# A Secure Auditable Remote Registry Pattern for IoT Systems
## 4 The Secure Auditable Registry Based On Message-Oriented Middleware (SARMOM) Pattern
### Problem  
An IoT application is used to obtain event information from different things or machines (e.g., devices and sensors). The amount of information generated is enormous and the rate of production is also extremely fast. The generated information is diverse and is used for many different purposes. Part of the information must be protected, to preserve privacy, to protect business intelligence or because it is considered confidential information, but at the same time it must also serve as proof of the integrity of the system and its information for external auditors. To represent the problem and the target SUDs, we investigated other systems and domains that could potentially benefit from adopting this pattern. One of those is part of a collaboration we have with an autonomous drone company. Autonomous drones are used for many different tasks, but because they are not controlled by humans their actions must be auditable in every moment. The gambling system and the drone system have very little in common at the functional level, and while there are similarities at the level of components and architecture we found that the main reason for the use of the pattern is not related to the components or the architecture but to the goals and restrictions of the system. For this reason, in order to represent the target SUDs that could benefit from using \(\mathrm{SARMOM}\), we concluded that we had to complement the normal UML (class, components or architecture) diagrams showing the architecture of the target systems by further specifying the SUD goals. This was achieved by means of the Secure Tropos Goal Analysis model [37]. Secure Tropos is an independent formalism that is not part of the standard UML. Consequently, to be able to integrate the Secure Tropos model into our modeling environment we developed a specific UML profile to represent Secure Tropos in UML. This profile has been made available as an Open Source artifact. Figure 3 shows a simplified and generalized architecture of target SUDs before the application of the \(\mathrm{SARMOM}\) pattern. The depicted architecture is a generalization of several systems that are candidates for the application of the \(\mathrm{SARMOM}\) pattern. In particular, we have considered scenarios for gambling, autonomous drones and a trusted  
mesh communication network for military vehicles. Please note that the dashed lines represent dependencies and do not imply any direction in the communication. In all these systems, there are \"Machines\" (i.e., gaming machines, drones or military vehicles) that generate the events that are central to the system operation. Each machine has a controller component that is used to integrate it with the SUD. Machines may send events to a central component (Event Collector) that has a central event store or to specific modules controlling different functions of the SUD, which may also have local event stores. An SUD Management module also exists, to coordinate the rest of the SUD. While the previous figure may allow the readers to determine whether their SUD can benefit from the application of the \(\mathrm{SARMO}\) pattern, we feel it misses important information about the goals of the system if it is taken as the only source for identifying target SUDs for the \(\mathrm{SARMO}\) pattern. To complement the previous architecture diagram, in Figure 4 we present the Secure Tropos Goal Analysis diagram highlighting goals of legitimate and malicious agents and showing how the proposed pattern can help mitigate most of the threats (represented with the <<Threatens>> relation stereotype) and contribute positively to legitimate goals for the SUD. The diagram uses a representation based on our own UML Profile (the ITIS-UMA-SwEngProfile), which extends UML with different security aspects: for instance, allowing us to represent Secure Tropos concepts and diagrams in UML. In this profile, the stereotype <<Agent>> is used to represent legitimate stakeholders of the SUD, while <<Malicious Agent>> denotes entities with illegitimate interests in the system.