1. MIDDLEWARE SYSTEMS RESEARCH GROUP Middleware 20071 A Policy Management Framework for Content-based Publish/Subscribe Middleware Hans-Arno Jacobsen Department of Electrical and Computer Engineering & Department of Computer Science University of Toronto v1.1 Joint work with Alex Wun. http://www.padres.msrg.utoronto.ca

2. 2 Logistics Retailer Manufacturer Supplier/Distributor RFID Tracking Sensor Network Management Business Activity Monitoring SLA Monitoring Content-based Publish/Subscribe (CPS)

3. 3 2015-10-20 3 The PADRES Project Acknowledgements

4. 4 B B B S S P B P B input queue output queue dest2 output queue dest3 dest1 dest2 dest3 P S = publisher = subscriber subscriptiondest Matching Engine Routing Table + temperature > 37 dest2 temperature > 40 dest3 Publications temperature = 38temperature = 42temperature = 36 A Pub/Sub Message Broker

5. RESEARCH GROUP MIDDLEWARE SYSTEMS Middleware 2007 5 Content-based Publish/Subscribe Many additional application-specific features often needed  Security  Message transformation  System debugging & message tracing Application integration  Different requirements from diverse applications must co-exist on same running infrastructure

6. RESEARCH GROUP MIDDLEWARE SYSTEMS Middleware 2007 6 Content-based Policy Framework Policy Framework  Flexible: separates application requirements from infrastructure mechanisms  Dynamic: change behavior of running system Content-based Policy Framework  Leverage content-based matching to achieve expressive, low overhead policies  More coupled with CPS systems  More efficient than generic policy layer

7. RESEARCH GROUP MIDDLEWARE SYSTEMS Middleware 2007 7 Contributions and Presentation Agenda Novel policy model for CPS systems  Focus on post-matching policy model Implementation of policy framework for CPS systems  Focus on policy mechanisms  Not interested in developing policy language or syntax Interesting new features enabled by our policy framework  Qualitative validation of approach using application scenarios Performance overhead experimental results  Quantitative validation of approach

8. RESEARCH GROUP MIDDLEWARE SYSTEMS Middleware 2007 8 Post-matching Policy Model In terms of Event-Condition-Action rules: When content-based match occurs If additional policy condition(s) satisfied then Perform Action1 …. ActionN

9. RESEARCH GROUP MIDDLEWARE SYSTEMS Middleware 2007 9 Post-matching Policy Model Given a message M, matching algorithm computes: Filter (Subscription, Advertisement) Associated Policy Statement Policies T 1 … T n are applied to M M is a publication, contains subscriptions and advertisements M is a subscription, contains advertisements

10. 10 Message Associated Policy Policies Applied on Injection

11. RESEARCH GROUP MIDDLEWARE SYSTEMS Middleware 2007 11 Policy Composition Publication space: [(a 1,x 1 ), …,(a N,x N )] Require Authentication Append Debugging Info. Trim Attributes S 1 = [(a 1 > T 1 )] : AuthenticateSender() S 2 = [(a 1 T 2 )] : AppendDebug(…) S 3 = [(a1 T 4 )] : TrimAttributes()

12. RESEARCH GROUP MIDDLEWARE SYSTEMS Middleware 2007 12 API with Policy Support publish/subscribe/advertise(Message, PolicyStatement) setPolicy(MessageID, PolicyStatement) PolicyStatement { On(MessageType) { … @broker: [Overlay location type] If Then Elseif Then … } … }

13. MIDDLEWARE SYSTEMS RESEARCH GROUP Middleware 200713 Policy Framework Validation Scenarios Enabling policies for  Security  CPS Semantics

14. RESEARCH GROUP MIDDLEWARE SYSTEMS Middleware 2007 14 Content-based Firewall On(Publication) { @broker: Routing If {} Then {BlockMessage()} } Subscription-associated policy: (applied to publications) Acts like negation subscription Firewall

15. 15 Content-based Firewall Individual Subscriptions Merged Subscription External Firewall BrokerInternal Firewall Broker

16. RESEARCH GROUP MIDDLEWARE SYSTEMS Middleware 2007 16 Authentication On(Publication) { @broker: Ingress,Routing,Egress If {AuthenticateReceiver(group1)} Then{} Elseif {} Then {BlockMessage()} } Shared group secret K g. Brokers either exchange via public/private key mechanisms or are bootstrapped with K g. B G1 B B P Advertisement-associated policy: Uncontrolled advertisement and subscription propagation Controlled publication injection, routing, and delivery

17. RESEARCH GROUP MIDDLEWARE SYSTEMS Middleware 2007 17 Authentication On(Subscription) { @broker: Ingress,Routing If {AuthenticateReceiver(group1) && AuthenticateSender(group1)} Then{} Elseif {} Then {BlockMessage()} } Shared group secret K g. Brokers either exchange via public/private key mechanisms or are bootstrapped with K g. B G1 B B S Advertisement-associated policy: Controlled subscription injection and routing S

18. RESEARCH GROUP MIDDLEWARE SYSTEMS Middleware 2007 18 Notification Semantics On(Publication) { @broker: Egress If {} Then {TrimAttributes(…), ToXML()} } SS P 1 = [(a,1)(b,2)(c,3)] P 1 ’= [(a,1)] P 2 ’= [(b,4),(c,3)] P 2 = [(a,9)(b,4)(c,3)] P 1 ’= [(a,1),(b,2)] P 2 ’= 1 4 Subscription-associated policy: Subscribers have fine-grained control over format of delivered publications

19. RESEARCH GROUP MIDDLEWARE SYSTEMS Middleware 2007 19 Meta-Events On(Subscription) { @broker: Ingress If {AuthenticateSender(group1)} Then {} Elseif {} Then {Publish(“[class,UnauthorizedSubscribe], [message,$message], [brokerID,$brokerID]”)} } Advertisement-associated policy: Self-generated event by system in response to unauthorized subscription injection B1 S S S = [(class = UnauthorizedSubscribe), (brokerID = B1)]

20. RESEARCH GROUP MIDDLEWARE SYSTEMS Middleware 2007 20 Healthcare Example “Doctors with appropriate specialties may only enter prescriptions for their own patients in their designated ward when they are on shift. If they try to write prescriptions in violation, a notification to be sent to the chief physician” Features used  Check doctor qualifications (authentication)  Check registration and shift status (authorization)  Report violations (meta-events)

21. RESEARCH GROUP MIDDLEWARE SYSTEMS Middleware 2007 21 Healthcare Example S Hospital Ward Access Point P Chief Physician Healthcare Broker Network [(class = Violation), (type = prescription)] [(class = Prescription), (doctor = *),(patient = *), (drug = *),(ward = x)] Advertise Policy Subscribe On(Publication) { @broker: Ingress If {CanPrescribe($doctor) && Registered($doctor,$patient) && OnShift($doctor,$ward)} Then {} Elseif {} Then {Publish(“[class,Violation], [type,prescription], [doctor,$doctor],…”)}}

22. RESEARCH GROUP MIDDLEWARE SYSTEMS Middleware 2007 22 Performance Overhead Setup Publication policy attached to subscriptions: On(Publication) { @broker: Egress If {} Then {Augment($Delay)} } Subscription policy attached to advertisements: On(Advertisement) { @broker: Ingress,Routing If {} Then {BlockMessage()} } On(Subscription) { @broker: Ingress,Routing If {} Then {Flood()}} Each run: 1000 Subscriptions (avg. 4 predicates – Poisson distribution) 1000 Publications (all attributes) ~20 Advertisements From 0% to 100% of Subscriptions/Advertisements associated with policies

23. 23 Performance Overhead Publication Policy Subscription Policy

24. RESEARCH GROUP MIDDLEWARE SYSTEMS Conclusions Applications have diverse feature requirements on messaging middleware  Security  Message transformations  System debugging Policies can leverage content-based publish/subscribe matching algorithms (Post-matching policies)  Flexible and expressive  Enables interesting features  Low overhead http://www.padres.msrg.utoronto.ca Thank You - Questions?

25. MIDDLEWARE SYSTEMS RESEARCH GROUP Middleware 200725 *** Extra Slides ***

26. RESEARCH GROUP MIDDLEWARE SYSTEMS Middleware 2007 26 Healthcare Example II “Only members of the finance department with titles of Director or VP can access patient billing history of more than 1 year ago” Features used  Historic data access (supported by PADRES)  Role-Based Access Control (authentication)  Data privacy (notification trimming) Alternative: content encryption

27. RESEARCH GROUP MIDDLEWARE SYSTEMS Middleware 2007 27 Healthcare Example II S Patient Database Client P Patient Info Access Point Healthcare Broker Network [(class = Historic), (patient = x),(date after y)] [(class = Historic), (patient = *),(billing_info = *), (medical_info = *),(date = *)] Advertise Policy Subscribe On(Publication) { @broker: Egress @attach: always If {AuthenticateReceiver(Director) || AuthenticateReceive(VP)} Then {} Elseif {DateBefore($now-1year)} Then {Trim(billing_info)}} P

28. RESEARCH GROUP MIDDLEWARE SYSTEMS Middleware 2007 28 Security Zones and Privacy Authentication: Control message propagation Message Transformation: Restrict attribute visbility Meta-Events: Monitor unauthorized subscriptions

29. RESEARCH GROUP MIDDLEWARE SYSTEMS Middleware 2007 29 Authentication

30. RESEARCH GROUP MIDDLEWARE SYSTEMS Middleware 2007 30 Notification Semantic

31. RESEARCH GROUP MIDDLEWARE SYSTEMS Middleware 2007 31 Policy Composition Publications of the form: [(class,C),(a 1,x 1 ),…,(a N,x N )] If class = c 1 & a 1 < T low AppendPrevHop() If class = c 1 & a 1 > T high RemoveAttrs(x 2...x N ) If class = c 2 … S 1 = [(class=c 1 ),(a 1 <T low )] : AppendPrevHop() S 2 = [(class=c 1 ),(a 1 >T high )] : RemoveAttrs(…) S 3 = [(class=c 2 )] : … Policies Subscriptions : Policy Statements

32. RESEARCH GROUP MIDDLEWARE SYSTEMS Middleware 2007 32 Content-based Match Event Filters (Subscriptions, Advertisements) Message (Publication) XOXO Associated Policies

33. RESEARCH GROUP MIDDLEWARE SYSTEMS Middleware 2007 33 Generic Policy Frameworks Focus on framework mechanisms and not policy language If-Then  If conditions evaluate on message content and duplicates work of CPS system  Post-matching policy model for content-based policies

34. RESEARCH GROUP MIDDLEWARE SYSTEMS Middleware 2007 34 Policy Framework Architecture Advertisement Subscription Store Policy Store Policy Evaluation Policy Manager Matching Engine Previous Broker or Client Next Broker(s) or Client(s) Policy Statement Policy Rule Filter/ Message

35. RESEARCH GROUP MIDDLEWARE SYSTEMS Middleware 2007 35 Policy Statement Data Structure Policy Statement Policy Rule (on publications @ egress) A B C D E F G H If {A & B} Then {C} Elseif {D} Then {E,F} Elseif {} Then {G,H} Policy Rule (on publications @ ingress) Policy Rule (on subscriptions @ ingress)