In Internet of Things (IoT)scenarios, the coordination of physical systems is often complex and rigid. Work to date has not comprehensively explored how to flexibly construct distributed IoT services to satisfy the coordination requirement. In our work, we propose a declarative approach to construct an event-driven IoT service system, where physical devices and systems are explicitly modeled as a service architecture foundation, the service behavior is flexibly declared based on distributed events, and it is step-by-step refined to have rigid service properties while allowing runtime adaptation. As an example, the controllability property of physical systems is discussed. Finally, we establish a distributed event-driven IoT service platform to test our method. Some experiments are performed to concept-prove our work.

Ensuring an information fabric safe is critical and mandatory. For its related Internet of Things (IoT) service system running on the open Internet, existing monitoring methods may fail due to only inspecting softwares, and the physical system may not be able to be protected. In this paper, a protection framework is provided to protect the physical system with the IoT services as a controlling means, which involves: multiple observation sources to get the inconsistent and untrusted observation knowledge, extracting true traces from the former, and checking properties for the physical system with considering adversarial environments. A novel certainty measure scheme is proposed to evaluate the service trace by fusing different observations.

Internet of Things (IoT) services play an increasingly important role in modern society with the more deployment in critical infrastructures. Ensuring IoT systems operating in a secure and safe environment is becoming a mandatory and urgent requirement. We have proposed a non-intrusive runtime monitoring mechanism in our previous work, but only runtime of C applications is considered in it. With the widely use of Java applications, the runtime monitoring of Java services is quite essential and important. However, the existing memory forensics on user processes are mainly focused on native stack of C or Java heap, which cannot meet the requirements of runtime monitoring of IoT services. In this paper, We propose an approach to dump and semantically reconstruct a Java stack, where a history of executed methods is obtained. We show the algorithms to extract methods in calling and the associated parameters, which are further encapsulated to be IoT events in XML format for runtime monitoring of IoT services, from Java stacks. The challenge of determining whether a stack frame is interpreted or compiled when reconstruct frames from the bottom to the top of the stack is solved. Experiments and evaluations show that the reconstruction is feasible and effective, with low resource occupation and real-time responses.

Complex Event Processing (CEP) systems extract interest situations from event flows based on event detection patterns. However, local event processing for distributed Internet of Things (IoT) has not been discussed yet. Besides, it is complex or impossible to discover such patterns in some applications of IoT. In this article, we design a complex event service to process event flows based on IoT resource models, which does not depend on existing patterns, and deals with both discrete events and continuous variables. To improve the CEP performance, local IoT resources are used for local event processing, and a lazy exchange method is designed to realize the collaborated event processing between network edges and a data center. Our evaluation shows that our solution is feasible and effective.

Software-defined networking (SDN) is a promising future network architecture which introduces new dimensionsin flexibility and adaptability to cope with different Quality of service (QoS) metrics, such as latency constraint, loss rate, etc. In this paper, we provide differentiated Services for flows of a topic-oriented publish/subscribe system to address some of the QoS guarantee issues, by leveraging multi-priority queue functions of SDN. Flows are bifurcated into multi-priority queues in terms of packet properties such as delay and reliability requirements. An active feedback-based queue management mechanism is responsible for ensuring bounded queueing delays for those higher priority queues, and a mapping method accounts for mapping time-constrained flows to different priority queues. The Experiments verify the effectiveness of the queue mechanism and flow scheduling.

The publish/subscribe paradigm can be used to build IoT service communication infrastructure owing to its loose coupling and scalability. Its features of decoupling among event producers and event consumers make IoT services collaborations more real-time and flexible, and allow indirect, anonymous and multicast IoT service interactions. However, in this environment, the IoT service cannot directly control the access to the events. This paper proposes a cross-layer security solution to address the above issues. The design principle of our security solution is to embed security policies into events as well as allow the network to route events according to publishers' policies and requirements. This solution helps to improve the system's performance, while keeping features of IoT service interactions and minimizing the event visibility at the same time. Experimental results show that our approach is effective.

The communication systems in existing smart grids mainly take the request/reply interaction model, in which data access is under the direct control of data producers. This tightly controlled interaction model is not scalable to support complex interactions among smart grid services. On the contrary, the publish/subscribe system features a loose coupling communication infrastructure and allows indirect, anonymous and multicast interactions among smart grid services. The publish/subscribe system can thus support scalable and flexible collaboration among smart grid services. However, the access is not under the direct control of data producers, it might not be easy to implement an access control scheme for a publish/subscribe system. In this article, we propose a Data-Centric Access Control Framework (DCACF) to support secure access control in a publish/subscribe model. This framework helps to build scalable smart grid services, while keeping features of service interactions and data confidentiality at the same time. The data published in our DCACF is encrypted with a fully homomorphic encryption scheme, which allows in-grid homomorphic aggregation of the encrypted data. The encrypted data is accompanied by bloom-filter encoded control policies and access credentials to enable indirect access control. We have analyzed the correctness and security of our DCACF and evaluated its performance in a distributed environment.

With various online crowdsourcing platforms, it is easy to collect multiple labels for the same examples from the crowd. Consensus integration algorithms can infer the estimated ground truths from the multiple label sets of these crowdsourcing datasets. However, it couldn't be avoided that these integrated (estimated) labels still contain noises. In order to further improve the performance of a model learned from data with these integrated labels, we propose an active learning framework to further improve the data quality, such that to improve the model quality, through acquiring limited true labels from experts (the oracle). We further investigate two active learning strategies in terms of two uncertainty measures (i.e., CLUE and MUE) within the active learning framework. From our experimental results on eight simulation crowdsourcing datasets and four real-world crowdsourcing datasets with three popular consensus integration algorithms, we draw several conclusions as follows. (i) Our active learning framework with the input from the oracle significantly improves the generalization ability of the model learned from crowdsourcing data. (ii) Our two active learning strategies outperform a random active learning strategy.

Traditional Complex Event systems (CEP) did not consider the computation requirements of continuous dynamic behavior such as differential equations. In addition, the event composition rules were predefined before the CEP engine began working. The rule defining task is error-prone and cumbersome. In this paper, therefore, a hybrid complex event service is proposed, which deals with not only discrete events but also continuous behavior computation based on IoT (Internet of Things) resource models. In order to satisfy the real-time constraints of processing IoT events, a divide-and-conquer principle is adopted, where we give a combination theorem such that different events can be processed on different IoT resources and then these processed results can be combined to derive complex events. Based on the formal IoT resources and event knowledge, we define interest goals to direct event composition without enumerating event relation to define event composition rules. We finally present event composition algorithms and evaluation to show our idea.

Summary Even though many IoT (Internet of Things) applications have been implemented based on distributed events, how to construct scalable IoT services is still unclear. In this paper, we first discuss representing physical entities as IoT resources in the cyber world and integrate them into IoT services and then use an event session mechanism to express the coordination logic in an IoT service system. Given their event‐driven models, the scalable IoT services are constructed through decoupling one service at behavior from others, where running atomic service instances with high concurrency is our first focus, and distributed execution of an IoT business process is our second focus. Our last focus is to make each distributed business process execution unit hold its properties in the whole process, which requires modeling the environment as a prerequisite to compute its properties, and some assume‐guarantee rules for composing the services from the environment's perspective. We then propose a platform to support the construction, where according to the behavior decoupling features, one IoT business process is decomposed into pieces of event composition logic and business computation logic, together with separating the data dependency of computation functions in each process fragment, such that it can be concurrently executed and distributed. A practical application is implemented to concept‐prove our work. Copyright © 2015 John Wiley & Sons, Ltd.

Summary With the development of Internet of Things (IoT), many middleware solutions have been proposed for the integration of physical world with the Web. However, most leading middleware solutions provide only limited resource matching and selection functionality. When significant amounts of resources are available, selecting the appropriate resources becomes challenging and time‐consuming. This paper addresses the growing issues of resource matching and selection in IoT solutions. In this paper, we propose a novel resource model to describe the IoT resources in a multidimensional manner. Based on the resource model, a resource matching algorithm that selects the well‐matched resources by matching the similarity between resources is proposed. Moreover, we constructed a combined resource set and used it and OWLS‐TC to evaluate our work comprehensively. Experimental results show that the proposed resource matching approach is more effective and efficient than existing approaches. Copyright © 2013 John Wiley & Sons, Ltd.

With the rapid application of service-oriented technologies, service and data outsourcing has become a practical and useful computing paradigm. Combined use of access control and cryptography was proposed by many researchers to protect sensitive information in this outsourcing scenario. However, the rigid combination in existing approaches has difficulty in satisfying the flexibility requirement of access control for diverse applications. In this paper, we propose a flexible authorization by generating public re-decryption trapdoor. The features of our solution are as follows: simple key management without the need of key derivation for users to decrypt cipher texts, grouping users during authorization to reduce management workload, composing conditions for accessing new resources without generating new keys if the re-encryption keys for atomic conditions have been produced.

Traditional graph configuration software builds monitor screen by integrating user interface components in a block-building way. It is domain-specific, such as a graph configuration system for coal mine. And usually the control logic (also called business) of a graph configuration system for coal mine is not suitable for electricity, yet its user interface and control logic (also called business) are coupled together. In order to solve these problems this paper proposes a UI service composition method based on SCA (Service Component Architecture) and DTS (Domain, Task and Show) models. SCA is going to decouple business from user interface, while DTS is going to model user interface thinking about its reuse. Through experiments, we can see that this system not only can significantly reduce the cost of UI development by DTS, but also provide efficient support for users to participate in business processes.

To solve the problems of traditional reporting system, such as difficult manipulation, high levels of data coupling, this paper presents an ontology-based semantic reporting system. It builds a semantic layer between report designer and data source, where enterprise professional information, relevant properties and metadata about data source are described in ontology language. On the report designer interface, semantic information that saved in ontology library is shown and can be dragged to design the report. Ontology-based semantic layer greatly improves design efficiency and makes manipulation easy, because it seals the technical details of data source.

The relationship-focused and credential-focused identity managements are both user-centric notions in Service-oriented architecture (SOA). For composite services, pure user-centric identity management is inefficient because each subservice may authenticate and authorize users and users need participate in every identity provisioning transaction. If the above two paradigms are unified into the universal identity management where identity information and privileges are delegatable, user centricity will be more feasible in SOA. The credential-focused system is a good starting point for constructing a universal identity management system. However, how to implement a practical delegation scheme is still a challenge although there are some delegatable anonymous credential schemes that were theoretically constructed. This paper aims to propose a practical delegation solution for universal identity management. For this, a pseudonym-based signature scheme is first designed where pseudonyms are self-generated and unlinkable for realizing user's privacy. Next, a proxy signature is presented with the pseudonyms as public keys where delegation can be achieved through certificate chains. Finally, the security of our scheme is analyzed and proved in the random oracle model.

As the convergence between telephony systems and data systems at all levels of the stack, provision of hybrid services that span multiple networks have attracted much more attentions from both academic and industry communities. The Internet of Things (IoT) is a novel paradigm that is rapidly gaining ground which needs to pay special attention to. In this paper, we present the Flexible Hybrid Service Supporting Platform (FHSSP) leverages on Service-Oriented Architecture (SOA) and Web services technologies. Aiming at the dynamic and flexible characteristics of the heterogeneous network environment, we introduced the template reuse based service creation, flexible service execution as well as resource adaptor methodologies, which ensure FHSSP to deliver “User-Centric” hybrid services in a rapid, cost-effective and highly scalable way. Specifically a typical communication Web services based multimedia conferencing system (MMCS) is presented as an illustrative example of applying FHSSP. Finally we conclude the paper with future work.

The merging of telecommunication and Internet domains is a real challenge for supporting the evolution towards the next generation of Web services. Enterprise service bus (ESB) has been regarded as a promising way to support dynamic and agile service integration in distributed heterogeneous environments. As communication services have strong real-time requirements and are based on asynchronous interactions, generic ESB based service integration is no longer suitable. This paper proposes an enhanced ESB based execution platform in which a low-latency service engine has been seamlessly integrated to support flexible communication Web services over heterogeneous networks. The design and implementation of the enhancements, a novel communication Web services based multimedia conference system, the prototype, and some preliminary performance measurements are presented. The performance results are encouraging.

Recent advances in Web services have made it practical to provide communication Web services to enable communication through SOA and package communication capability as services. This paper provides an appropriate implementation to deliver the multimedia conferencing communication components as Web services in order to be used simply by Web service clients in converged applications.

In this paper, we introduce the session initiation protocol (SIP) based multimedia conferencing on Internet, and mainly focus on the design and implementation for conferencing communication services model, such as SIP connection, session management, media control conferencing management, also we provide a prototype. Finally, we give the conclusions.