## 6 Evaluation of Results
### IoT-Fog-Cloud Architecture with Access Control Model versus without Access Control Model  
In this subsection, we evaluate the IoT-Fog-Cloud architecture with our access control model using AWS cloud metrics, as shown in Table 4.  
The first experiment of the IoT-Fog-Cloud architecture was conducted using one IoT device. We ran this experiment twice simultaneously, one instance without our access control model and the other with the model. We used two subscribes and two publishes because the IoT device generated two types of data: (A) temperature degree and (B) humidity degree. The results show that the numbers of subscribes and publishes (i.e., subscribe.success and connect.success) for the IoT-Fog-Cloud architecture with and without the access control model were the same and reflect the defined number of subscribes and publishes for one IoT device. This is because the connection of neither experiment (with versus without the access control model) was disconnected, so the subscribe request was not lost. Although the first experiment with the security model had a certificate in the authentication process of the IoT-fog-cloud layers, it did not affect the number of subscribes and publishes. In contrast, the number of published messages (publishout.success andpublishin.success) for the IoT-Fog-Cloud architecture with the access control model was slightly less than that of the architecture without the model. This is because the IoT device performed some security operations that took one second for each sensor data type. Each sensor data type (i.e., temperature data and humidity data) took one second to generate keys containing a set of attributes and encrypt the generated sensor data type value with the corresponding key containing its attribute.  
The second experiment of the IoT-Fog-Cloud architecture was performed by connecting two IoT devices and making four subscribe and publish requests. This experiment was also run twice simultaneously, with and without our access control model. The results show that the numbers of subscribes and publishes (i.e., subscribe.success and connect.success) for the IoT-Fog-Cloud architecture with and without the access control model were the same for two IoT devices and match the defined number of subscribe and publish requests for one IoT device. However, the number of published messages (publishout.success and publish.success) for the architecture with the access control model was slightly less than that of the architecture without the model. This is because each of the two IoT devices performed security operations, which took one second for each sensor data type (i.e., temperature data or humidity data) of each of the two IoT devices. Each sensor data type (i.e., temperature data or humidity data) of each of the two IoT devices took one second to generate a key containing a set of attributes and encrypt the generated sensor data type value with the corresponding key containing its attribute.  
Overall, we found that the performance of the IoT-Fog-Cloud architecture without the access control model was slightly better than that of the architecture with the model when using one, two, or three IoT devices. However, when using one, two, or three IoT devices, the number of published messages was delayed two seconds when using the access control model, as shown in Table 4. This is because the second layer of security requirements, authorization, was proposed and added to the IoT-Fog-Cloud architecture. Therefore, this gives the IoT-Fog-Cloud architecture a better performance and security at the same time.