# Modeling and Security in Cloud Ecosystems
## 3 Related Work  
As indicated earlier, the word ecosystem has a variety of interpretations. [7] discusses an Internet of Things (IoT) ecosystem from a business perspective. A business ecosystem is \"the network of buyers, suppliers and makers of related products or services plus the socio-economic environment, including the institutional and regulatory framework.\" Our definition is more restricted focusing on the products themselves but also considering policies defining institution or regulations, as well as industry standards that apply to the products. [7] indicates that ecosystems usually have a _hub_, or central product or service; we have a similar concept in our ecosystem. A specialized type of ecosystem is the _learning ecosystem_[20; 21; 22]. This type of ecosystem is quite different from ours in that it is a set of homogeneous units with a predefined purpose and a well-defined architecture; ours are heterogeneous systems with an evolving architecture. These ecosystems do not use our definition of pattern and do not use UML models to describe them. The only paper with more abstract models of ecosystems is [6], which presents a model oriented to the business (functional) aspects of ecosystems; in contrast our models emphasize the structural aspects of the interconnection of products. While there is a good amount of work on ecosystems from the point of view of software architecture, e.g., [2], we have found only a few examples of cloud ecosystems. The US National Institute of Standards and Technology (NIST) described an ecosystem for its Cloud Reference Architecture [23] and, later, an ecosystem for its Security Reference Architecture [24]. However, they included only a Broker to let users access multiple clouds, an Auditor to check compliance with regulations, and a Communications Provider; which is a rather meager set of external functions. They describe their models with words and block diagrams, which we consider not precise enough to guide developers and researchers. The Open Group has a web site with their cloud model [25]. This includes a UML model for the main blocks and a table describing the components involved. There are no UML models for the components and they consider the same main components of the NIST model. A blog presents some ideas about models for cloud ecosystems [26]; however, the models are loose and shown as block diagrams. The Open Services Gateway initiative (OSGi) also has some general ideas about ecosystems [27] but nothing specific about clouds. Ecosystems can also be seen as systems of systems and work on that topic may apply to them. Work on software product line architectures is also relevant [28], as well as work on cloud security requirements [29], but these works do not attempt to model a complete ecosystem. Given the novelty of fog computing there is little work on its security aspects. Three papers survey general security aspects:  
Ref. [30] evaluates business, professional, and government structures and practices for improving IoT security, proposing some structures and rules. The paper focuses mainly in economic and political aspects and does not provide any technical details. Ref. [31] surveys fog applications and general security issues. They analyze in detail a man-in-the-middle attack, where gateways used as fog devices may be replaced by fake ones. Ref. [32] considers industrial IoT systems, which are cyber-physical systems where attacks can have very serious effects. The paper surveys some of these attacks and provides a few solutions. The only paper that discusses fog computing security models and architectures is [33]. The paper proposes a policy-driven security management approach, considering the implementation of a policy enforcement system (Reference Monitor [8]) that can enforce eXtensible Access Control Markup Language (XACML) rules; however, they do not consider rights inheritance or propagation of rights in the ecosystem. We see our work as expanding this work across the ecosystem.