Abstract:<p>In recent years, with the rapid development of smart city, prevalent pub/sub (publish/subscribe) streaming systems have been increasingly employed as upstream middleware layer in multi-tenant edge clouds, and feed large volume of data gathered from IoT devices of different tenants into downstream systems (e.g., data analytics and warehouse). A shared tenancy model where multiple untrusted applications or tenants utilize the same pub/sub system is generally exploited in edge cloud, which poses crucial challenges including privacy-sensitive data/metadata access threat and critical metadata modification by unauthorized tenants. A centralized monitoring node is invariably adopted in existing security strategies (such as ACL, TLS), which causes the pub/sub streaming model vulnerable to external malicious attacks and single point failure.</p><p>In this paper, inspired by outstanding features of blockchain including tamper-resistance, decentralization, strong consistency, and traceability, we propose BPS, a general and decentralized Blockchain-enhanced Pub/Sub communication model for multi-tenant edge cloud, to redesign pub/sub system internal security mechanisms. Specifically, by exploiting blockchain technology, BPS can detect the illegal operations and behaviors from both malicious tenants and untrusted publishers or subscribers. BPS directly leverages Merkel Hash Tree (MHT) of blockchain to verify the integrity of critical and confidential metadata. Regarding authorization, BPS introduces smart-contract-enabled fine-grained control over partition topic-classified messages by storing access control list (ACL) into an append-only blockchain ledger. Additionally, an incentive mechanism is employed in BPS to reward honest publishers and subscribers. We implement BPS prototype based on Kafka and EoS blockchain. Our security analysis and extensive experiments demonstrate that BPS outperforms the state-of-the-art pub/sub streaming system Kafka in security with minimal performance overhead.</p>

Secure Cloud-Assisted Data Pub/Sub Service With Fine-Grained Bilateral Access Control

The Service of Secure Data Publication and Subscription on Cloud Platforms

Verifiable Cloud-Based Data Publish-Subscribe Service with Hidden Access Policy

TRA-PS: Accountable Data Pub/Sub Service with Fast and Fine-Grained Controllable Subscription

A Privacy-Preserving Attribute-Based Access Control Scheme.

BPS: A reliable and efficient pub/sub communication model with blockchain-enhanced paradigm in multi-tenant edge cloud

Combining Data Owner-Side and Cloud-Side Access Control for Encrypted Cloud Storage.

Catch Me if You Can: A Secure Bilateral Access Control System with Anonymous Credentials

An Attribute-Based Controlled Collaborative Access Control Scheme for Public Cloud Storage.

An efficient fine-grained data access control system with a bounded service number

EACS: an Efficient Access Control Scheme for Electronic Publishing in Cloud Computing

Achieving Secure, Scalable, and Fine-grained Data Access Control in Cloud Computing

Efficient and Secure Attribute-Based Access Control with Identical Sub-Policies Frequently Used in Cloud Storage

Revocable and Privacy-Preserving Bilateral Access Control for Cloud Data Sharing

A Cloud Access Security Broker Based Approach for Encrypted Data Search and Sharing.

RAAC: Robust and Auditable Access Control with Multiple Attribute Authorities for Public Cloud Storage

Private Set Intersection with Authorization over Outsourced Encrypted Datasets.

MagikCube: Securing Cross-Domain Publish/Subscribe Systems with Enclave

P2E: Privacy-preserving and Effective Cloud Data Sharing Service

Server-Aided Bilateral Access Control for Secure Data Sharing with Dynamic User Groups.

An Efficient Privacy-Preserving Publish-Subscribe Service Scheme for Cloud Computing