Publicação
Safeguarding from abuse by IoT vendors: edge messages verification of cloud-assisted equipment
| Resumo: | The fact that most IoT solutions are provided by 3rd-parties, along with the pervasiveness of the collected data, raises privacy and security concerns. There is a need to verify which data is being sent to the 3rd-party, as well as preventing those channels from becoming an exploitation avenue. We propose to use existing API definition languages to create contracts which define the data that can be transmitted, in what format, and with which constraints. To verify the compliance with these contracts, we propose a converging "Multi-Access Edge Computing" architecture which validates RESTalike API requests/responses against a Swagger schema. We deal with encrypted traffic using an SFC-enabled Man-in-the-Middle, allowing us to do verifications in "real-time". We devised a Proof of Concept and shown that we were able to detect (and stop) contract violations. |
|---|---|
| Autores principais: | Cunha, Vítor A. |
| Outros Autores: | Silva, Eduardo da; Carvalho, Marcio B. de; Corujo, Daniel; Barraca, João P.; Gomes, Diogo; Schaeffer-Filho, Alberto E.; Santos, Carlos R. P. dos; Granville, Lisandro Z.; Aguiar, Rui L. |
| Ano: | 2019 |
| País: | Portugal |
| Tipo de documento: | capítulo de livro |
| Tipo de acesso: | acesso restrito |
| Instituição associada: | Universidade de Aveiro |
| Idioma: | inglês |
| Origem: | RIA - Repositório Institucional da Universidade de Aveiro |
| _version_ | 1877769129445818368 |
|---|---|
| author | Cunha, Vítor A. |
| author2 | Silva, Eduardo da Carvalho, Marcio B. de Corujo, Daniel Barraca, João P. Gomes, Diogo Schaeffer-Filho, Alberto E. Santos, Carlos R. P. dos Granville, Lisandro Z. Aguiar, Rui L. |
| author2_role | author author author author author author author author author |
| author_facet | Cunha, Vítor A. Silva, Eduardo da Carvalho, Marcio B. de Corujo, Daniel Barraca, João P. Gomes, Diogo Schaeffer-Filho, Alberto E. Santos, Carlos R. P. dos Granville, Lisandro Z. Aguiar, Rui L. |
| author_role | author |
| country_str | PT |
| creators_json_txt | [{\"Person.name\":\"Cunha, Vítor A.\"},{\"Person.name\":\"Silva, Eduardo da\"},{\"Person.name\":\"Carvalho, Marcio B. de\"},{\"Person.name\":\"Corujo, Daniel\"},{\"Person.name\":\"Barraca, João P.\"},{\"Person.name\":\"Gomes, Diogo\"},{\"Person.name\":\"Schaeffer-Filho, Alberto E.\"},{\"Person.name\":\"Santos, Carlos R. P. dos\"},{\"Person.name\":\"Granville, Lisandro Z.\"},{\"Person.name\":\"Aguiar, Rui L.\"}] |
| datacite.creators.creator.creatorName.fl_str_mv | Cunha, Vítor A. Silva, Eduardo da Carvalho, Marcio B. de Corujo, Daniel Barraca, João P. Gomes, Diogo Schaeffer-Filho, Alberto E. Santos, Carlos R. P. dos Granville, Lisandro Z. Aguiar, Rui L. |
| datacite.date.Accepted.fl_str_mv | 2019-04-08T00:00:00Z |
| datacite.date.available.fl_str_mv | 2021-04-15T16:12:34Z |
| datacite.date.embargoed.fl_str_mv | 2021-04-15T16:12:34Z |
| datacite.rights.fl_str_mv | http://purl.org/coar/access_right/c_16ec |
| datacite.titles.title.fl_str_mv | Safeguarding from abuse by IoT vendors: edge messages verification of cloud-assisted equipment |
| dc.creator.none.fl_str_mv | Cunha, Vítor A. Silva, Eduardo da Carvalho, Marcio B. de Corujo, Daniel Barraca, João P. Gomes, Diogo Schaeffer-Filho, Alberto E. Santos, Carlos R. P. dos Granville, Lisandro Z. Aguiar, Rui L. |
| dc.date.Accepted.fl_str_mv | 2019-04-08T00:00:00Z |
| dc.date.available.fl_str_mv | 2021-04-15T16:12:34Z |
| dc.date.embargoed.fl_str_mv | 2021-04-15T16:12:34Z |
| dc.format.none.fl_str_mv | application/pdf |
| dc.identifier.none.fl_str_mv | http://hdl.handle.net/10773/31192 |
| dc.language.none.fl_str_mv | eng |
| dc.publisher.none.fl_str_mv | IEEE |
| dc.rights.none.fl_str_mv | http://purl.org/coar/access_right/c_16ec |
| dc.title.fl_str_mv | Safeguarding from abuse by IoT vendors: edge messages verification of cloud-assisted equipment |
| dc.type.none.fl_str_mv | http://purl.org/coar/resource_type/c_3248 |
| description | The fact that most IoT solutions are provided by 3rd-parties, along with the pervasiveness of the collected data, raises privacy and security concerns. There is a need to verify which data is being sent to the 3rd-party, as well as preventing those channels from becoming an exploitation avenue. We propose to use existing API definition languages to create contracts which define the data that can be transmitted, in what format, and with which constraints. To verify the compliance with these contracts, we propose a converging "Multi-Access Edge Computing" architecture which validates RESTalike API requests/responses against a Swagger schema. We deal with encrypted traffic using an SFC-enabled Man-in-the-Middle, allowing us to do verifications in "real-time". We devised a Proof of Concept and shown that we were able to detect (and stop) contract violations. |
| dirty | 0 |
| eu_rights_str_mv | restrictedAccess |
| format | bookPart |
| id | ria_eb85668b357d314d5a7487db917775ec |
| identifier.url.fl_str_mv | http://hdl.handle.net/10773/31192 |
| inst_facet_str | urn:organizationAcronym:ua{{{_:::_}}}Universidade de Aveiro |
| instacron_str | ua |
| institution | Universidade de Aveiro |
| instname_str | Universidade de Aveiro |
| language | eng |
| network_acronym_str | ria |
| network_name_str | RIA - Repositório Institucional da Universidade de Aveiro |
| oai_identifier_str | oai:ria.ua.pt:10773/31192 |
| organization_str_mv | urn:organizationAcronym:ua |
| person_str_mv | Cunha, Vítor A. Silva, Eduardo da Carvalho, Marcio B. de Corujo, Daniel Barraca, João P. Gomes, Diogo Schaeffer-Filho, Alberto E. Santos, Carlos R. P. dos Granville, Lisandro Z. Aguiar, Rui L. |
| publishDate | 2019 |
| publisher.none.fl_str_mv | IEEE |
| repo_facet_str | urn:repositoryAcronym:ria{{{_:::_}}}RIA - Repositório Institucional da Universidade de Aveiro |
| reponame_str | RIA - Repositório Institucional da Universidade de Aveiro |
| repository_id_str | urn:repositoryAcronym:ria |
| service_str_mv | urn:repositoryAcronym:ria |
| spelling | pt_PTThe fact that most IoT solutions are provided by 3rd-parties, along with the pervasiveness of the collected data, raises privacy and security concerns. There is a need to verify which data is being sent to the 3rd-party, as well as preventing those channels from becoming an exploitation avenue. We propose to use existing API definition languages to create contracts which define the data that can be transmitted, in what format, and with which constraints. To verify the compliance with these contracts, we propose a converging "Multi-Access Edge Computing" architecture which validates RESTalike API requests/responses against a Swagger schema. We deal with encrypted traffic using an SFC-enabled Man-in-the-Middle, allowing us to do verifications in "real-time". We devised a Proof of Concept and shown that we were able to detect (and stop) contract violations.application/pdfengIEEEpt_PTSafeguarding from abuse by IoT vendors: edge messages verification of cloud-assisted equipmentCunha, Vítor A.Silva, Eduardo daCarvalho, Marcio B. deCorujo, DanielBarraca, João P.Gomes, DiogoSchaeffer-Filho, Alberto E.Santos, Carlos R. P. dosGranville, Lisandro Z.Aguiar, Rui L.Handlehttp://hdl.handle.net/10773/311922021-04-15T16:12:34Z2019-04-08T00:00:00Z2019-04-08http://purl.org/coar/access_right/c_16ecrestricted access338887 byteshttp://purl.org/coar/access_right/c_16ecapplication/pdffulltexthttps://ria.ua.pt/bitstream/10773/31192/1/08717812.pdfliteraturehttp://purl.org/coar/resource_type/c_3248book part |
| spellingShingle | Safeguarding from abuse by IoT vendors: edge messages verification of cloud-assisted equipment Cunha, Vítor A. |
| status | SINGLETON |
| title | Safeguarding from abuse by IoT vendors: edge messages verification of cloud-assisted equipment |
| title_full | Safeguarding from abuse by IoT vendors: edge messages verification of cloud-assisted equipment |
| title_fullStr | Safeguarding from abuse by IoT vendors: edge messages verification of cloud-assisted equipment |
| title_full_unstemmed | Safeguarding from abuse by IoT vendors: edge messages verification of cloud-assisted equipment |
| title_short | Safeguarding from abuse by IoT vendors: edge messages verification of cloud-assisted equipment |
| title_sort | Safeguarding from abuse by IoT vendors: edge messages verification of cloud-assisted equipment |
| url | http://hdl.handle.net/10773/31192 |
| visible | 1 |
Atividades financiadas
Não foram encontrados projetos financiados.