Bhuban panthee
A data protection model for Fog Computing
Introduction
Fog computing enables more processing tasks to be performed at the network edge before
being moved to the core network or centralized clouds. Decisions shall be made by edge devices
rather than being submitted and received from clouds. This leads to more efficient process and
the ability to react more quickly to events. With the potential for billions of IoT devices creating
data, data management becomes an issue at the edge network since it fails in providing adequate
bandwidths for all of data to be transferred through the network. Architectures for fog are,
however, in the early stage of being defined with open issues for the current research [1]. Fog
resources are structured by the large number of physical devices in various locations and
different type of communication and connections. Nevertheless, fog devices frequently change
their locations and may request or provide nearby computing resources for faster responses.
Thus, provisioning computing resources locally and allocating into regions users shall shorten
the response time and enable adequately resource distributions. In fact, a location service also
needs to be proposed to address frequently changes of fog devices’ locations.
objectives
Region-Based Trust-Aware (RBTA) model for trust translation among fog nodes of
regions
To introduce a Fog-based Privacy-aware Role Based Access Control (FPRBAC) for
access control at fog nodes
To develop a mobility management service to handle changes of users and fog devices’
locations.
Scope of the case study
The scope of the case study is to introduce the new concept of “Region” where users, fog
nodes, and fog devices are allocated, and a protocol to establish trust agreements among regions;
and introduce a mobility service for location registration, which provides efficiently location
services for fog devices and enables users deploying applications with high mobility; as well as
design a fog privacy role based access control to grant users’ permission and authorize requests
based on assigned roles that enables system to detect attacks based on the audit records.
Literature Review
Fog computing has become a computing model for providing real-time computing services
and storage. However, few research efforts have focused on security issues which existed
intrinsically in highly dynamic computing services. Clinton [4] proposed a policy-driven security
management framework for fog computing which secures collaboration and enables
interoperability of user-resources. Specifically, the proposed policy management mechanism
supports not only virtual component interaction but also physical component interaction
including fog nodes and fog instances communicating with physical devices and cloud data
centers. The defined policies have focused on collaboration among components in fog computing
based on policy modules. However, there is no attempt to protect resources and preserve user
privacy. In fact, role-base access control was not used to define and confine the access rights of
sub-systems and components in this multi-user environment. Chen [2] proposed framework with
Cloud-based Privacy-aware Role Based Access Control (CPRBAC). CPRBAC extends
traditional Role Based Access Control model and include additional components such as
Organizations, Conditions, Obligations and Purposes. The model, however, fails to provide low
sensitive-latency verification as it is at cloud-based authorizing. Enhancing low-latency services
and improving performance were studied in [5, 6], where trade-off performance approaches
between fog and cloud, and allocating fog resources to applications were carried out.
Nevertheless, these researches did not focus on security concerns in implementing fog systems.
Consequently, users find it difficult to adopt fog computing since the adversaries may exploit the
vulnerability to compromise the users’ sensitive data. Studies related to potential security and
privacy problems in fog computing [7, 8] have been investigated to identify types of attack on
users’ data. Authors have raised some potential attacks such as man-in-the-middle attack,
intrusion detection, malicious detection, and malicious Fog. Nevertheless, the lack of security
approaches in fog computing prevents users from adopting fog computing since the adversaries
may exploit the vulnerability to compromise the users’ sensitive data.
Method
Regarding fog-based region data protection in the present of an adversary as follows: 1) fog
devices integrity: technical and non-technical approaches to prevent such fog devices
tampering have been taken to prevent the issues of device tampering to regions; 2) physical
security: fog devices are owned by both users and service providers. These devices can be
physically observed, enforced and verified through known best practice on duty management
by organizations. This assumption is important for building high-level hardware and software
security guarantees for the components of fog-based region infrastructure; 3) cryptographic
security: we assume symmetric and public-key encryption schemes are semantically secure
and that adversary cannot obtain plain text of encrypted data when it is sent and received by
fog devices, and that the message authentication code algorithm correctly verifies message
integrity and authenticity; 4) defined policies: defined policies correctly authorize valid
requests associated with users, fog nodes, fog devices and operations. The adversary cannot
modify defined policies to grant and bypass FBRBAC by their own permissions.
Analysis
This paper focus on providing a data protection model which allows users to access securely
resources based on assigned roles. The new features of our proposed model include: a region-
based trust component to deal with new joined devices coming from other regions; FPRBAC for
verification and authorization; Mobility management to deal with changes of fog devices’
location, tracing, tracking, and triggering an alarm on any operation, data or policy violations.
Figure 1 depicts the model and its three core components: 1) the Region-Based Trust-Aware
component; 2) Fog-Base Privacy-Aware Role Based Access Control; and 3) the mobility
management component. These components will be described in the next subsections.
Fig. 1. The design of data protection framework for fog computing
Algorithm 1. Fog-Based Region verification algorithm Input: A set RQ of requests to
access the data with parameters.
Output: granted or denied requests
for each request r in RQ do
if r.region_id exists in Trust database then
[Link] = true // Request is trusted and passed to FPRBAC
else
trust_establishment(r) // Establish a trust relationship
end if
result = verify_FPRBAC(r) // verify access roles in the request
if result = true then
MS_Update_LRD(r) // Update LRD and notify data owner
else
MS_Notify_User(r) // The MS notifies data owner
end if
end for
Result
This section presents the performance evaluation for the proposed model. We investigate
different aspects as follows: 1) processing time evaluation; 2) data protection evaluations; 3)
mobility [Link] that there are N requests for fog resources. For each request r ∈ N,
the processing time consists of elements as follows: 1) the trust establishment time from two
regions, denoted as tt; 2) the lookup service time from client to fog node, denoted as lt; 3) the
verification and mobility service time at fog node, denoted vt; 4) the response time from fog
node to client, denoted rt. Each node of fog computing network represents for a method and an
edge represents whether a method is invoked. Assume that the execution cost of a method m in a
fog node is mf and on cloud server mc.
Conclusion
This paper presented a data protection model for fog computing to protect data and handle
mobility. The model features a Region-Based Trust-Aware (RBTA) model for trust translation
among fog nodes of regions, a Fog-based Privacy-aware Role Based Access Control (FPRBAC)
for access control at fog nodes, a mobility management service to handle location requests at a
region. In order to deploy our framework in practice, providing high availability of fog services
and resources and up-to-date location services need to be taken into account to address the
sensitive-response requirement. The experimental outcomes demonstrated the feasibility and
efficiency of the model.
References
[1]I. Consortium, S. Schrecker, H. Soroush, and J. Molina, Industrial Internet of Things Volume G4:
Security Framework: CreateSpace Independent Publishing Platform, 2016.
[2]L. Chen and D. B. Hoang, "Active data-centric framework for data protection in cloud environment,"
in ACIS 2012: Location, location, location: Proceedings of the 23rd Australasian Conference on
Information Systems, pp. 1-11, 2012.
[3]C. Liu, J. Chen, L. T. Yang, X. Zhang, C. Yang, R. Ranjan, et al., "Authorized Public Auditing of
Dynamic Big Data Storage on Cloud with
Efficient Verifiable Fine-Grained Updates," IEEE Transactions on Parallel and Distributed Systems, vol.
25, pp. 2234-2244, 2014.
[4]C. Dsouza, G. J. Ahn, and M. Taguinod, "Policy-driven security management for fog computing:
Preliminary framework and a case study," in 2014 IEEE 15th International Conference on Information
Reuse and Integration (IRI), pp. 16-23, 2014.
[5]R. Deng, R. Lu, C. Lai, T. H. Luan, and H. Liang, "Optimal Workload Allocation in Fog-Cloud
Computing Towards Balanced Delay and Power Consumption," IEEE Internet of Things Journal, vol. PP,
pp. 1-1, 2016.
[6]M. A. Hassan, M. Xiao, Q. Wei, and S. Chen, "Help your mobile applications with fog computing," in
2015 12th Annual IEEE International Conference on Sensing, Communication, and Networking -
Workshops (SECON Workshops), pp. 1-6, 2015.
[7]K. Lee, D. Kim, D. Ha, U. Rajput, and H. Oh, "On security and privacy issues of fog computing
supported Internet of Things environment," in 2015 6th International Conference on the Network of the
Future (NOF), pp. 1-3, 2015.