# A Security Framework for the Internet of Things in the Future Internet Architecture
## 5 IoT Middleware Security  
The IoT platform in MobilityFirst introduces a new essential component, _IoT middleware_, to handle data processing and distribution in the data plane as well as system management in the control plane. The IoT middleware consists of three layers, _aggregator_, _local service gateway_ (_LSG_) and _IoT server_, so that it can support a variety of functionalities, including managing IoT devices, processing the raw data collected by the devices and then distributing the processed data through the MobilityFirst network. This approach allows a clean separation of IoT systems from the underlying network so that the network is only responsible for transmitting the IoT data, just as it handles other network traffic. Therefore, integrating our IoT solution into MobilityFirst architecture has a lightweight touch that is easy to deploy. Further, decoupling the IoT middleware from the underlying network infrastructure makes our IoT solution more general and is easily ported to other network designs that share similar features with MobilityFirst. For example, the middleware layer is independent of the network infrastructure and supports object virtualization that enables interoperability between heterogeneous devices regardless of the underlying networking medium. In particular, we note that the separation of our middleware from the network allows for our IoT security solutions to be easily deployed on the existing Internet infrastructure, as well as other clean slate architectures, such as NDN [9] and XIA [8]. Further, the security mechanisms adopted in our middleware provide secure communication and key management functions that are generally both necessary and applicable to other styles of IoT deployments. In the IoT middleware architecture described in Figures 4 and 5, the _aggregator_ sitting at the bottom level is usually located near or at the gateway of the local network. This is the first stage of data processing as the aggregator collects raw data directly from a variety of heterogeneous IoT devices and filters out the redundant data. The introduction of the aggregator hides the complex heterogeneous hardware from upper layer applications and facilitates application development. The _LSG_ level contains one _IoT Name Resolution Service (IoT-NRS)_ and several other functional components depending on the system and application requirements. The top level is the _IoT server_, which is essentially a logically centralized but physical distributed database that provides lookup service for data consumers. The aggregator, the LSG and the IoT server form the middleware of MobilityFirst-based IoT and connect the various IoT devices with the upper layer applications. Our security measures are primarily integrated in the LSG layer, while the access control policy is enforced at the IoT server, who might push it further to the GNRS. From the perspective of the data consumer, which is typically an application, to either fetch the processed data from the data storage location or get the raw data from the aggregator directly, it needs to know where to fetch the data. Therefore, the data consumer looks up the data storage location at the IoT server with its identity. On the other side, the IoT server evaluates the request with the access control policy defined by the IoT data owner. If the decision is \"approve\", it returns the data location to the data consumer (possibly with a token depending on the specific access control policy). Then the consumer may be able to fetch the data or setup a subscription. In the case where the IoT server pushes the enforcement of the access control policy to the GNRS, the GNRS will grant a token to the data consumer if the access decision is \"approve\". Then the data consumer can present the token to the IoT server to request data information. At the data producer side, efficient and secure IoT device and data management is not only necessary but crucial for providing accurate and fresh IoT data.