# A Secure Auditable Remote Registry Pattern for IoT Systems
## 2 Motivation and Background  
### Motivating Scenario  
Modern IT systems, and especially IoT systems, must comply with different standards and regulations, and they are expected to fulfill essential non-functional (a.k.a. quality) requirements, such as reliability and security. In particular, accountability, auditability and transparency are becoming essential security properties in these systems. The commonly accepted definition of quality includes different aspects: efficiency, operability, compatibility, security or maintainability among others. We can refer to the ISO/IEC 25010:2011 software quality model [9] for an in-depth description of IT systems quality. In our case, the motivating scenario is a project for re-engineering a system to control slot machines in a casino. In this context, evolvability and maintainability are essential because the SUD must remain in operation for a long time and adapt to different changes (the current communication protocol for slot machines will soon be replaced, new functionalities are constantly added, etc.). To this end, the architecture proposed by the Secure Auditable Registry based on Message-Oriented Middleware (\(\mathrm{SARMOM}\)) pattern is ideal, in order to achieve those properties and to reduce and isolate the impact of the future changes in the system. Another critical requirement (which is also part of quality [9]) is security. Security properties cover an extremely wide spectrum of targets and goals ranging from the classic CIA trio (Confidentiality, Integrity and Availability) to more complex and specific properties, such as non-repudiation, access control mechanisms and policies, accountability, auditability, freshness, retention, etc. Together with the fact that there are agents interested in breaking those properties, the variety and complexity of the technical security solutions make them hard to select, design and implement. Accountability is essential in our target domain. An accountable system provides mechanisms to understand the state of the SUD, and that, in turn, requires a guarantee that all significant actions and events are recorded and that it is possible to evaluate and trace both the state of the system and the reasons why it reached that state. Auditability is a key requirement for the gambling domain, but also for many IoT applications and for other domains. It goes beyond accountability because it not only guarantees that we record traces of actions and events, but also that the SUD can provide trustworthy proofs of the authenticity of those traces for (normally external) entities called auditors. In this case, it is frequent to have dedicated interfaces and mechanisms for auditors to access the proofs while maintaining the privacy and confidentiality of the system data. Finally, transparency refers to a more general scenario, in which the facts, logs and/or reports of the SUD can be provided to any actor requesting them [10]. Obviously, transparency is usually limited or at least affected by privacy and confidentiality. Moreover, in addition to technical requirements, our target scenarios are also subject to laws and regulations. In the case of the gambling domain, we find very different laws, such as the Gambling Act 2005 [11] for the UK, the Spanish Gambling Act or Decree-Law 422/89 or the Nevada Revised Statutes (mainly the NRS 463 series, such as the NRS 463.0129 \"Public policy of state concerning gaming; license or approval revocable privilege\"). Regulations governing IoT applications continue to evolve around the world, as governments gain a better understanding of the field and as they develop and evolve laws to protect citizens' rights in the expanding IoT landscape. It is not the goal of this section to provide a comprehensive overview but to highlight that regulations are converging and that the monitoring of relevant events, their protection and their use are part of those regulations. An extensive review of the laws and regulations affecting the IoT around the world is provided in [12].