LUCON: Data Flow Control for Message-Based IoT Systems

Abstract

Today's emerging Industrial Internet of Things (IIoT) scenarios are characterized by the exchange of data between services across enterprises. Traditional access and usage control mechanisms are only able to determine if data may be used by a subject, but lack an understanding of how it may be used. The ability to control the way how data is processed is however crucial for enterprises to guarantee (and provide evidence of) compliant processing of critical data, as well as for users who need to control if their private data may be analyzed or linked with additional information -a major concern in IoT applications processing personal information. In this paper, we introduce LUCON, a data-centric security policy framework for distributed systems that considers data flows by controlling how messages may be routed across services and how they are combined and processed. LUCON policies prevent information leaks, bind data usage to obligations, and enforce data flows across services. Policy enforcement is based on a dynamic taint analysis at runtime and an upfront static verification of message routes against policies. We discuss the semantics of these two complementing enforcement models and illustrate how LUCON policies are compiled from a simple policy language into a first-order logic representation. We demonstrate the practical application of LUCON in a realworld IoT middleware and discuss its integration into Apache Camel. Finally, we evaluate the runtime impact of LUCON and discuss performance and scalability aspects.

A Systematic Survey of Industrial Internet of Things Security: Requirements and Fog Computing Opportunities

“…Based on their observations, they propose some design patterns that can help protect data flow already in the design stage. Schütte and Brost [164] state that data flow enforcement is a requirement in certain contexts, and propose a policycontrolled data flow control framework capable of monitoring messages between entities both statically and at run-time. This allows users to not just specify access policies, but also to state how data elements are allowed to be processed by the system.…”

“…A Fog node can set up and maintain highly secure, authenticated channels with remote parties, potentially alleviating some of the challenges involved in designing lightweight Edge devices that need to interact with these parties, as they only need to concern themselves with secure communication with the Fog node. If the Fog node additionally has the ability to access the message content of traffic passing through it, it can enforce data flow policies, e.g., as described in [164], allowing fine-grained data security mechanisms on top of encryption techniques.…”

IoT Cloud Security Review

“…However, the more flows there are, the more attacking vectors the IoT cloud systems face. For more extensive data flow analysis of IoT cloud applications, we refer to [47,89,98,103].…”

Detecting Dynamic Security Threats in Multi-Component IoT Systems

“…Here, a central auditor collects information from contributing audit hooks, combines the information to synthesize an analysis to determine if the composition is meeting its service requirements (or service levels), and then alerts stakeholders if the constraints are not met [22]. Others in the IoT MCA research community have highlighted audit hooks as options for IoT systems [23], but to our knowledge no frameworks make wide usage of audit hooks to integrate data across multiple disparate components and differing abstractions in IoT architectures (e.g. data arising from functional execution of code on smartphones, connected webservices, and the IoT device hardware).…”