Security in Multi-domain Event-based SystemsSicherheit in ereignis-basierten Mehrdomänensystemen

Abstract

Summary Event-based systems give the potential for active information sharing. The event-based paradigm, if used for event transport, provides loose coupling between components, many-to-many communication and mutual anonymity of event producers and event consumers. This communication style has been adopted enthusiastically for convenience of programming; particularly for financial processing, healthcare applications and sensor-based systems. But some data is sensitive, and its visibility must be controlled carefully for personal and legal reasons. Our research projects have explored this space for some time, investigating application domains in which the event-based paradigm is appropriate yet where security is an issue. We discuss security issues for multi-domain, event-based systems, considering the requirements of applications and the risk associated with failure. We provide an overview of the state-of-the-art in secure event-based systems: research already carried out, work in progress and issues still to be addressed. This is of relevance to emerging largescale systems required by government and public bodies for domains such as healthcare, police, transport and environmental monitoring.Zusammenfassung Ereignis-

Enforcing End-to-End Application Security in the Cloud

“…When health records are exchanged, long-term data security is critical-for a lifetime or more. We have adapted distributed event-based systems to this challenge, by tightly integrating RBAC with publish/subscribe messaging [13,23] along the lines suggested in section 3. Organisational security policy dictates which data flows are allowed; we assume that each domain has at least one trusted event broker node for secure exchange of events, and uses point-to-point communication between domains.…”