search accuracy by 5–20% compared to CCKS when the filter’s space utilization is between 60 and 90%. Additionally, the scheme stores service topic indexes and registry on the blockchain and implements a smart contract to match indexes and subscription trapdoors, ensuring the integrity and trustworthiness of service topics and registry. Security analysis and experimental simulations demonstrate that the scheme is effective and secure in the SWIM system.

Privacy-Preserving Contact Tracing System based on a Publish-Subscribe Model

Privacy-Preserving Contact Tracing System based on a Publish-Subscribe Model

End-to-End Encrypted Message Distribution System for the Internet of Things Based on Conditional Proxy Re-Encryption.

In light of the existing security vulnerabilities within IoT publish-subscribe systems, our study introduces an improved end-to-end encryption approach using conditional proxy re-encryption. This method not only overcomes limitations associated with the reliance on a trusted authority and the challenge of reliably revoking users in previous proxy re-encryption frameworks, but also strengthens data privacy against potential collusion between the broker and subscribers. Through our innovative encryption protocol, unauthorized re-encryption by brokers is effectively prevented, enhancing secure communication between publisher and subscriber. Implemented on HiveMQ, an open-source MQTT platform, our prototype system demonstrates significant enhancements. Comparison to the state-of-the-art end-to-end encryption work, encryption overhead of our scheme is comparable to it, and the decryption cost is approximately half of it. Moreover, our solution significantly improves overall security without compromising the asynchronous communication and decentralized authorization foundational to the publish-subscribe model.

Post-Quantum Authentication in the MQTT Protocol

Message Queue Telemetry Transport (MQTT) is a common communication protocol used in the Internet of Things (IoT). MQTT is a simple, lightweight messaging protocol used to establish communication between multiple devices relying on the publish–subscribe model. However, the protocol does not provide authentication, and most proposals to incorporate it lose their lightweight feature and do not consider the future risk of quantum attacks. IoT devices are generally resource-constrained, and postquantum cryptography is often more computationally resource-intensive compared to current cryptographic standards, adding to the complexity of the transition. In this paper, we use the postquantum digital signature scheme CRYSTALS-Dilithium to provide authentication for MQTT and determine what the CPU, memory and disk usage are when doing so. We further investigate another possibility to provide authentication when using MQTT, namely a key encapsulation mechanism (KEM) trick proposed in 2020 for transport level security (TLS). Such a trick is claimed to save up to 90% in CPU cycles. We use the postquantum KEM scheme CRYSTALS-KYBER and compare the resulting CPU, memory and disk usages with traditional authentication. We found that the use of KEM for authentication resulted in a speed increase of 25 ms, a saving of 71%. There were some extra costs for memory but this is minimal enough to be acceptable for most IoT devices.

Pub-SubMCS: A privacy-preserving publish–subscribe and blockchain-based mobile crowdsensing framework

This paper proposes a privacy-preserving publish–subscribe-based decentralized framework for MCS systems named “Pub-SubMCS”. The framework allows data sharing, where requesters can subscribe to an existing data request (task) if their requirements match. Otherwise, they can create a new task with specific requirements on considered parameters. Incorporating the publish–subscribe (pub–sub) service model in a decentralized MCS system saves system entities’ sensing and computing resources and the cost of acquiring the data by the requesters. However, the pub–sub service model makes the curse of sensing issues more severe. Pub-SubMCS handles the curse of sensing issues by performing access control using smart contracts, which impose restrictions on data collectors (workers) to publish the data and identify and penalize the malicious workers early. To ensure data privacy and validation simultaneously over blockchain, we perform data transformation enabling the validation algorithm to run over transformed data and thus enhancing trust among the system entities. In particular, we use the normalization technique to transform data and the Pearson correlation coefficient measure to compare the similarity in the collected sensor data. Pub-SubMCS is implemented on the Ethereum blockchain, and solidity programming language is used to create smart contracts. The security analysis and experiment results show the proposed system’s scalability, usability, and feasibility. We also demonstrate the effectiveness of the publish–subscribe model against the requester–worker model.

Privacy-preserving data dissemination scheme based on Searchable Encryption, publish–subscribe model, and edge computing

Attribute-based Searchable Encryption is emerging as a promising cryptographic technique supporting data protection, flexible access control, and keyword search over encrypted data. The current scientific literature already investigated its adoption in cloud-based services and additionally explored the usage of edge computing to implement some of the cryptographic tasks in scenarios with limited computational capabilities (such as Internet of Things). In the majority of the available solutions, however, the remote cloud is still responsible for data storage, keyword search over encrypted data, and delivery tasks. Indeed, the heavy computational load generated in scenarios with multiple data producers and data consumers (never studied yet) and large communication latencies can inevitably compromise the overall system performance. To bridge this gap, this work proposes a decentralized service architecture offering privacy-preserving data dissemination, by jointly leveraging attribute-based Searchable Encryption techniques, publish–subscribe communication model, and edge computing capabilities. Here, customized Edge Servers are deployed at the network edge to (i) collect subscription requests encoded via Searchable Encryption Trapdoors, (ii) receive data publications, encrypted via Attribute-based Searchable Encryption scheme, (iii) implement keyword search over encrypted data, and (iv) deliver encrypted data only to authorized requesters. Experimental tests explored the impact of network configuration and traffic load on both communication latency and energy consumption. Obtained results demonstrated the unique ability of the proposed solution to achieve shorter data delivery delays as well as less energy consumption with respect to cloud-based alternatives.

Formalization and verification of Kafka messaging mechanism using CSP

Apache Kafka is an open source distributed messaging system based on the publish-subscribe model, which achieves low latency, high throughput and good load balancing. As a popular messaging system, the transmission of messages between applications is one of the core functions of Kafka. Therefore, the reliability and security of data in the process of message transmission in Kafka have become the focus of attention. The formal methods can analyze whether a model is highly credible. Therefore, it is significant to analyze Kafka messaging mechanism which describes the communication process and rules between each module entity in Kafka from the perspective of formal methods. In this paper, we apply the process algebra CSP (Communicating Sequential Processes) and the model checking tool PAT (Process Analysis Toolkit) to analyze Kafka messaging mechanism. The results of verification show that the model caters for its specification and guarantees the reliability of messages in the normal communication process. Moreover, in order to further analyze the security of Kafka messaging mechanism, we add the intruder model and the authentication protocol Kerberos model and compare the verification results of Kafka messaging mechanism with or without the secure protocol Kerberos. The results show that the Kerberos protocol has improved the security of Kafka messaging mechanism in some aspects, but there are still some security loopholes.

BREPubSub: A Secure Publish-Subscribe Model using Blockchain and Re-encryption for IoT Data Sharing Management

As a result of the incredible growth and diversity of IoT systems and applications over the past several years, an enor-mous amount of sensing data has been generated, which is critical for developing IoT-based intelligent systems. So far, it has taken a significant amount of time and money to collect sufficient sensing data for these smart systems leading to demands of sharing or exchanging available and valuable data to reduce the time and money spent on the data collection process. However, ensuring the data sharing process’s integrity, security, and fairness is fraught with challenges. This paper proposes a Blockchain-based model that supports a secure publish-subscribe protocol for data sharing management by addressing three criteria such as confidentiality, integrity, and availability. In addition, the proposed model adopts a re-encryption technique to optimize shared data storage with multiple users and enhance the security of the data exchange process in a transparent and public environment like Blockchain. We have developed a DApp to demonstrate the feasibility of our design and evaluate its performance.

Distribution of DDS-cerberus authenticated facial recognition streams

Successful missions in the field often rely upon communication technologies for tactics and coordination. One middleware used in securing these communication channels is Data Distribution Service (DDS) which employs a publish-subscribe model. However, researchers have found several security vulnerabilities in DDS implementations. DDS-Cerberus (DDS-C) is a security layer implemented into DDS to mitigate impersonation attacks using Kerberos authentication and ticketing. Even with the addition of DDS-C, the real-time message sending of DDS also needs to be upheld. This paper extends our previous work to analyze DDS-C’s impact on performance in a use case implementation. The use case covers an artificial intelligence (AI) scenario that connects edge sensors across a commercial network. Specifically, it characterizes how DDS-C performs between unmanned aerial vehicles (UAV), the cloud, and video streams for facial recognition. The experiments send a set number of video frames over the network using DDS to be processed by AI and displayed on a screen. An evaluation of network traffic using DDS-C revealed that it was not statistically significant compared to DDS for the majority of the configuration runs. The results demonstrate that DDS-C provides security benefits without significantly hindering the overall performance.

About decentralized swarms of asynchronous distributed cellular automata using inter-planetary file system’s publish-subscribe experimental implementation

This research describes the simple implementation of asynchronous distributed cellular automata and decentralized swarms of asynchronous distributed cellular automata built on top of inter-planetary file system’s publish-subscribe (IPFS PubSub) experimentation. Various publish-subscribe(PubSub) models are described. As an illustration, two distributed versions and a decentralized swarm version of a 2D elementary cellular automaton are thoroughly detailed to highlight the simplicity of implementation with IPFS and the inner workings of these kinds of cellular automata (CA). Both algorithms were implemented, and experiments were conducted throughout five datacenters of Grid’5000 testbed in France to obtain preliminary performance results in terms of network bandwidth usage. This work is prior to implementing a large-scale decentralized epidemic propagation modeling and prediction system based upon asynchronous distributed cellular automata with application to the current pandemic of SARS-CoV-2 coronavirus disease 2019 (COVID-19).

A Communication Interface for Multilayer Cloud Computing Architecture for Low Cost Underwater Vehicles*

To enable high computational loads for low cost underwater drones, a cloud based architecture is proposed to take advantage of recent development in machine learning and computer vision. The processing power made available will benefit vehicles with limited onboard processing capacity. The rapid development of cloud computing services have made servers with significant computational resources easier to access. In this paper, a communication interface for cloud based multilayer architecture is proposed to enable real time performance by distributing the workload to networked processing devices. It adopts a publish-subscribe model for efficient communication between the layers. The latency and workload distribution are evaluated to assess the efficiency of the proposed method. An application to semantic segmentation of under-water scenes is also tested to measure the framework capabilities for real-time operation using more resource-demanding tools. The conducted experiments resulted in time and performance gains through offloading the underwater vehicle, and forwarding the computations to the cloud based layer.

Hardware Implementation of MQTT Broker and Precise Time Synchronization Using IoT Devices

In recent years, while internet of things (IoT) devices and cloud computing environments have been penetrated, the increase in communication latency and concentration of traffic caused by data centers has deteriorated the quality of some network services. Message Queuing Telemetry Transport (MQTT) is a well‐known protocol for exchanging messages between dedicated applications. MQTT employs a publish–subscribe model in which a broker mediates communication between IoT devices and applications. To improve service quality, the processing latency of the broker should be reduced. Moreover, the broker's throughput must be increased. IoT devices, in particular, must maintain a highly accurate time to provide some IoT services. This study proposed hardware implementation of MQTT broker and evaluated the accuracy of an MQTT‐based time synchronization method. The proposed MQTT architecture's hardware resource utilization is also provided. We confirmed that our implementation achieved high throughput, low latency, and low jitter MQTT broker, which satisfies the smart city services for automated drive and power control, which must be less than a few milliseconds. © 2021 Institute of Electrical Engineers of Japan. Published by Wiley Periodicals LLC.

Data Distribution Service Converter Based on the Open Platform Communications Unified Architecture Publish–Subscribe Protocol

The open platform communications unified architecture (OPC UA) is a major industry-standard middleware based on the request–reply pattern, and the data distribution service (DDS) is an industry standard in the publish–subscribe form. The OPC UA cannot replace fieldbuses at the control and field levels. To facilitate real-time connectionless operation, the OPC Foundation added the publish–subscribe model—a new specification that supports broker functions, such as message queuing telemetry transport (MQTT), and advanced message queuing protocol (AMQP)—to the OPC UA Part 14 standard. This paper proposes a protocol converter for incorporation into the application layer of the DDS subscriber to facilitate interoperability among publisher–subscriber pairs. The proposed converter comprises a DDS gateway and bridge. The former exists inside the MQTT and AMQP brokers, which convert OPC UA publisher data into DDS messages prior to passing them on to the DDS subscriber. The DDS bridge passes the messages received from the DDS gateway to the OPC UA subscriber in the corresponding DDS application layer. The results reported in existing studies, and those obtained using the proposed converter, allow all devices supporting the OPC UA and OPC UA PubSub standards to realize DDS publish–subscribe interoperability.

MQTT-PRESENT: Approach to secure internet of things applications using MQTT protocol

The big challenge to raise for deploying the application's domain of the Internet of Things is security. As one of the popular messaging protocols in the IoT world, the message queue telemetry transport (MQTT) is designed for constrained devices and machine-to-machine communications, based on the publish-subscribe model, it offers a basic authentication using username and password. However, this authentication method might have a problem in terms of security and scalability. In this paper, we provide an analysis of the current research in the literature related to the security for the MQTT protocol, before we give a brief description of each algorithm used on our approach, to finally propose a new approach to secure this protocol based on AugPAKE algorithm and PRESENT encryption. This solution provides mutual authentication between the broker and their clients (publishers and subscribers), the confidentiality of the published message is protected twice, the integrity and non-repudiation of MQTT messages which is protected during the process of transmission.

Using Aerial and Vehicular NFV Infrastructures to Agilely Create Vertical Services.

5G communications have become an enabler for the creation of new and more complex networking scenarios, bringing together different vertical ecosystems. Such behavior has been fostered by the network function virtualization (NFV) concept, where the orchestration and virtualization capabilities allow the possibility of dynamically supplying network resources according to its needs. Nevertheless, the integration and performance of heterogeneous network environments, each one supported by a different provider, and with specific characteristics and requirements, in a single NFV framework is not straightforward. In this work we propose an NFV-based framework capable of supporting the flexible, cost-effective deployment of vertical services, through the integration of two distinguished mobile environments and their networks: small sized unmanned aerial vehicles (SUAVs), supporting a flying ad hoc network (FANET) and vehicles, promoting a vehicular ad hoc network (VANET). In this context, a use case involving the public safety vertical will be used as an illustrative example to showcase the potential of this framework. This work also includes the technical implementation details of the framework proposed, allowing to analyse and discuss the delays on the network services deployment process. The results show that the deployment times can be significantly reduced through a distributed VNF configuration function based on the publish–subscribe model.

A Green Data Management Layer in Industrial IoT

All Nowadays, industry 4.0, which aims at transforming industrial manufacturing systems to the smart factories, has gained considerable attention from both industry and academia. The Industrial Internet of Things (IIoT) plays a primordial role to achieve the objectives of Industry 4.0, by enabling the Cyber-Physical Production Systems (CPPS) to communicate and cooperate with each other and with humans both internally and across the participants of the supply chain. A communication model used commonly in IIoT networks consists of the publish-subscribe model, in which the data generated by sensor nodes are cached in a central controller to be subsequently consumed by actuator nodes. However, the traditional centralized data management is inappropriate for real application because of its communication overhead and inability to cope with strict delay requirements of IIoT applications and energy constraints of IIoT networks. To address these issues, we propose a Green Data Management Layer (GDML), which caches data distributedly in some IoT nodes, called proxy nodes, so that the network energy consumption is optimized while the constraints on data access latency and IoT nodes’ cache capacity are met. In this measure, the extra IoT nodes not involved in data transmission nor in data caching are switched off to prolong the battery lifetime of constrained IoT nodes. We modeled the aforementioned optimization problem as an Integer Linear Programming (ILP) and solved it using the CPLEX tool. The obtained results show that the proposed GDML outperforms significantly alternative solutions in terms of overall energy consumption, energy consumption devoted to data transmission, energy consumption devoted to keeping active the involved nodes, while the constraints on data applications latency and the cache size of IoT nodes are satisfied.

DOLARS, a Distributed On-Line Activity Recognition System by Means of Heterogeneous Sensors in Real-Life Deployments-A Case Study in the Smart Lab of The University of Almería.

Activity Recognition (AR) is an active research topic focused on detecting human actions and behaviours in smart environments. In this work, we present the on-line activity recognition platform DOLARS (Distributed On-line Activity Recognition System) where data from heterogeneous sensors are evaluated in real time, including binary, wearable and location sensors. Different descriptors and metrics from the heterogeneous sensor data are integrated in a common feature vector whose extraction is developed by a sliding window approach under real-time conditions. DOLARS provides a distributed architecture where: (i) stages for processing data in AR are deployed in distributed nodes, (ii) temporal cache modules compute metrics which aggregate sensor data for computing feature vectors in an efficient way; (iii) publish-subscribe models are integrated both to spread data from sensors and orchestrate the nodes (communication and replication) for computing AR and (iv) machine learning algorithms are used to classify and recognize the activities. A successful case study of daily activities recognition developed in the Smart Lab of The University of Almería (UAL) is presented in this paper. Results present an encouraging performance in recognition of sequences of activities and show the need for distributed architectures to achieve real time recognition.

Improving Topic-Based Data Exchanges among IoT Devices

Data exchange is one of the huge challenges in Internet of Things (IoT) with billions of heterogeneous devices already connected and many more to come in the future. Improving data transfer efficiency, scalability, and survivability in the fragile network environment and constrained resources in IoT systems is always a fundamental issues. In this paper, we present a novel message routing algorithm that optimizes IoT data transfers in a resource constrained and fragile network environment in publish-subscribe model. The proposed algorithm can adapt the dynamical network topology of continuously changing IoT devices with the rerouting method. We also present a rerouting algorithm in Message Queuing Telemetry Transport (MQTT) to take over the topic-based session flows with a controller when a broker crashed down. Data can still be communicated by another broker with rerouting mechanism. Higher availability in IoT can be achieved with our proposed model. Through demonstrated efficiency of our algorithms about message routing and dynamically adapting the continually changing device and network topology, IoT systems can gain scalability and survivability. We have evaluated our algorithms with open source Eclipse Mosquitto. With the extensive experiments and simulations performed in Mosquitto, the results show that our algorithms perform optimally. The proposed algorithms can be widely used in IoT systems with publish-subscribe model. Furthermore, the algorithms can also be adopted in other protocols such as Constrained Application Protocol (CoAP).

DoS attack detection method on application layer for publish-subscribe networks

Introduction: For the development of cyberphysical systems, new technologies and data transfer protocols are being developed, in order to reduce the energy costs of communication devices. One of the modern approaches to data transmission in cyberphysical systems is the publish-subscribe model, which is subject to a denial-of-service attack. Purpose: Development of a model for detecting a DoS attack implemented at the application level of publish-subscribe networks based on the analysis of their traffic using machine learning methods. Results: A model is developed for detecting a DoS attack, operating with three classifiers depending on the message type: connection, subscription, and publication. This approach makes it possible to identify the source of an attack. That can be a network node, a particular device, or a user account. A multi-layer perceptron, the random forest algorithm, and a support vector machine of various configurations were considered as classifiers. Training and test data sets were generated for the proposed feature vector. The classification quality was evaluated by calculating the F1 score, the Matthews correlation coefficient, and accuracy. The multilayer perceptron model and the support vector machine with a polynomial kernel and SMO optimization method showed the best values of all metrics. However, in the case of the support vector machine, a slight decrease in the prediction quality was detected when the width of the traffic analysis window was close to the longest period of sending legitimate messages from the training data set. Practical relevance: The results of the research can be used in the development of intrusion detection features for cyberphysical systems using the publish-subscribe model, or other systems based on the same approach

Development of Kafka Messaging System and its Performance Test Framework using Prometheus

In today’s era of internet, communication plays a vital role in every aspect of daily activity, as the number of internet users increases an enormous volume of data is generated. This motivates to develop and use a messaging system that collects and analyzes large volume of generated data. Kafka is a distributed messaging system based on publish-subscribe model with high throughput and fault-tolerant mechanism. Around 40% of fortune 500 companies use Kafka messaging system for processing data. Kafka is used to stream real-time data and it is also used to process the data received from IOT sensors. This paper discusses about the procedure for developing and deploying the Kafka messaging system into the working environment based on container technology. The secure communication is enabled by configuring the Kafka with two security mechanisms. The performance of the developed system is evaluated considering QoS parameters for different test scenarios using Prometheus tool.