search

gwu-cs-iot / collaboration

Spring '20 IoT - systems and security class. This is the collaborative half of the class.
https://www2.seas.gwu.edu/~gparmer/classes/2020-01-01-Internet-of-Things-Systems-Security.html
MIT License
14 stars 26 forks source link

Paper discussion: 1a. On Enabling Technologies for the Internet of Important Things #1

Open gparmer opened 4 years ago

gparmer commented 4 years ago

Shared concerns/questions:

Discussion: Should we focus on Auth and LetsEncrypt and replace some existing papers?

albero94 commented 4 years ago

Reviewer: Álvaro Albero Review Type: Critical

Problem being solved Internet is a key technology for the functionality of IoT devices. However, the technologies and protocols used in the internet were not designed for cyber physical systems (CPSs). Using the internet generates latency and security problems in IoT systems that need to be address.

Important areas The main areas of study to address these problems are architecture, coordination and timing, and programming models. Edge computing architecture can provide better latency, due to proximity, and security, as it controls the access to the internet of these devices. Different coordination and timing standards are used and newer are being developed; they should be good enough for IoT systems. Finally, programming models that work asynchronously, like JavaScript, but can also ensure a level of determinism in the order of execution are necessary.

Questions about the survey Section 3a: Why IoT devices cannot have a fixed IP address? Couldn’t they work with private fixed addresses if necessary?

Section 5: I do not understand the excessive focus in real time. If there are isolated systems already deployed and working in real time and performing well with many different functions and capabilities, why adding an edge server that will also communicate with the cloud for some tasks needs so much extra complexity?

Section 3a: When the authors talk about using proximity as a way to authenticate and authorize access to an IoT device, are they only using this condition? Is this working in combination with PKI or passwords?

Critiques about the survey In the security section, the authors do not provide any information or solution for systems that do not have physically constrained access. They just comment that other mechanisms should be developed. In the introduction, they consider cars and trains as important systems, and clearly these are totally accessible to anyone so I believe more explanation and detail should have been given here.

In the robust time coordination sections, the authors explain that the systems should be robust to time errors as these may happen due to unexpected events that affect the timing system. However, they do not go further and explain how this can be done and set an example of a system that can overcome time errors in certain circumstances and recover from them.

AkinoriKahata commented 4 years ago

Reviewer: Akinori Kahata Review Type: Critical

1.the problem being solved. Recently, internet technology is applied to the physical systems, and this change make our life more comfortable. However, compared to conventional internet technology, cyber-physical systems need more reliability include safety and dependability and so on, especially in the area such as factory automation and transportation systems. Traditionally, reliability of these area is secured by isolation, but surrounding environment is changing to open with the internet, then, the technologies for keeping security, time accuracy, safety are needed.

2.most important to the survey. For securing IoIT(Internet of Important Things) reliability, the edge computing technologies, which is placed between IoIT devices and cloud computing, can be a good solution. Specifically, the author shows the possible technologies for enhancing reliability; authentication and authorization method for security, clock synchronization technology and some protocol of time-sensitive networking for coordination and timing, and programming model of temporal semantics for real-time analysis.

3.questions about the survey.

4.critiques about the survey

lrshpak commented 4 years ago

Lily Shpak Critical Review

Problem Being Solved

The Internet was not originally built for physical systems to interact with it, so now with the increasing number of “smart” devices that need to connect to the Internet, it is important for there to be a secure connection to the Internet. This paper focuses on what they call the Internet of Important Things(IoIT), these IoIT systems are safety-critical, meaning that if they are compromised there will be catastrophic effects. The authors of this paper approach this issue by looking at the use of edge computing and clock synchronization.

Main Contributions

They contribute to this issue by providing examples as well as counter examples to fix this issue. The authors argue that the best way to approach the issue of securing the IoIT is to combine the use of real time clocks and edge computing. They talk about different examples of edge computing that could work, as well as different ways to use real time clocks.

Three Questions

  1. How does their system Auth actually work, and where would it be placed within a system?
  2. Would having to provide an edge computing system to keep company’s IoIT devices secure be extremely costly?
  3. Once more and more IoIT devices use edge computing and hackers figure out vulnerabilities, how else would the system be protected?

    Critiques

  4. The jump in the paper from talking about edge computing to real time clocks is a bit confusing, I think they could have added a section that bridged the two, even though they describe how edge computing and real time clocks work together at the end, you read about clocks for a while without any acknowledgment of how they relate to real time computing.
  5. I think they are successful at providing examples of edge computing systems or real time clocks that will not work, this shows that the authors have done their research on systems that already exist and it proves why their system would be the best way to solve the issue.
searri commented 4 years ago

Reviewer: Rick Sear Review Type: Critical

Problem being solved

There is a contradiction between the current Internet of Things programming trends and the highly time-sensitive nature of a lot of IoT devices. However, there are technologies and techniques which can help resolve this contradiction, which this paper surveys.

Important areas

Spans a lot of important areas: the architecture of making secure (verifiable and not easily penetrated) systems to the problems associated with real-time systems (and some possible solutions). Mainly, the paper talks about how using edge computing and well-orchestrating a group of IoT devices has great potential to make them do "important things".

Questions about the survey

Critiques about the survey

Others commented 4 years ago

Name: Gregor Peach

RT: Critical Review

Problem Being Solved

Internet of things devices have been naively implemented on top of off the shelf technology. But that tech was designed for less critical/more ethereal systems. This leads to “smart” physical devices (which can’t be replaced as easily as digital components), that have much shorter lives than the “dumb” products they were designed to replace. Also, physical security and responsiveness have different fundamental characteristics than digital security and responsiveness. Therefore, a lack of green field design has led to insecure and unresponsive devices.

Main Contributions

They suggest a number of design philosophies for IoT. They recommend using a specific framework for authentication and authorization. They also talk about edge computing as a solution for certain problems. A major section of the paper is on timing coordination, maybe in the direction of networked time-coordinated computing.

Three Questions

  1. In intro Internet of Important things mentioned—why the narrowed focus?
  2. Is there a real world example system designed according to the principles laid out in this paper?
  3. Security section feels short, what other security steps can IoT designers take?

Critiques

  1. Synchronized clocks have been dismissed as impractical and unreliable in a data center setting. What reason do we have to think that this approach would work in an IoT setting, which seems even more “real world”?
  2. How is this novel? Edge compute has been established since 2015, and systems like Google Spanner have previously leveraged the time guarantees they’re talking about. (But even that relies on incredibly precise atomic clock information.)
pcodes commented 4 years ago

Reviewer: Pat Cody Review Type: Critical

Problem Being Solved

The Internet of Things suffers from mismatched priorities with the Internet, as the latter was not originally designed to allow for control over cyber-physical systems. As a result, IoT devices struggle in areas relating to efficient responsiveness and robust security.

Main Contributions

This paper highlights a variety of problems the IoT has due to the implementation of the Internet. It discusses some upcoming technologies that can be used to solve the stated problems. It proposes architecture and infrastructure changes to make the IoT more robust.

Questions

Critiques

s-hanna15 commented 4 years ago

Reviewer: Sam Hanna Review Type: Critical

Problem Being Solved: This paper talked about the Internet of Important Things (IoIT) which is Cyber-Physical Systems in which safety is a vital component. In these types of systems, timing, reliability, and safety are all very important; these are all things that the conventional internet was not built to handle. This paper surveys different techniques that can be used to mitigate these risks.

Important Areas: While there were a lot of areas that the paper covered, the four main topics were: edge computing, security, timing, and programming models. While these areas were all important, the timing and programming models were the two areas that were covered the most. The paper covered multiple types of technologies that can be used to help these IoIT systems be safe.

Questions about the Survey:

  1. IoIT devices are all so incredibly different, how would these recommendations work across the different systems?
  2. I didn’t understand section 5b about real-time, I am confused about the relevance of including all of this as it seemed like only two of the six systems were relevant?
  3. How does the use of Edge Computing impact the security implications of the devices?

Critiques about the Survey:

  1. Like many areas of computer science today, I feel like while they talked about security it was one of the smaller sections. I feel like security could have been a larger focus, especially considering how critical these cyber-physical systems can be.
  2. This paper did a good job of describing each section independently, but as all of these are vital to the IoIT devices, time could have been spent talking about how they would interact or how using all of them could impact the overall system.
ericwendt commented 4 years ago

Reviewer: Eric Wendt Review Type: Critical

Overview This papers overviews Internet of Things as a technology and mentions many of the challenges and security concerns associated with the concept. Rather than addressing a single challenge, this paper lists many of the strategies/steps taken to mitigate these concerns, as well as illuminating any resulting pitfalls.

Contributions

Critiques

Questions:

rachellkm commented 4 years ago

Reviewer: Rachell Kim Review Type: Critical

Problem Being Solved

Current standards and protocols for Internet technology in IoT systems are considered unreliable in terms of security and does not guarantee safety for many cyber-physical systems. This paper reviews and attempts to offer a few possible solutions to these problems of time-sensitivity and safety in cyber-physical systems which seek to make use of Internet services by referencing some of the existing technologies and techniques, including those developed by the author’s team.

Main Contributions

This paper identifies and attempts to address some of what the authors consider the major vulnerabilities in IoIT systems. The authors propose architectural approaches such as edge computing as well as their own communication protocols, called Auth, to solve the identified issues. The authors also propose integrating existing TSN technologies such as the IEEE standard for clock synchronization (or accurate clocks in general) with edge computing, paired with advanced time transfer mechanisms, to develop a more robust security in IoIT devices.

Questions

  1. I didn’t quite catch how the authors’ proposed authentication and authorization solution, Auth, would take care of the IP address situation for IoT devices, but this may be rooted in my misunderstanding of what it does exactly. How does this actually work?
  2. 5C discusses the disadvantages of AAC frameworks, but I didn't understand the spiel about temporal semantics and logical clocks. Are they suggesting that logical clocks should be the newer or better "metric" for real-time?

Critique

  1. The author mentions several notable technologies and provides in depth explanations, functions, and use cases for clock synchronization, time transfer protocols, and what they mean by "real-time", but I personally felt that there was a lack of an in-depth explanation for the technologies developed by the authors (i.e. the Auth and CapeCode). For a paper that attempts to provide a survey on the tools for potential solutions for the problems surrounding IoIT, I felt that they failed to explain their own proposed technologies.
  2. I felt that the abstract and perceived focus of this paper was misleading, considering the giant focus on synchronization, time coordination, clocks, and real-time which consumed nearly more than half of the entire paper.
rebeccc commented 4 years ago

Reviewer: Becky Shanley Review Type: Critical

Problem being solved

Making Cyber-Physical Systems that are critically important and safe, reliable, and secure is really hard. This paper studies some of the technologies it deems most prevalent in providing Important Things with these things. Then, it spends the end of the paper discussing ways that these technologies have been utilized together in programming models to provide the aforementioned attributes.

Important areas

The survey studies technologies, such as Edge Computing, Security (authentication/authorization and availability threats/resiliency), and Timing (clock synchronization, robust time coordination, timeliness of message deliveries). It specifically studies elements of these technologies that provide safety, reliability, and security for IIoT devices (Internet of Important Things). The survey also discusses programming models that combine all of the aforementioned technologies to meet all of the unique requirements of IIoT devices.

Questions about the survey

  1. Is there a meaningful difference in edge computing when it’s mobile or immobile? If an edge computer meets all the requirements of being considered “edge” (internet/network capability, acts as an internet gateway, physically close) what difference does it make if the edge computer moves with the device or not?
  2. How does edge computing provide security in non-isolated systems? I can see it being a good solution to timing but if a system has multiple resources connected through edge computing how is that more secure than not being connected through the edge?

Critiques about the survey

  1. Although Edge Computing seems to be an integral part of the majority of this survey, the technology itself was skimmed over a lot. In Section II (Edge Computing) a distinction is made between “mobile” and “immobile” edge computers, but this distinction is not mentioned again in the paper and thus led to me feeling like I missed something fundamental about what an edge computer is. However, this distinction is not mentioned again in the paper when discussing edge computing.
  2. The order that Real-Time definitions came in the paper was confusing to me. If they had begun the Programming Models section with it to contextualize how AAC and Logical Clocks with Real-Time I think it would have made more sense. By the time Logical Clocks began to detail AAC again, I was wrapping my head around vague definitions of different kinds of Real-Time systems
huachuan commented 4 years ago

Reviewer: Huachuan Wang Review Type: Critical

Overview This paper focused on the dependability and safety of Things. It surveys architectural approaches, communication protocols, and programming models that promise to bridge the gap between internet technology and the physical systems. Where the internet and things have different requirements, respectively, regarding timeliness and security. It argued that the smart gateways hosted on edge cloud-based services could provide tighter control over timing and security. This paper also explained how time-sensitive network technology could increase the reliability of the IoT.

Contribution This paper has shown that computers can enhance reliability and resilience as well as improve scalability. It emphasized that a critical enabler for the realization of the IoIT is synchronization and time-aware communication protocols. This paper also explained how edge computers could handle secure communications between Things that allow reliable low-latency connections and achieve real-time responsiveness.

Questions

  1. Questions on the security part. This paper gives an example that attacks for traditional internet services, for example, DDoS. Why is IoT more vulnerable to this kind of attack?

  2. Questions on the coordination and timing part. This paper states that the high-precision clock synchronization combines with edge computers, which can function as gateways to ensure controlled timing on the local area networks with deterministic latencies and reliable delivery. The coordination of the physical time is expensive or not? Software defined network (SDN) can manage the workflow to maximize capacity. However, when compared with time sensitive network (TSN), why TSN potentially can provide much better bounds on latency?

Critiques

  1. This paper is well structured and very informative. Especially in the Real-time part, it provides the illustration, examples, questions, and solutions on each aspect of the definition.

  2. The floating-point numbers are an approximation of the real number, it cannot do equality tests, and its addition is not associative. However, in this paper, it only states that the problem is solved without indicating how this was solved and there is no related reference provided. I found a reference "What Every Computer Scientist Should Know About Floating-Point Arithmetic" (https://docs.oracle.com/cd/E19957-01/806-3568/ncg_goldberg.html) gives detailed instruction. The numerical analysis devoted to studying the numerical stability of algorithms, this helps with understanding the complex computation of floating points.

hjaensch7 commented 4 years ago

Reviewer: Henry Jaensch

Review Type: Critical Review

Problem Being Solved

As the internet of things is expanding security and latency concerns have become important. The internet was not designed to support embedded systems or systems that interact with the physical world. The time and security constraints that come with a cyber physical system are different that strictly digital constraints. This paper surveys technology that has advanced to help manage timing and security in the internet of things.

Main Contributions

The paper recognizes where standard digital solutions to problems like authentication will not be adequate for the internet of things. Edge computing is considered as a way to mediate authentication at a closer proximity to the Things while also avoiding a single point of failure. The paper also highlights the issue of timing and coordination within IoT. The protocols used by the internet are not particularly concerned with robust timing which can be crucial to an important Thing. The largest portion of this paper is spent discussing how IoT developers are addressing timing constraints of real-time devices.

Questions

  1. While edge computing might make security easier, will it actually be safer to have essentially shards of secret keys on a local edge?
  2. How does the edge computer get it's software update? Firmware failing is a huge reason why smart devices have bad lifespans so how do we update the edge safely and reliably?
  3. There is a brief mention of SDN being used to improve latency and perhaps orchestrate IoT timing. I wonder what this would look like, and if the resources spent on coordination would allow SDN to make useful improvements in routing.

Critiques

nikorev commented 4 years ago

Reviewer: Niko Reveliotis Review Type: Critical

Problem Being Solved This paper discusses the techniques being applied to our existing network infrastructure (which was originally built for information systems) to allow for the development of cyber-physical systems. These techniques aren't limited to the physical infrastructure, but also communication protocols and programming models. Specifically, they are examining the Internet of "Important" Things, which are systems that have the highest requirements for safety (such as self-driving vehicles and factory robotics) and how they can be integrated to our network infrastructure.

Main Contributions

Three Questions

  1. In section 3a, they discuss how certificate authorities are unable to give our certificates at the rate IoT is growing. The paper then discusses the automation of this process through a service called Let's Encrypt. How does the technology behind generating a successful and safe online certificate done under automation? Not necessarily the encryption of the public and private keys, but how is it verified across machines, or how does Let's Encrypt determine whether the request is legitimate?

  2. The paper briefly listed the network protocols (HTTP/TCP/UDP). I understand with TCP you ensure that data was successfully received vs UDP where you continuously send packets up to a recipient. In the context of IoT, are there situations where UDP would be acceptable versus TCP? From what I see, although latency is a problem within these devices, confirming that data was successfully sent seems much more important. When wouldn't this be the case?

  3. In section 3a, when they refer to fixed IP addresses as a security risk are they specifically referring to the global network? I use DHCP reservations to assign static IP addresses to a few devices that I need to access remotely within my home network network (SSH/SFTP). Would this be considered a security risk, or would my router be the first wall of entry before this is a cause of concern?

Three Critiques

  1. Section 4c only briefly discusses the current development of reducing latency within WANs (Wide Area Networks) with wireless connections. To develop a paper discussing the "Important" IoT systems without divulging enough time into wireless latency reduction seems to be a gaping hole in this paper. For example, low latency will allow self driving cars to communicate with each other to make the cars "smarter" by providing them more information to work with, but if that data is old then the information is of significantly less use.

  2. The paper's programming models section focused on Javascript. Not to dissuade from JS development, but many embedded systems are working on limited hardware and have to use lower level languages such as C. These systems aren't necessarily linked to creating a webpage, but rather direct communication between other IoT devices.

  3. Auth's description was limited to a single paragraph. Examining the inner-workings of Auth, and how it could become the future of credential verification would've made their product shine a lot brighter in this paper. This critique is a bit nit-picky; I understand they were trying to give a more general outline of the future of our internet to incorporate IoT devices. I just find this idea of multi-authentication servers from their description to be interesting.

zacharied commented 4 years ago

Reviewer: Zach Day Review type: Critical

Overview

The paper provides a broad overview of the state of security on the "Internet of Things" scene, along with reviewing popular and upcoming technologies that could be used to enrich IoT functionality and security with a strong focus on technologies that can be applied to real-time systems. Specifically, they focus on devices which utilize the internet to share environmental information with each other. They draw a distinction between consumer "smart" devices and safety-critical systems like robots and vehicle components, which they describe as the "Internet of Important Things." The focus on IoIT gives rise to the aforementioned focus on enabling real-time concurrency.

Main contributions

Security is critical in any system connected to an open network, but systems for which failure could result in catastrophic damage or loss of life, ensuring security is critical for avoid disaster. The authors converge the current concerns with IoIT security with another key issue, timing. Although security and timing are fairly unrelated subjects, they both play a huge role in preventing Thing-induced accidents. The paper's main contribution is creating an overview of humanity's progress thus far in researching security and timing among safety-critical IoT devices.

Questions

Critiques

mjhegarty commented 4 years ago

Reviewer: Michael Hegarty Review type: Critical

Summary of Problem

IoT is a new technology that has issues in being integrated into the current internet model. IoT has new domains of security vulnerabilities not seen in other devices, and security is often not a primary concern of IoT designers. Devices also have problems fitting into the current centralized internet model, especially in the areas of time-critical operations, timing, and authentication.

Summary of solution

The paper suggests edge computing as a way to bridge the gap between the cloud and IoT. They discuss various security issues involving IoT devices and how due to the criticality of certain tasks that IoT will take on, new issues arise that traditional computer networks wouldn't be as concerned about. They also discuss timing in an IoT system and how to implement clock synchronization. Lastly they go in depth about how the programming model of IoT is atypical due to its real time nature.

Questions

Critiques

gkahl commented 4 years ago

Reviewer: Greg Kahl

Review Type: Critical

Summary

This paper explains and analyzes the difficulties and necessary technology for the development of a secure Internet of Things. They look at both the technology for the Internet of Things and how it can be used for what they call the Internet of Important Things.

Main Contributions

The main areas that they looked at throughout the survey were first security issues such as Authentication, Authorization, and Integrity. They next looked at the methods of distributing computing to edge devices, and finally analyzed the multiple ways in which IoT Systems keep track of time and synchronize actions and clocks.

Questions

Critiques

RyanFisk2 commented 4 years ago

Reviewer: Ryan Fisk Review Type: Critical

Summary Some of the biggest obstacles to widespread IoT adoption are the limitations placed on it by current internet protocols. The centralized structure of the current internet is prone to latency when used by many IoT devices. Servers also need to be secure and have the ability to verify the devices connecting to them. However, it can be difficult to keep track of authenticated IP addresses when they are being dynamically assigned to each device. The latency also creates a timing issue, since the servers receive data at a later time after the device records it. That latency needs to be reduced before real-time systems can be fully implemented.

Main Contributions This paper looked at the ways that internet protocols and infrastructure could be better adapted to work with IoT devices. Edge computing would solve many of the issues that the paper attempts to tackle. Offloading some computation from the main cloud to smaller edge clouds would reduce latency, therefore allowing for closer to real-time computation. Since the edge cloud would be more local to the devices (the paper uses LAN), it would have fewer devices to keep track of and less volatile IP addresses, which would make authentication of devices faster and more reliable.

Questions I understand how asynchronous atomic callback works in a web browser, for example, but I was confused how the paper proposed to use them in an edge cloud system. Would the AAC be between the main cloud and the edge or between the edge and devices?

The whole concept of labeled logical clock domains is still confusing to me. How can the processor ensure than at any given time, processes A and B have both happened exactly n times. What if the processor was in the middle of process A or B at that time? Would the processor delay the synchronization until it did as many of process A or process B to make sure both had happened n times?

Critiques My first critique is that when talking about the edge cloud, they stopped short of talking about how the edges would connect to the main cloud. They go in depth with how the edge would be set up over LAN, but the whole network would still need to be connected to the larger cloud.

My final critique is about the correctness criteria to control timing from section 5b. Any kind of function to test the correctness of the input would take up time, and in cases like streaming video or video conferencing, getting the data out quickly is more important than ensuring every packet is correct.

chandaweia commented 4 years ago

Reviewer: Cuidi Wei Review Type: Critical

Problem being solved This paper explains how time sensitive network technology can be leveraged to reliably orchestrate a multiplicity of things, and how augmenting our programming models with a well-defined notion of time can make systems more deterministic and more testable. Today’s IoT solutions are often plagued by problems and IoT devices often lack adequate security.

Main contributions Focusing on Things where dependability and safety are extremely important, this paper discusses and surveys architectural approaches, communication protocols, and programming models that promise to bridge the gap, enabling the use of the Internet technologies even in safety-critical, cyber-physical applications such as factory automation and transportation. Also, in this paper we discuss and survey several technological innovations that we believe will be instrumental in the development of a safe, secure, and reliable IoIT.

Questions about the survey 1.For the Auth, how to securely migrate to other available Auths to continue authentication and authorization services. 2.What’s the difference between Time Sensitive Network(TSN) and the common Network?

Critiques about the survey 1.For a security model, the paper proposes that a device can get physically close to another device can be granted access to services. Is there any problem? For example, this model has a big problem that if a stealer comes to the house, then he can control the devices. (p.4)

  1. Edge computing indeed has its own advantages, but does it has some defects? For example, the outdated data may influence some computing results?
reesealanj commented 4 years ago

Reviewer: Reese Jones Review Type: Critical Review

Problem Being Solved: The paper addresses the fact that the IoT has created a whole new set of security problems that will need to be dealt with in the coming future as IoT becomes more and more expansive. The paper also goes into the fact that the domain of IoT does not fit very well into the current model of the internet, and they present new issues with regard to real-time applications of technology. Main Contributions: This paper first contributes ideas related to security problems that come alongside the IoT and Real-Time computing. Also, the paper contributes to the domain of working with the internet and the IoT by discussing the viability of edge computing and the cloud in order to help the function of IoT devices.

Questions: 1) (This may be because I don't fully comprehend edge computing's benefits) How does/could edge computing benefit devices connected to the whole world in terms of security if they're already connected worldwide does that not present another vector for attacks? 2) Is there ever a point within the creation of a system with edge computing being used more effectively where the benefit with regard to the increased security is outweighed by the physical cost to create the system in the first place? 3) (This is also most likely me not understanding the definition for real-time systems enough) How is it possible that creating a system for real-time computing with edge nodes not create a considerable overhead for computation? I understand the network being more local, but if for example, the device connecting to the node has to then branch off to something on the other side of the world has there not been wasted compute power in that operation?

Critiques: 1) I felt as though the end of the discussion on security was not concrete enough. It felt to me as though the conclusion the authors left off on was not solid enough to move forward with concrete actions. 2) The way this paper was organized (to me at least) feels like there was not enough discussion into the vast network of potential IoT devices, that is to say, that I felt like the authors did not address the differences between different devices and their needs.

bushidocodes commented 4 years ago

Reviewer: Sean McBride Review type: Critical

Problem Being Solved

"On Enabling Technologies for the Internet of Important Things" seeks to identify the gap between the capabilities provided by the Internet / web platform and the requirements of cyber-physical systems (called "Important Things") in the areas of architecture, communication protocols, and programming models. In these various models, the authors seek to review ongoing research involved in closing these gaps and identify remaining areas of research.

Main Contributions

  1. Defines a narrow subset of IOT called the "Internet of Important Things," which more narrowly corresponds to "things where dependability and safety are extremely important, such as factor robots, trains, and cars."
  2. Based on identified areas of misalignment between existing Internet technologies and the requirements of cyber-physical systems, organizes major research areas in the categories of Edge Computing, Security, Coordination/Timing, and Programming models. Within each category, provides more granular decomposition into research problems and provides a detailed discussion of ongoing research and related works (papers, open-source, standards)

Questions about the Research Paper:

  1. The paper laments that programming languages that include timing constructs have largely been unsuccessful and faded from popularity (e.g. Ada), and the paper discusses the closest facilities offered by JavaScript's setTimeout and setInverval. What are the advantages of having these constructs in the programming language itself and not in a library?
  2. The paper suggested that a key reason that deterministic modeling paradigms have not caught on has been because ISAs do not provide instructions to control timing beside timer interrupts. Have there even been such instructions in an ISA, either a real-world CISC ISA (VAX, etc.) or a dead-on-arrival one (Intel i432)? How did operating systems exploit this? Furthermore, can't RTOSes do a sufficiently good job of this without such support?
  3. The paper discusses problems of prioritization on edge devices because edge workloads are highly dynamic and you can't know the competing task set a priori. It then suggests the need for admission control (rejecting jobs if not able to service them properly) and mentions the need to develop new technologies. Is this assessment of edge prioritization correct? If so, what new technologies would need to be developed?

Two Critiques about the Survey

  1. Towards the beginning, the survey very briefly mentioned the idea of edge device and IOT device as "roles," including the idea of either of these roles could be run by a mobile device, causing the relationship between IOT and edge devices to be more ephemeral. However, this idea did not appear in the following discussions. I would imagine this sort of mobility would impact these issues dramatically.
  2. Perhaps appropriate for an IEEE paper, but the discussion around local clocks and time synchronization was substantially felt out of balance with the other research areas.
anguyen0204 commented 4 years ago

Reviewer: Andrew Nguyen Review Type: Critical

Problem Being Solved: The relationship between cyber and physical phenomena continuously grow to become more complex and expectedly intertwined as time progresses. "On Enabling Technologies for the Internet of Important Things" explores this concept with the premise that security, implementation, application, and time complexities are among the many concepts that tie into the Internet of Things.

Main Contributions: There are several main points that the paper delves into. These subjects would discuss about how the infrastructure of IOT can be vulnerable (especially in regards to security) and at the same time be adequately applied to multiple projects to have a more breadth and reliable use. In addition, edge computing would contribute into the idea of stable network connections coupled with reliable low latency communications. Consequently, Timing and the coordination of it can be overlooked and if not thoroughly observed, can have negative or impactful results.

Questions:

  1. The Paper compares that a phone would not be an effective edge computer. It doesn't provide further reasoning so how is it more ineffective due to the fact that it's mobile despite being able to properly make connections and interactions with various Things?
  2. They mention "robust" time many times throughout the paper with the expectation that the reader is assumed to understand it. To a reader like me, I don't exactly know what qualifies as being robust. How smoothly it runs? How fast it runs?

Critiques:

  1. The information around IEEE does not flow well and the information jumps too much making it hard to distinguish and understand what message that section is trying to convey even though it was informative and listing the various differences. It wasn't until afterwards that I felt the information mattered more making me feel if it was necessary earlier.
  2. Edge Computing is discussed frequently but at some moments the concept of itself merged with the cloud are brought up. I would have liked to see more of these concepts explored and discussed especially real-time data analytics and a hybrid cloud/edge architecture
themarcusyoung commented 4 years ago

Reviewer: Marcus Young Review Type: Critical

Problem Being Solved The Internet's protocols and principles were designed for interacting with information systems, not cyber-physical systems (CPSs). Current Internet technology is widespread and valuable to the IoT, but is slow, lacks quality of service features and fails to physically secure CPSs.

Main Contributions This paper aims to bridge the gap between the internet's protocols and principles and cyber-physical systems by enabling Internet technology to be used in safety-critical CPSs such as factory automation and transportation. The paper calls these safety-critical CPSs IoITs or "Internet of Important Things". Specifically, this paper argues that smart gateways hosted on edge computers are a great complement to the Internet's cloud based services for the IoITs.

Questions

Critiques

jacobcannizzaro commented 4 years ago

Reviewer: Jacob Cannizzaro Review Type: Critical

Problem Being Solved

This paper went over many of the problems facing IoT devices and networks currently. One problem has been that IoT devices have typically been created to be sold as quickly as possible instead of making sure that they provide timely, reliable, and secure operations. This combines with the fact that many of these devices rely on cloud services, which could potentially go out of business, leaving useless devices. Problems like this, unpatchable firmware, and a general lack of security in IoT devices shows the use for edge computing as talked about in this paper.

In terms of security, there are some notable issues in today's widely available authentication and certificate type protection. While certificates can be created for stable corporation domains, it would be impossible with given systems to issue each IoT device. With human centered certificate issuing this is obviously a problem with the pure number of Things coming into existence. Even with more advanced certificating protocols like Let's Encrypt won't work with the dynamic nature of Things in the network (IP's change).

In terms of edge computing, there are is also a lot of background into current network timekeeping protocols to show how these networks interact with devices. There are some problems with many of these, for example GNSS (the dominant technology) which is has many problems due to its high frequency waves. These include natural interference as well as relatively easy to implement malicious attacks including jamming.

Main Contributions

This paper goes in depth explaining how the use of edge computing can greatly enhance IoT network/device reliability, security, and especially scalability. Edge computing can provide everything from local access control, highly efficient security protocols such as proximity based authentication, and more reliable and effient operation of Things. Edge computing as presented is not meant to replace cloud operations. In fact it can help to work with cloud computing when a device needs an agglomeration of data from the cloud. It can offer processing pre-cloud that allows filtration of raw data into smaller packets to be sent out, which tends to yield lower latency, less storage needs, and increased security.

This paper goes in depth into talking about the time keeping protocols and goes on to make assumptions about these for the future. For example, with eLoran, they assume it will become prevalent as they discuss edge computing because these time-keeping network functions are critical for IoT devices as well. Even though currently only operational in UK, this paper explains how lower frequency waves lead to much safer communications because they are harder to jam, are less at risk to natural interference, and can penetrate indoors (important for large factory networks of IoT devices). These increasingly effective and resillient time keeping measures are shown to be critical to the evolution of the Internet of Important Things (Things that require low-latency secure communication protocols).

Questions

  1. What is homomorphic encryption?
  2. Why would software defined networks "surely" degrade accuracy if they provide quicker capabilities to route traffic?
  3. Is eLoran harder to jam and spoof simply because of it's high power? As in an attacker would just need a lot more energy to produce a effective tool?
  4. Could we go over the difference between representing Newtonian time vs. the quantized superdense model of time on computers? Why have there not been ways to more accurately compare floating point numbers and how does this other model get around that?

Critiques

  1. I feel that the paper gave a lot of hopeful uses for edge computing when it comes to security but doesn't offer many solutions to the problems. It offers very good options for proximity based authorization such as in a factory but sort of skips over the case where proximity can't be a factor. They high level explain Auths but don't really explain how this works or how it gets around relying on remote servers or connections.
  2. There were times in this paper when they mentioned a new technology and then didn't really provide any context or background information. It does say that they aren't mature enough yet for their use to be completely known but then why did they bring them up at all? They mention Homomorphic encryption blockchain decentralization techniques when talking about security and the quantized superdense model of time when talking about timing and failed to really give context or reasoning for any of these little additions to the paper. It sort of came off as confusing and I wish they had either not included it or explained it more robustly.
mralexjacobson commented 4 years ago

Reviewer: Alex Jacobson Review Type: Critical

The paper defines safety-critical systems, such as self driving cars, as the Internet of Important Things. The Internet of Things has issues such as security, and the IoIT has the issue of timing. A self driving car must apply its breaks at the proper moment, or else there can be real life consequences that threaten physical safety. This paper discusses ways to ensure that important time constraints can be met/improved.

Contributions: Using edge computing to offer services to devices that the edge computer is physically close to allow reliable, low latency communications. Edge computers also can improve security by keeping data local, isolating the network, and authenticating things. Furthermore, the TSN task group will be releasing standards for the internet that improve coordination and timing, given that the internet was not designed with those things in mind.

Critiques:

  1. The paper seems to rely on aggregating the work of others and previous work that the authors have done. It is interesting that examining prior work and work that will be done in the near future can result in a new paper that accomplishes or lays out a vision for something new. Almost like mixing and matching.
  2. The paper assumes that high precision clock synchronization combined with edge computers to achieve networks with deterministic latencies and reliable delivery compatible with the internet will become widely deployed. That seems like a bold assumption, so what is the likelihood that those networks actually do become widely deployed?
  3. The paper poses the question "How can measurements of physical time be coordinated to sufficient accuracy across networks?" It discusses how to coordinate time across a LAN network, but what about across multiple networks?

Questions:

  1. Why do we need both authentication and authorization? If a connection is authentic, and we know what it is, why does it need to be authorized? Why can't we just block an action from an authentic connection that we do not want it to do, rather than explicitly authorizing different things.

2.The paper kept going on about temporal semantics, and states that certain temporal properties should be elevated from quality metrics to correctness criteria. First of all, I am a bit confused on what a temporal semantic is. And second, why should certain ones be elevated from quality metrics to correctness criteria, and what is the difference between those two things? If something is of high quality, is it not likely correct?