Search

MQTT, a popular IoT messaging protocol, is frequently associated with numerous vulnerabilities, the majority of which are critical. Many IoT devices that utilize MQTT are susceptible to cyberattacks such as denial-of-service and buffer overflow. In this paper, we unveil a novel Denial of Service (DoS) attack in the MQTT protocol, referred to as Slow Subscribers, which has the potential to cause MQTT brokers to become single points of failure. Unlike existing MQTT DoS attacks, Slow Subscribers can occur on a single compromised node and could potentially disrupt a MQTT broker with minimal subscription permissions. We evaluated the reliability of Mosquitto and NanoMQ, two popular MQTT messaging brokers, to determine the effect of Slow Subscribers. According to the findings of our investigation, NanoMQ outperforms Mosquitto in response to the Slow Subscribers attack at QoS level 0. We also determine that the response to Slow Subscribers at QoS 2 is the worst for both broker implementations. In addition, the results of our experiments indicate that Eclipse Mosquitto achieves a higher rate of reliability than NanoMQ on cloud deployments whereas NanoMQ has proven to be well-suited for edge environments, especially edge IoT devices that require the use of QoS levels 0 and 1. Finally, we propose a Resilient Middleware for Message Queue Telemetry Transport (Remistry) framework that is capable of detecting misconfigurations while providing granular support of resource commitment errors, in particular the out-of-memory (OOM) problems for effectively mitigating the impact of Slow Subscribers attacks on MQTT brokers. [ABSTRACT FROM AUTHOR]

Internet of Things (IoT) paved the way for devices and machine communication using TCP/IP protocol. Lightweight and stateless communication is imperative especially in a situation requiring conservation of energy usage, e.g. wireless sensor network. Representational State Transfer (REST) API method is based on web communication protocol, Hyper-Text Transfer Protocol (HTTP), and is widely used in IoT messaging. Some of these protocols are DPWS, XMPP, MQTT, COaP, AMQP. Among these protocols, MQTT is the most preferred protocol and is expected to be the de facto messaging IoT standard. MQTT uses a publisher/subscriber model to facilitate messaging between devices making messaging lightweight. Nevertheless, there are a number of security issues due to the design of the protocol itself. Some of the issues are denial of service, identity spoofing, information disclosure, elevation of privileges and data tampering. These issues can be caused by both internal and external perpetrators. Researchers have proposed various security techniques and mechanisms to address these issues. Incorporation of security has added processing overhead to the devices and this will have a bearing on IoT devices that are powered by a battery. This issue has opened up new research challenges in making the protocols more lightweight and at the same time not compromising the level of security provided. [ABSTRACT FROM AUTHOR]

Middlewares are standard tools for modern software development in many areas, especially in robotics. Although such have become common for high-level applications, there is little support for real-time systems and low-level control. Therefore, µRT provides a lightweight solution for resource-constrained embedded systems, such as microcontrollers. It features publish–subscribe communication and remote procedure calls (RPCs) and can validate timing constraints at runtime. In contrast to other middlewares, µRT does not rely on specific transports for communication but can be used with any technology. Empirical results prove the small memory footprint, consistent temporal behavior, and predominantly linear scaling. The usability of µRT was found to be competitive with state-of-the-art solutions by means of a study.

Abstract Background The Internet of Things (IoT) enables the development of innovative applications in various domains such as healthcare, transportation, and Industry 4.0. Publish-subscribe systems enable IoT devices to communicate with the cloud platform. However, IoT applications need context-aware messages to translate the data into contextual information, allowing the applications to act cognitively. Besides, end-to-end security of publish-subscribe messages on both ends (devices and cloud) is essential. However, achieving security on constrained IoT devices with memory, payload, and energy restrictions is a challenge. Contribution Messages in IoT need to achieve both energy efficiency and secure delivery. Thus, the main contribution of this paper refers to a performance evaluation of a message structure that standardizes the publish-subscribe topic and payload used by the cloud platform and the IoT devices. We also propose a standardization for the topic and payload for publish-subscribe systems. Conclusion The messages promote energy efficiency, enabling ultra-low-power and high-capacity devices and reducing the bytes transmitted in the IoT domain. The performance evaluation demonstrates that publish-subscribe systems (namely, AMQP, DDS, and MQTT) can use our proposed energy-efficient message structure on IoT. Additionally, the message system provides end-to-end confidentiality, integrity, and authenticity between IoT devices and the cloud platform.

Security attacks on Cyber-Physical Systems with operations that involve Unmanned Aerial Vehicles (UAVs) are a matter of great concern due to their major impact in the deployed systems, and a deal-breaker for their utilization; if a system is not perceived as secure, either it will not be used or its capabilities will be underutilized, regardless of how good they could be. This happens with particular intensity in missions with UAVs, as they can be hacked to tamper with their collected data or taken away by unauthorized parties. Development of security countermeasures is extensive both in theoretical and practical implementations, but the integration of these measures can be difficult, and performance might be affected because of it. This manuscript puts forward a SEDIBLOFRA (Secure, Distributed, Blockchain-based Framework) for remote maneuvering of UAVs, based on several distributed systems technologies that pile up to provide complementary functionalities. Asymmetric cryptography encrypts the data. Publish/Subscribe communications offer a way to enhance data delivery. Finally, blockchain provides a way to keep all the transferred data in a redundant and immutable manner. The proposed framework is also extensible to other kinds of unmanned vehicles, like Unmanned Ground Vehicles or Autonomous Underwater Vehicles.

Background: The Internet of Things (IoT) enables the development of innovative applications in various domains such as healthcare, transportation, and Industry 4.0. Publish-subscribe systems enable IoT devices to communicate with the cloud platform. However, IoT applications need context-aware messages to translate the data into contextual information, allowing the applications to act cognitively. Besides, end-to-end security of publish-subscribe messages on both ends (devices and cloud) is essential. However, achieving security on constrained IoT devices with memory, payload, and energy restrictions is a challenge. Contribution: Messages in IoT need to achieve both energy efficiency and secure delivery. Thus, the main contribution of this paper refers to a performance evaluation of a message structure that standardizes the publish-subscribe topic and payload used by the cloud platform and the IoT devices. We also propose a standardization for the topic and payload for publish-subscribe systems. Conclusion: The messages promote energy efficiency, enabling ultra-low-power and high-capacity devices and reducing the bytes transmitted in the IoT domain. The performance evaluation demonstrates that publish-subscribe systems (namely, AMQP, DDS, and MQTT) can use our proposed energy-efficient message structure on IoT. Additionally, the message system provides end-to-end confidentiality, integrity, and authenticity between IoT devices and the cloud platform. [ABSTRACT FROM AUTHOR]

Multiagent Systems (MASs) have multiple different characteristics, such as autonomy, and asynchronous and social features, which make these systems difficult to understand. Thus, there is a lack of procedures guaranteeing that multiagent systems once implemented would behave as desired. Determining the reliability of such systems is further complicated by the fact that current agent-based approaches may also involve non-deterministic characteristics, such as learning, self-adaptation and self-organization (SASO). Nonetheless, there is a gap in the literature regarding the testing of systems with these features. This paper presents an approach based on metadata and the publish-subscribe paradigm to develop test applications that address the process of failure diagnosis in a self-organizing MAS. The novelty of the proposed approach involves its ability to test self-organizing MAS systems in the context of local and global behavior. To illustrate the use of this approach, we developed a self-organizing MAS system based on the Internet of Things (IoT), which simulates a set of smart street lights, and we performed functional ad-hoc tests. The street lights need to interact with each other in order to achieve the global goals of reducing energy consumption and maintaining the maximum value of visual comfort in illuminated areas. To achieve these global behaviors, the street lights develop local behaviors automatically through a self-organizing process based on machine-learning algorithms.

Decentralized Identifiers (DIDs) are new self-manageable means of authentication, which is currently under standardization by the World Wide Web Consortium (W3C). Closely related to DIDs, verifiable credentials (VCs) are another ongoing standardization effort (by the same W3C working group) that enables privacy-preserving and cryptographically secure proofs of attribute ownership. Both these approaches assume in their core an immutable decentralized registry (e.g., a blockchain, or a p2p network) in which critical meta-data is recorded. However, W3C’s standards do not specify how this registry is implemented, instead this is left as an open implementation choice. In this paper we design, implement, and evaluate a secure DID/VC registry service using the emerging paradigm of Information Centric Networking (ICN). In order to achieve our goal, we combine the decentralized nature, and the “lookup by name” property of ICN, with a secure mechanism for maintaining synchronized replicas of an item in multiple locations. Due to ICN’s inherent support for multicast and caching, our construction imposes small network overhead, and achieves low lookup times.

The content routing protocols for MANETs proposed to date require the flooding of content requests or link-state advertisements. The Adaptive Publish-subscribe Distance Vector (APDV) protocol is presented as an alternative. APDV combines routing to well-known directories using distance-vector signaling with publish-subscribe mechanisms to discover content. Named data objects (NDO) are published with directories, and consumers of content obtain routes to NDOs from those directories. Each node is covered dynamically by a minimum number of directories within a few hops. APDV is shown to be loop-free at every instant, to provide correct routes within a finite time, and to have a small route stretch. APDV is compared with representative protocols for routing to NDOs using link-state information and on-demand routing; the results show that APDV incurs orders of magnitude less control overhead in large wireless networks.

The publish/subscribe paradigm provides a loosely-coupled and scalable communication model for the large-scale IoT service systems, such as supervisory control and data acquisition (SCADA). Data confidentiality and service privacy are two crucial security issues for the publish/subscribe model deployed in different domains. The existing access control schemes for such model cannot address both the issues at the same time. In this paper, we propose a comprehensive access control framework (CACF) to bridge this gap. The design principle of the proposed framework is twofold: (a) a bi-directional policy matching scheme for protecting the privacy of IoT services; and (b) a fully homomorphic encryption scheme for encrypting published events to protect data confidentiality. We analyze the correctness and security of the CACF, moreover, we prototype CACF based on Apache ActiveMQ, an open source message broker, and evaluate its performance. The experimental results indicate that our security system meets the latency requirements for very high-quality SCADA services.

Security in the Internet of Things is a current hot topic and it may comprise different aspects such as confidentiality and integrity of personal data, as well as the authentication and the authorization to access smart objects that are spreading more and more in our every-day lives. In this work we focus on MQTT (Message Queue Telemetry Transport), a message-based communication protocol explicitly designed for low-power machine-to-machine communications and based on the publish-subscribe paradigm. First of all, we provide an accurate analysis of some of the most recent security solutions and improvements of MQTT found in the literature. Secondly, we describe in detail a novel secure solution, called MQTT-Auth, to protect specific topics in MQTT. This solution is based on the AugPAKE security algorithm for guaranteeing confidentiality, and onto two tokens which permit to authenticate the usage of a topic and to guarantee authorization in accessing a topic respectively. MQTT-Auth can also be easily extended to a hierarchical structure of topics and entities. Finally, we compare MQTT-Auth with some solutions for securing MQTT being present in the relevant literature, and we provide some details on how MQTT-Auth has been implemented and successfully tested.

The publish-subscribe programming model has been an alternative to the design of data-intensive distributed applications in many domains. Recently, this model has been ported to the domain of Multiprocessor Systems-on-Chips, in which applications must use the underlying Network-on-Chip communication infrastructure effectively due to restrictions on the architecture such as low power consumption and limited memory size. In such a scenario, the publish-subscribe model fulfills some of these requirements while providing high-level access to the network hardware to programmers, thus contributing to software quality. However, the publish-subscribe model relies on a single process dedicated to orchestrating the communication at the application level, the broker. Should a broker process crash, the communication between associated nodes may experience delays, downtime, or even inconsistent data. In extreme cases, communication is definitively ruined. Thus, a recovery strategy for brokers in the publish-subscribe model becomes crucial when the application has safety requirements. In this work, we extend a publish-subscribe protocol to add redundancy to brokers' sensitive data. Besides, we provide a recovery protocol to recover brokers in case of a failure. We also provide analytical models to estimate the communication overhead of our approach. We validate our approach in two distinct MPSoC platforms. The results show that our approach inserts a small memory footprint to the system while providing minimal system downtime during recovery. [ABSTRACT FROM AUTHOR]

Intelligent environments combine physical spaces with pervasive computing technologies to provide context-aware, people-centred, and ambient-assisted strengthening of the activities of inhabitants in their daily lives. We propose a system to support mountain rescuers in their daily tasks. The system explores the activities of the mountain hikers, by analyzing data gathered from wireless sensor and mobile networks which cooperatively monitor an environment. The system utilizes message streaming brokers to transport data within the system. Massive amounts of data are pre-processed into formats, to allow analysis by logical SAT solvers. Pairing brokers and solvers as advanced technologies is challenging. The processed data contains valuable information about human activities and context situations, providing a basis for context reasoning and prediction. The resulting pro-active, hierarchical, and real-time smart decisions provide warnings about threatening situations, making tourists' stays safer. This combination of acting on predicted context, data streaming platforms, and logical solvers is a novel and innovative aspect of this approach. This strictly modeled system, intensively experimented, allows us to bridge the gap between the low-level observations produced by mobile and sensor networks and the high level smart services which support human activities.

Message Queuing Telemetry Transport (MQTT) is a widespread protocol for topic-based publish-subscribe architectures supporting IoT and social networks applications. MQTT brokers are logical entities that couple publishers and subscribers and play a critical role in such architectures. MQTT brokers can be implemented either as standalone servers or in a cluster configuration. Clusters of brokers increase reliability, availability and overall performance, since operations can be highly parallelized among the brokers that form the cluster. The load-balancing strategy in a cluster usually consists in connecting an incoming client to a randomly selected broker. This random-attach strategy, it is very simple, but generates a significant amount of inter-broker traffic, as we demonstrate through theoretical and experimental evaluations. Inter-broker traffic is an overhead for the system and it increases the CPU load of the brokers, compromising the scaling behavior of the whole cluster. Indeed, we found that a linear increase of the number of brokers forming a cluster does not necessarily provide an equivalent linear gain in performance, and such a scaling penalty can be surprisingly significant, in the order of 40%. To solve this issue and improve performance, we propose a novel load-balancing strategy that envisages the use of multiple MQTT sessions per client to reduce inter-broker traffic and that can be implemented by means of a greedy algorithm. We show feasibility and effectiveness of our strategy for IoT and social-network applications by means of simulations and real measurements. The resulting scaling penalty is reduced to 10%. [ABSTRACT FROM AUTHOR]

Copyright of Journal of Engineering Sciences & Information Technology is the property of Arab Journal of Sciences & Research Publishing (AJSRP) and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

Fog computing dramatically extends the cloud computing to the edge of the network and admirably solves the problem that the brokers (in publish-subscribe system) generally lack of computing capacity and energy power. However, brokers may be disguised, hacked, sniffed, and corrupted. The traditional security technology cannot protect the system privacy when facing a possible collusion attack. In this paper, we propose a privacy-preserving content-based publish/subscribe scheme with differential privacy in fog computing context, named PCP, where the fog nodes act as the brokers. Specifically, PCP firstly utilizes the U-Apriori algorithm to mine the top-K frequent itemsets (i.e., the attributes) from uncertain data sets, then applies the exponential and Laplace mechanism to ensure the differential privacy, and the broker uses the mined top-K itemsets to match appropriate publisher and subscriber finally. Security analysis shows that the PCP can guarantee differential privacy in theory. To evaluate the performance of PCP, we carry out experiments with real-world scenario data sets. The experimental results show that PCP efficiently achieves the tradeoff between the system cost and the privacy demand.

Many data processing systems are naturally modeled as pipelines, where data flows though a network of computational procedures. This representation is particularly suitable for computer vision algorithms, which in most cases possess complex logic and a big number of parameters to tune. In addition, online vision systems, such as those in the industrial automation context, have to communicate with other distributed nodes. When developing a vision system, one normally proceeds from ad hoc experimentation and prototyping to highly structured system integration. The early stages of this continuum are characterized with the challenges of developing a feasible algorithm, while the latter deal with composing the vision function with other components in a networked environment. In between, one strives to manage the complexity of the developed system, as well as to preserve existing knowledge. To tackle these challenges, this paper presents EPypes, an architecture and Python-based software framework for developing vision algorithms in a form of computational graphs and their integration with distributed systems based on publish-subscribe communication. EPypes facilitates flexibility of algorithm prototyping, as well as provides a structured approach to managing algorithm logic and exposing the developed pipelines as a part of online systems.

Secure authentication while communicating data between sender and receiver nodes is a key concept when providing Internet of Things as a service. Hash algorithms can provide such an authentication mechanism for IoT based applications. The most recent secure hash algorithm technique standardized by the NIST is SHA-3. SHA-3 is fully apt in ensuring authentication for a sender and receiver transaction. A novel signature generating technique based on SHA-3 is presented in the paper. Two of the popular IoT communication models of publish subscribe and request response are examined under this authentication scheme. The sender generates a unique hash code for the data that it is about to send. This hash code serves as the authenticating token for the transaction. Mechanisms for the sender receiver interaction are built into the program codes in both the simulated communication models. The system architecture also manages interaction of the receiver with the cloud. This interaction ensures proper authentication through the mechanisms and api(s) provided by the cloud service providers, and these mechanisms are also integrated into the simulation. Both the cloud services used in the system architecture, i.e. cloud messaging as a service, and cloud database as a service ensure that the sender's identity is verified. In this way a blanket authentication system is set up for the aforementioned IoT architectures. [ABSTRACT FROM AUTHOR]

An Internet of Things (IoT) middleware can solve interoperability problem among "things" in IoT infrastructure by collecting data. However, the sensor nodes' data that is collected by the middleware cannot be directly delivered to cloud applications since the sensor nodes and the middleware are located in intranet. A solution to this problem is an Internet Gateway Device (IGD) that retrieves data from the middleware in intranet then forwards them to cloud applications in the internet. In this study, an IGD based on cellular network is proposed to provide wide-coverage internet connectivity. Two test scenarios were conducted to measure delay and throughput between the IGD and the cloud application; using data from DHT22 sensor and image sensor respectively. The results of the first test scenario using DHT22 sensor show that the average delay is under 5 seconds and the maximum throughput is 120 bps, while the second one using image sensor concludes that the average delay is 595 seconds and the maximum throughput is 909 bps. [ABSTRACT FROM AUTHOR]

We propose a holistic Model‐Based Protocol Specification (MBPS) framework. Standards, procedures, and protocols are important anchors for interconnected systems: they facilitate the connectivity of billions of devices around the world, commodify advanced technologies and solutions, and enable efficient services involving trillions of transactions in aviation, medicine, e‐commerce, transportation, infrastructure, and other domains. Domain protocols allow for conventional interactions within a domain among ecosystem entities and humans (eg, airline ticketing, financial transactions, etc). Protocol specifications must be formal, consistent, and verifiable. Nevertheless, most current standard protocols are text‐based, unverifiable, and often inconsistent with themselves and with other standards. Text‐based standards are difficult to manage, track, control, and adopt. MBPS includes three critical enablers: a modeling language, a modeling process, and a model‐supported standardization process. This paper employs Object‐Process Methodology (OPM), a model‐based systems engineering framework, endorsed as ISO‐19450, for modeling and simulation of the generic protocol specification process and for two examples: (a) a Kerberos authentication protocol revision based on a previous Kerberos model and on a recently discovered vulnerability and (b) a domain‐specific Publish—Subscribe protocol application for selective information distribution. [ABSTRACT FROM AUTHOR]

Communications systems and protocols are becoming second nature to utilities operating distribution systems. Traditionally, centralized communication approaches are often used, while recently in microgrid applications, distributed communication, and control schema emerge offering several advantages such as improved system reliability, plug-and-play operation, and distributed intelligence. Still, operation and control of microgrids including distributed communication schema have been less of a discussion in the literature. To address the challenge of multiple-inverter microgrid synchronization, a publish-subscribe protocol based, data distribution service, communication schema for microgrids is proposed. The communication schema is discussed in details for individual devices such as generators, photovoltaic systems, energy storage systems, microgrid point of common coupling switch, and supporting applications. Finally, islanding and resynchronization of a microgrid are demonstrated on a test-bed utilizing this schema. [ABSTRACT FROM AUTHOR]

Security in the Internet of Things is a current hot topic and it may comprise different aspects such as confidentiality and integrity of personal data, as well as the authentication and the authorization to access smart objects that are spreading more and more in our every-day lives. In this work we focus on MQTT (Message Queue Telemetry Transport), a messagebased communication protocol explicitly designed for low-power machine-to-machine communications and based on the publishsubscribe paradigm. First of all, we provide an accurate analysis of some of the most recent security solutions and improvements of MQTT found in the literature. Secondly, we describe in detail a novel secure solution, called MQTT-Auth, to protect specific topics in MQTT. This solution is based on the AugPAKE security algorithm for guaranteeing confidentiality, and onto two tokens which permit to authenticate the usage of a topic and to guarantee authorization in accessing a topic respectively. MQTT-Auth can also be easily extended to a hierarchical structure of topics and entities. Finally, we compare MQTT-Auth with some solutions for securing MQTT being present in the relevant literature, and we provide some details on how MQTT-Auth has been implemented and successfully tested. [ABSTRACT FROM AUTHOR]

In recent years we have been assisting a radical change in the way devices are connected to the Internet. In this new scope, the traditional TCP/IP host-centric network fails in large-scale mobile wireless distributed environments, such as IoT scenarios, due to node mobility, dynamic topologies and intermittent connectivity, and the Information-Centric Networking (ICN) paradigm has been considered the most promising candidate to overcome the drawbacks of host-centric architectures. Despite bringing efficient solutions for content distribution, the basic ICN operating principle, where content must always be associated with an interest, has serious restrictions in IoT environments in relation to scale, performance, and naming, among others. To address such drawbacks, we are presenting ndnIoT-FC, an NDN-based architecture that respects the ICN rules but offers special treatment for IoT traffic. It combines efficient hybrid naming with strategies to minimize the number of interests and uses caching strategies that virtually eliminates copies of IoT data from intermediate nodes. The ndnIoT-FC makes available new NDN-based application-to-application protocol to implement a signature model operation and tools to manage its life cycle, following a publisher-subscriber scheme. To demonstrate the versatility of the proposed architecture, we show the results of the efficient gathering of environmental information in a simulation environment considering different and distinct use cases.

Data Distribution Service (DDS) has emerged as a potential solution for data communication challenges in smart grids. DDS is designed to support quality communication for large scale real-time systems through a wide range of QoS policies. However, a smart grid involves various types of communication applications running on different computing environments. Some environments have limited computing resources such as small memory and low performance, which makes it difficult to accommodate DDS. In this paper, we present a feature-based approach for tailoring DDS to configure lightweight DDS by selecting only the necessary features for the application in consideration of the resource constraints of its running environment. This allows DDS to serve as a uniform communication middleware across the smart grid, which is critical for interoperability. We analyze DDS in terms of features and design them using Unified Modeling Language (UML) and Object Constraint Language (OCL) based on inheritance and overriding. We define a formal notion of feature composition to build DDS configurations. We implemented the approach in OpenDDS and demonstrate its application to different application environments. We also experimented the approach for the efficiency of configured DDS in terms of resource utilization. The results show that configured DDS is viable for efficient and quality data communication for applications that run on an environment with limited computing capability.