# Publish/Subscribe-Middleware-Based Intelligent Transportation Systems: Applications and Challenges
## 6 Challenges
### Security Challenges  
Security is the most challenging part of computer network systems. Research must tackle two security challenges in publish/subscribe-middleware-based ITS [103]: (1) The system must ensure that it accepts data only from verified publishers, preventing unauthorized data injection; (2) It must also restrict access to the published data to authorized individuals only.  
Researchers can leverage the broker in a centralized publish/subscribe middleware to accomplish these requirements. In the Connected Vehicles and Smart Transportation (CVST) platform [103], the broker functions as a reliable key management system by issuing certificates to publishers and subscribers, thereby validating the data's provenance and integrity. The system uses these certificates to sign interest and data packets in Named Data Networking (NDN), and a shared key encryption algorithm facilitates secure data exchange between publishers, the broker, and subscribers. The broker provides shared keys to authorized users for encrypting and decrypting data, ensuring confidentiality and integrity within the system. Similarly, [PERSON] et al. [71] used Secure Copy Protocol (SCP) to secure EDR data they upload to a central server that doubles as an MQTT broker. However, a broker is a single point of failure, which puts it at risk of cybersecurity and cyber-physical attacks. The pay-off to the attackers is even higher if the broker has multiple functions, like in the case of [71]. Also, the security of publicly available brokers or physically located in remote areas of the ITS presents tremendous cyber-physical challenges.  
For distributed publish/subscribe middleware, aspect-oriented space containers (ASCs) are applicable data in publisher/subscribe ITS protection. A space container is a customizable storage component designed for efficient storage and retrieval of structured, spatial-temporal data distributed in a fault-tolerant manner through Distributed Hash Tables (DHT) [108]. Developers can use aspects in ASC to realize security measures such as authorization and authentication, ensuring secure communication within the system. The integration of aspect-oriented space containers in publish/subscribe scenarios can enhance security by allowing the implementation of security mechanisms through aspects. However, adding an ASC may lead to memory and latency overheads on the ITS.  
[PERSON] & [PERSON] discussed some cybersecurity concerns of beaconing in publish/subscribe middleware for VANET [14]. Beaconing is the periodic sending of beacon signals containing a node's ID and movement details to advertise the node's presence to nearby neighbors. It helps manage network congestion, support safety, and emerging applications in vehicular networks. The authors argued that beacons in VANET applications raise security concerns regarding the accuracy and reliability of the information exchanged, especially in safety applications like collision warnings and traffic management. Thus, a publish/subscribe middleware should provide intrusion detection systems that evaluate the variation of beacon parameters between consecutive beacons to prevent malicious activities like Sybil attacks [111] or malfunctioning nodes sending incorrect beacons [14]. This threat is particularly significant in large-scale P2P networks due to its application in many railway ITS protocols [83] and other P2P-based land transportation ITS [15; 92].  
Other security concerns of using publish/subscribe middleware include vulnerabilities in rules and protocols that can lead to network misconfigurations, which account for a significant portion of network failures [112]. Thus, model-checking techniques are essential to identify vulnerabilities in design rules and protocols of communication systems, addressing security issues before any losses occur. Researchers should develop easy-to-configure publish/subscribe ITS, reducing system installation and maintenance costs. Also, stakeholders must focus on staff training to ensure system security.