Disclosure control in multi-domain publish/subscribe systems

Abstract

Publish/subscribe is an effective paradigm for event dissemination over wide-area systems. However, there is tension between the convenience of open information delivery, and the need to protect data from unauthorised access. Publish/subscribe security models tend to focus on protecting the client API, or encrypting events and managing disclosure through key distribution. However, some application environments require more stringent, fine-grained controls governing precisely the data disclosed and transmitted given particular circumstances. In this paper, we present Interaction Control, a policy model that overlays context-aware, point-to-point (hop-level) controls onto a publish/subscribe network. The approach is unique as it allows granular control over i) the construction of the dissemination network, and ii) the information flows within the network. Interaction Control was designed considering legal obligations, to enable those responsible for information to transmit data on a need-to-know basis. Security policies set the bounds for communication, enforced only where necessary at specific points of the publish/subscribe process, to provide control while retaining the efficiency benefits of the paradigm. We present implementation details and results showing that any security overheads must be considered with respect to the overall network load.

On middleware for emerging health services

“…the selfmanaged cells of Ponder2 [37], the grouping of agents with trusted controllers [38], and/or other constraints, e.g. a particular form of interaction [39][40][41] (see §5.5). Clearly, policy specification and enforcement specifics are relevant; however, the nature of pervasive healthcare requires systems to be open and flexible.…”

“…With respect to communication, there is some work that considers integrating policy into pub/sub infrastructure [40,41,48], for enforcement throughout a broker network. Pub/sub, however, is inappropriate as the sole means of communication for emerging healthcare, as it provides only for stream-based interactions (request-reply is cumbersome), and the layer of indirection (event-bus) favours anonymous interactions through a shared communication channel, which is inappropriate for healthcare as it raises identity, security and policy enforcement concerns.…”

Policy enforcement within emerging distributed, event-based systems

“…A domain refers to a group of resources under common administrative control [28]. Domains are logical constructs, the components of which may, for instance, be in the patient home, some may be mobile (e.g.…”

“…For example, in Ponder2 [31] there are self-managed cells and in LGI there are trusted controllers [20]. There may also be restrictions related to a particular form of interaction [28,33,19]. In contrast for the emerging middleware applications targeted in this work we try to avoid imposing particular constraints on how applications need to be modelled or designed.…”

“…The middleware we have developed supports both request/reply and stream-based communication, so as to limit application designs as little as possible. While there has been research into integrating policy directly into pub/sub infrastructure [33,28,29], pub/sub is not going to suffice as the only communication paradigm: request-reply is necessary for various control actions, but is cumbersome to implement using pub/ sub. Using an event-bus style routing approach has good support for anonymous (or at least decoupled) interactions between components, but this feature may cause security and enforcement difficulties.…”