MIDDLEWARE SYSTEMS RESEARCH GROUP Middleware A Policy Management Framework for Content-based Publish/Subscribe Middleware Hans-Arno Jacobsen Department of Electrical and Computer Engineering & Department of Computer Science University of Toronto v1.1 Joint work with Alex Wun.

2 Logistics Retailer Manufacturer Supplier/Distributor RFID Tracking Sensor Network Management Business Activity Monitoring SLA Monitoring Content-based Publish/Subscribe (CPS)

The PADRES Project Acknowledgements

4 B B B S S P B P B input queue output queue dest2 output queue dest3 dest1 dest2 dest3 P S = publisher = subscriber subscriptiondest Matching Engine Routing Table + temperature > 37 dest2 temperature > 40 dest3 Publications temperature = 38temperature = 42temperature = 36 A Pub/Sub Message Broker

RESEARCH GROUP MIDDLEWARE SYSTEMS Middleware Content-based Publish/Subscribe Many additional application-specific features often needed  Security  Message transformation  System debugging & message tracing Application integration  Different requirements from diverse applications must co-exist on same running infrastructure

RESEARCH GROUP MIDDLEWARE SYSTEMS Middleware Content-based Policy Framework Policy Framework  Flexible: separates application requirements from infrastructure mechanisms  Dynamic: change behavior of running system Content-based Policy Framework  Leverage content-based matching to achieve expressive, low overhead policies  More coupled with CPS systems  More efficient than generic policy layer

RESEARCH GROUP MIDDLEWARE SYSTEMS Middleware Contributions and Presentation Agenda Novel policy model for CPS systems  Focus on post-matching policy model Implementation of policy framework for CPS systems  Focus on policy mechanisms  Not interested in developing policy language or syntax Interesting new features enabled by our policy framework  Qualitative validation of approach using application scenarios Performance overhead experimental results  Quantitative validation of approach

RESEARCH GROUP MIDDLEWARE SYSTEMS Middleware Post-matching Policy Model In terms of Event-Condition-Action rules: When content-based match occurs If additional policy condition(s) satisfied then Perform Action1 …. ActionN

RESEARCH GROUP MIDDLEWARE SYSTEMS Middleware Post-matching Policy Model Given a message M, matching algorithm computes: Filter (Subscription, Advertisement) Associated Policy Statement Policies T 1 … T n are applied to M M is a publication, contains subscriptions and advertisements M is a subscription, contains advertisements

10 Message Associated Policy Policies Applied on Injection

RESEARCH GROUP MIDDLEWARE SYSTEMS Middleware Policy Composition Publication space: [(a 1,x 1 ), …,(a N,x N )] Require Authentication Append Debugging Info. Trim Attributes S 1 = [(a 1 > T 1 )] : AuthenticateSender() S 2 = [(a 1 T 2 )] : AppendDebug(…) S 3 = [(a1 T 4 )] : TrimAttributes()

RESEARCH GROUP MIDDLEWARE SYSTEMS Middleware API with Policy Support publish/subscribe/advertise(Message, PolicyStatement) setPolicy(MessageID, PolicyStatement) PolicyStatement { On(MessageType) { [Overlay location type] If Then Elseif Then … } … }

MIDDLEWARE SYSTEMS RESEARCH GROUP Middleware Policy Framework Validation Scenarios Enabling policies for  Security  CPS Semantics

RESEARCH GROUP MIDDLEWARE SYSTEMS Middleware Content-based Firewall On(Publication) Routing If {} Then {BlockMessage()} } Subscription-associated policy: (applied to publications) Acts like negation subscription Firewall

15 Content-based Firewall Individual Subscriptions Merged Subscription External Firewall BrokerInternal Firewall Broker

RESEARCH GROUP MIDDLEWARE SYSTEMS Middleware Authentication On(Publication) Ingress,Routing,Egress If {AuthenticateReceiver(group1)} Then{} Elseif {} Then {BlockMessage()} } Shared group secret K g. Brokers either exchange via public/private key mechanisms or are bootstrapped with K g. B G1 B B P Advertisement-associated policy: Uncontrolled advertisement and subscription propagation Controlled publication injection, routing, and delivery

RESEARCH GROUP MIDDLEWARE SYSTEMS Middleware Authentication On(Subscription) Ingress,Routing If {AuthenticateReceiver(group1) && AuthenticateSender(group1)} Then{} Elseif {} Then {BlockMessage()} } Shared group secret K g. Brokers either exchange via public/private key mechanisms or are bootstrapped with K g. B G1 B B S Advertisement-associated policy: Controlled subscription injection and routing S

RESEARCH GROUP MIDDLEWARE SYSTEMS Middleware Notification Semantics On(Publication) Egress If {} Then {TrimAttributes(…), ToXML()} } SS P 1 = [(a,1)(b,2)(c,3)] P 1 ’= [(a,1)] P 2 ’= [(b,4),(c,3)] P 2 = [(a,9)(b,4)(c,3)] P 1 ’= [(a,1),(b,2)] P 2 ’= 1 4 Subscription-associated policy: Subscribers have fine-grained control over format of delivered publications

RESEARCH GROUP MIDDLEWARE SYSTEMS Middleware Meta-Events On(Subscription) Ingress If {AuthenticateSender(group1)} Then {} Elseif {} Then {Publish(“[class,UnauthorizedSubscribe], [message,$message], [brokerID,$brokerID]”)} } Advertisement-associated policy: Self-generated event by system in response to unauthorized subscription injection B1 S S S = [(class = UnauthorizedSubscribe), (brokerID = B1)]

RESEARCH GROUP MIDDLEWARE SYSTEMS Middleware Healthcare Example “Doctors with appropriate specialties may only enter prescriptions for their own patients in their designated ward when they are on shift. If they try to write prescriptions in violation, a notification to be sent to the chief physician” Features used  Check doctor qualifications (authentication)  Check registration and shift status (authorization)  Report violations (meta-events)

RESEARCH GROUP MIDDLEWARE SYSTEMS Middleware Healthcare Example S Hospital Ward Access Point P Chief Physician Healthcare Broker Network [(class = Violation), (type = prescription)] [(class = Prescription), (doctor = *),(patient = *), (drug = *),(ward = x)] Advertise Policy Subscribe On(Publication) Ingress If {CanPrescribe($doctor) && Registered($doctor,$patient) && OnShift($doctor,$ward)} Then {} Elseif {} Then {Publish(“[class,Violation], [type,prescription], [doctor,$doctor],…”)}}

RESEARCH GROUP MIDDLEWARE SYSTEMS Middleware Performance Overhead Setup Publication policy attached to subscriptions: On(Publication) Egress If {} Then {Augment($Delay)} } Subscription policy attached to advertisements: On(Advertisement) Ingress,Routing If {} Then {BlockMessage()} } On(Subscription) Ingress,Routing If {} Then {Flood()}} Each run: 1000 Subscriptions (avg. 4 predicates – Poisson distribution) 1000 Publications (all attributes) ~20 Advertisements From 0% to 100% of Subscriptions/Advertisements associated with policies

23 Performance Overhead Publication Policy Subscription Policy

RESEARCH GROUP MIDDLEWARE SYSTEMS Conclusions Applications have diverse feature requirements on messaging middleware  Security  Message transformations  System debugging Policies can leverage content-based publish/subscribe matching algorithms (Post-matching policies)  Flexible and expressive  Enables interesting features  Low overhead Thank You - Questions?

MIDDLEWARE SYSTEMS RESEARCH GROUP Middleware *** Extra Slides ***

RESEARCH GROUP MIDDLEWARE SYSTEMS Middleware Healthcare Example II “Only members of the finance department with titles of Director or VP can access patient billing history of more than 1 year ago” Features used  Historic data access (supported by PADRES)  Role-Based Access Control (authentication)  Data privacy (notification trimming) Alternative: content encryption

RESEARCH GROUP MIDDLEWARE SYSTEMS Middleware Healthcare Example II S Patient Database Client P Patient Info Access Point Healthcare Broker Network [(class = Historic), (patient = x),(date after y)] [(class = Historic), (patient = *),(billing_info = *), (medical_info = *),(date = *)] Advertise Policy Subscribe On(Publication) always If {AuthenticateReceiver(Director) || AuthenticateReceive(VP)} Then {} Elseif {DateBefore($now-1year)} Then {Trim(billing_info)}} P

RESEARCH GROUP MIDDLEWARE SYSTEMS Middleware Security Zones and Privacy Authentication: Control message propagation Message Transformation: Restrict attribute visbility Meta-Events: Monitor unauthorized subscriptions

RESEARCH GROUP MIDDLEWARE SYSTEMS Middleware Authentication

RESEARCH GROUP MIDDLEWARE SYSTEMS Middleware Notification Semantic

RESEARCH GROUP MIDDLEWARE SYSTEMS Middleware Policy Composition Publications of the form: [(class,C),(a 1,x 1 ),…,(a N,x N )] If class = c 1 & a 1 < T low AppendPrevHop() If class = c 1 & a 1 > T high RemoveAttrs(x 2...x N ) If class = c 2 … S 1 = [(class=c 1 ),(a 1 <T low )] : AppendPrevHop() S 2 = [(class=c 1 ),(a 1 >T high )] : RemoveAttrs(…) S 3 = [(class=c 2 )] : … Policies Subscriptions : Policy Statements

RESEARCH GROUP MIDDLEWARE SYSTEMS Middleware Content-based Match Event Filters (Subscriptions, Advertisements) Message (Publication) XOXO Associated Policies

RESEARCH GROUP MIDDLEWARE SYSTEMS Middleware Generic Policy Frameworks Focus on framework mechanisms and not policy language If-Then  If conditions evaluate on message content and duplicates work of CPS system  Post-matching policy model for content-based policies

RESEARCH GROUP MIDDLEWARE SYSTEMS Middleware Policy Framework Architecture Advertisement Subscription Store Policy Store Policy Evaluation Policy Manager Matching Engine Previous Broker or Client Next Broker(s) or Client(s) Policy Statement Policy Rule Filter/ Message

RESEARCH GROUP MIDDLEWARE SYSTEMS Middleware Policy Statement Data Structure Policy Statement Policy Rule (on egress) A B C D E F G H If {A & B} Then {C} Elseif {D} Then {E,F} Elseif {} Then {G,H} Policy Rule (on ingress) Policy Rule (on ingress)