IEEE INTERNET OF THINGS JOURNAL, VOL. 5, NO.

2, APRIL 2018 871

A Reference Model for Internet

of Things Middleware
Mauro A. A. da Cruz, Joel José P. C. Rodrigues , Senior Member, IEEE, Jalal Al-Muhtadi,
Valery V. Korotaev, and Victor Hugo C. de Albuquerque, Member, IEEE

Abstract—Internet of Things (IoT) is a term used to describe I. I NTRODUCTION

an environment where billions of objects, constrained in terms
HE TERM Internet of Things (IoT) is credited to Kevin
of resources (“things”), are connected to the Internet, and
interacting autonomously. With so many objects connected in
IoT solutions, the environment in which they are placed becomes
T Ashton as, in 1999, he started a presentation entitled
“That ‘Internet of Things’ Thing” [1]. From then, enormous
smarter. A software, called middleware, plays a key role since contributions, such as security, connectivity, energy efficiency,
it is responsible for most of the intelligence in IoT, integrat- and much more, were made on the topic. Currently, IoT is con-
ing data from devices, allowing them to communicate, and make
sidered a relevant topic for researchers, consumers, and service
decisions based on collected data. Then, considering requirements
of IoT platforms, a reference architecture model for IoT mid- providers. Since its beginning, the term has suffered mini-
dleware is analyzed, detailing the best operation approaches of mal modifications. Nevertheless, the basics are still the same.
each proposed module, as well as proposes basic security features IoT can be described as a fancy term for a scenario where
for this type of software. This paper elaborates on a systematic anything may be inserted in a network, be uniquely identi-
review of the related literature, exploring the differences between fied, and interact with minimal human intervention [2]–[4].
the current Internet and IoT-based systems, presenting a deep
discussion of the challenges and future perspectives on IoT mid- These things can belong to the real world (physical things)
dleware. Finally, it highlights the difficulties for achieving and both from inanimate pieces and to living animals, or the vir-
enforcing a universal standard. Thus, it is concluded that mid- tual world (virtual “things”) that only exists in a simulation
dleware plays a crucial role in IoT solutions and the proposed environment [5]. To clarify, a thing is an ordinary device that
architectural approach can be used as a reference model for IoT can be uniquely identified and connected to the Internet. Then,
middleware.
if users or applications have access to the information and
Index Terms—Internet of Things (IoT), middleware, middle- communicate with these things (objects) through the Internet,
ware architecture for IoT, reference model it can be considered IoT scenario.
Since 2015, the smartphone has surpassed the laptop as the
most important device for connecting to the Internet in the
U.K. and, from 2008, there are more devices connected to
Manuscript received November 21, 2017; revised December 10, 2017;
accepted December 11, 2017. Date of publication January 23, 2018; date the Internet than all the world population [6]. It is expected
of current version April 10, 2018. This work was supported in part by that, by 2020, about 50 billion objects may be connected to
the national funding from the Fundação para a Ciência e a Tecnologia the Internet [7]. At first glance, it might seem an exaggerated
under Project UID/EEA/50008/2013, in part by the Government of Russian
Federation under Grant 074-U01, in part by the Finatel through the Instituto number (and, maybe, it can be), but history has shown that, as
Nacional de Telecomunicações (Inatel) Smart Campus Project, in part by the physical size and price of certain technologies reduce, more
the Brazilian National Council for Research and Development (CNPq) under people can access to them and, consequently, their presence
Grant 309335/2017-5, in part by Finep, with resources from Funttel through
the Centro de Referência em Radiocomunicações Project of the Inatel, Brazil, becomes ubiquitous in daily life.
under Grant 01.14.0231.00, and in part by the Research Center of College of Considering the IoT definition, it is easy to conclude that
Computer and Information Sciences, King Saud University. (Corresponding IoT follows the basic principle of things “speaking” the same
author: Joel José P. C. Rodrigues.)
M. A. A. da Cruz is with the National Institute of Telecommunications, language, using technologies that perform a good commu-
Santa Rita do Sapucaí, Brazil (e-mail: [email protected]). nication among them. To illustrate it, imagine the following
J. J. P. C. Rodrigues is with the National Institute of Telecommunications, scenario: an interesting woman profile is spotted on a social
37540-000 Santa Rita do Sapucaí, Brazil, with the Instituto de
Telecomunicações, 1049-001 Lisbon, Portugal, with Technosphere Safety, network, and a conversation is initiated through the chat. Both
ITMO University, 197101 Saint Petersburg, Russia, with the University of realize that one speaks English and the other Russian. The
Fortaleza (UNIFOR), Fortaleza 60811-905, Brazil, and also with the College conclusion is simple. Despite having a direct way to com-
of Computer and Information Sciences, King Saud University, Riyadh 11653,
Saudi Arabia (e-mail: [email protected]). municate, they do not understand each other, as they are just
J. Al-Muhtadi is with the College of Computer and Information sending/receiving meaningless data (content). Therefore, none
Sciences, King Saud University, Riyadh 12372, Saudi Arabia (e-mail: of them can make meaning of it. The same principle is applied
[email protected]).
V. V. Korotaev is with Technosphere Safety, ITMO University, 197101 Saint when things interact regardless they have an Internet connec-
Petersburg, Russia (e-mail: [email protected]). tion. If they cannot interpret each other, the communication
V. H. C. de Albuquerque is with the Post-Graduation Program in Applied will be futile and does not exist. Other applications of IoT
Informatics, University of Fortaleza (UNIFOR), Fortaleza-CE 60811-905,
Brazil (e-mail: [email protected]).
can be widely found in the literature and industry (raw water
Digital Object Identifier 10.1109/JIOT.2018.2796561 management and smart homes, for instance), and, mainly,
2327-4662 c 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission.
See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
872 IEEE INTERNET OF THINGS JOURNAL, VOL. 5, NO. 2, APRIL 2018

health fields for remote healthcare monitoring and control of or even political reasons. Power sockets are a notable exam-
vital signs from wearable sensors. Thus, requiring a robust ple, they exist for at least a century, and different standards
middleware software system to mediate these interactions. are adopted across the globe. Big tech companies appear on
Without middleware solutions, programmers must read the member list of more than one of the mentioned initia-
a new software specification every time they integrate new tives: Intel (5), Cisco (4), Ericsson, Microsoft, Qualcomm,
software packages, turning these tasks difficult and very time- LG (3), and Bosch (2). Take the open connectivity founda-
consuming [8], [9]. In this regard, numerous organizations tion, for example, it supports IoTivity [11] and Alljoyn [12],
struggle and prefer integrated solutions from the same ven- despite both being frameworks that are addressing device con-
dor, even when they are insufficient or too complicated for nectivity. It is easily inferable that tech companies are not sure
their needs. In IoT, organizations and users will use multiple what standard will prevail and are not willing to fully commit.
(and incompatible) software. In fact, middleware is one of its Another aspect of the standards competition is that besides the
enabling technologies [3], [10]. Recognizing the crucial role mentioned initiatives, other traditional standardization entities,
of middleware in IoT environments, they are the focus of such as IEEE, third generation partnership project), among
this paper. Then, the main contributions of this paper are as others, are developing standards for IoT. With so many entities
follows. developing competing standards, another question emerges,
1) A deep review of the state of the art on IoT middleware what is the longevity of such standards, also, what happens
platforms. when a standard is established, and another that is superior
2) A reference architecture model proposal for IoT mid- is developed. Therefore, expecting to reach interoperability
dleware detailing the best operation method for each among devices by enforcing a universal standard is somewhat
module. innocent.
3) Proposal of security features that IoT middleware should
comply for a safer IoT environment.
4) Deep discussion on the difficulties of achieving a univer- A. Connecting to the Internet in IoT
sal standard for IoT, as well as the differences between In IoT, most objects are constrained in resources. For this
the regular Internet and the IoT. reason, nearly everything that works on the current Internet
This paper also highlights the importance of IoT middleware requires a lightweight IoT version [13], [14]. A rapid analy-
and their crucial role. sis of the most common wireless methods of accessing the
The remainder of this paper is organized as follows. Internet reveals that the current Internet protocol stack does
Section II provides a background on the difficulties of achiev- not take the limitations of IoT into account. Wi-Fi (IEEE
ing and enforcing a universal standard. Then, it provides 802.11 a/b/g/n/ad/ac) is not battery efficient, does not cover
a background on how Internet connectivity is slightly differ- a large area, and does not support a high number of end-
ent in IoT comparing to the conventional Internet due to their devices. For this reason, alternatives, such as Bluetooth 5 and
requirements. Section III provides a simplified IoT layered IEEE 802.15.4 are being deployed in IoT solutions. Bluetooth
architecture. Then, highlights the platform layer by showing 5 is the most recent version of the mainstream Bluetooth
their requirements and considering three categories of IoT standard. Like Bluetooth 4.2, Bluetooth 5 also supports IP
platforms. Section IV defines IoT middleware and how they networks [15] (Bluetooth’s IP capabilities are rarely explored
operate. This section also details some closed and open-source by end-users). IEEE 802.15.4 is a standard for low-rate wire-
middleware solutions. Section V describes the operation of less personal area networks that specifies the physical and
relevant modules of a model IoT middleware to meet IoT MAC layers of the OSI model [15]. The most common imple-
requirements, and also proposes basic security features that mentations of IEEE 802.15.4 are IPv6 over low power wireless
middleware should comply for a safer IoT. Open issues and personal area networks (6LoWPANs) and ZigBee. 6LoWPAN
research challenges are identified and discussed in Section VI, is an Internet engineering task force approach that compresses
and, finally, Section VII concludes this paper. and encapsulates the IPv6 headers, then accommodates them
on the frame IEEE 802.15.4 [15]. ZigBee was developed and
maintained by ZigBee Alliance. It is famous for its mesh
II. S TANDARDS C OMPETITION topology, but it supports other topologies, such as star and
There will be different devices from different brands tree [15]. The most prominent advantage of 6LoWPAN is that
and vendors in IoT. Currently, most IoT devices are only it natively supports IP networks. When using ZigBee or tra-
compatible with devices from the same brand, or part- ditional Bluetooth, a gateway is necessary to communicate
ner brands. For this reason, several standardization initia- with the Internet, which increases overhead. All technologies
tives, such as IPSO Alliance, AllSeen Alliance, OneM2M, that do not support IP natively use a similar concept to con-
Openconnectivity, Fiware, OpenFog, OpenDaylight, and many nect to the Internet. ZigBee recognized the importance of IP
more were created. All of these initiatives are developing networks and releases ZigBee IP that uses many 6LoWPAN
reference architectures or standards for all IoT layers with concepts, especially the header fragmentation and compression
the purpose of delivering a more efficient and sustainable scheme [15].
IoT. The problem with standards is that history proves that Another wireless method of accessing the Internet is
different regions adopt different standards because of many through 3G/4G networks. Both have the same problems as
factors that can range from price, implementation complexity, Wi-Fi regarding IoT environments. For this reason, wireless
DA CRUZ et al.: REFERENCE MODEL FOR IoT MIDDLEWARE 873

Fig. 1. Illustration of Sigfox/LoRa overall architecture.

long-range network solutions, such as Sigfox, LoRa, and IEEE

802.11ah (HaLow) [16] were developed. These networks con- Fig. 2. Simplified IoT layered architecture.
sume less battery on end-devices and provide wide area cover-
age. Both LoRa and Sigfox need a gateway that interfaces with
end devices. This gateway connects to a backhaul that provides Internet, this inefficiency is worth the advantages, but in IoT
a connection to the Internet [17], this is depicted in Fig. 1. One every byte counts. Therefore, binary encodings such as Apache
of the differences between LoRa and Sigfox is that Sigfox Thrift and Google’s Protocol buffers are better suited for most
operates similarly to a traditional ISP, where the user has to IoT devices [25]. Despite JSON inefficiency in IoT, many
subscribe to the service in order to use it, while LoRa offers devices in IoT environments still use it. However, to maximize
technology that any user can purchase, install the infrastruc- efficiency, they should only use JSON encoding when strictly
ture, and use the network at will. The advantage of IEEE necessary.
802.11ah over LoRa and Sigfox is that as an IEEE 802.11 stan-
dard, it natively supports IP networks [18]. Another promising III. IoT P LATFORMS
method of accessing the Internet through IoT is 5G technol-
In computer science and engineering, an architecture
ogy, expected to be released to the public around 2020 [19].
describes the general organization of a system, abstracting
5G presents different performance requirements for distinct
from restraints such as implementation technology [26]. It
scenarios and IoT is one of them.
goals to understand and describe a system’s behavior. In [2],
The current Internet architecture uses the hypertext trans-
the most relevant architecture proposals for IoT are surveyed
fer protocol (HTTP) in the presentation layer (referring to
and reviewed. To summarize the different approaches, the most
the OSI model), but common HTTP requests consume too
relevant layers that are available in most IoT solutions are
many resources. For this reason, alternative lightweight proto-
illustrated in Fig. 2. They are as follows: 1) users or applica-
cols that are more efficient and practical for end-devices have
tions; 2) IoT platform; and 3) devices and infrastructure.
been proposed for IoT [20]. Two protocols that stand out in
Users or Applications: This upper layer addresses the users
this regard are the constrained application protocol (CoAP)
and auxiliary applications, such as decision support tools or
and message queing telemetry transport (MQTT), both expect-
social media.
ing a TCP/IP stack, and are being deployed on various IoT
IoT platform is a software package that integrates devices,
deployments. MQTT runs over TCP, while CoAP runs over
networks, and applications. The platforms hide implementa-
UDP [21], [22]. CoAP is based on the representational state
tion complexity from the user, because they support and enable
transfer (REST) model, meaning that constrained devices pos-
IoT solutions by providing an ecosystem where things are built
sess a lightweight method to perform REST requests. MQTT
upon [27].
relies on the publish/subscribe (Pub/Sub) model, and needs
Devices and Infrastructure: At the low layer, the physi-
a message broker. A variation of the MQTT protocol for
cal IoT infrastructure is located. It includes network devices
networks that are not based on TCP/IP is called MQTT-
(including things), multiple access, and modulation techniques.
SN [23]. CoAP generates less overhead than MQTT for all
Like most software, platforms possess requirements.
message sizes when the packet loss is low; when the packet
Software engineering states that requirements are divided in
loss is higher, CoAP produces less overhead only when the
functional and nonfunctional [28].
message size is small [22]. When the message is large, the
probability that TCP loses the message is smaller than UDP,
which causes MQTT to retransmit the entire message fewer A. Functional Requirements
times than CoAP [22]. Another aspect of IoT is data rep- Functional requirements are functionalities that describe
resentation. Currently, the most used encoding technique is what a system should be qualified to perform (what should
JavaScript object notation (JSON), but one of its biggest be done) [29]. There are cases where functional require-
strengths (easily readable to humans) implies more com- ments state what systems should not do [28]. Either functional
putational capacity when encoding or decoding as well as requirements are met or not, there is no objective way of quan-
transmitting. However, JSON is far superior to its competi- tifying them. The functional requirements of IoT platforms are
tor Extensible Markup Language (XML) [24]. In the current described as follows.
874 IEEE INTERNET OF THINGS JOURNAL, VOL. 5, NO. 2, APRIL 2018

1) Resource Discovery: If an individual does not know experiencing failures. Reliability and availability should work
what are his capabilities he cannot advertise them to the others. together to ensure some level of fault tolerance.
The same principle is applied in IoT, where it is crucial for 4) Security: One of the most significant concerns in every
things to be aware of their abilities and limitations, so they application is always security. In IoT, that aspect is even more
can announce to peers what resources they offer. Expecting critical since a compromised object could perform all sorts of
a human to complete this task for every IoT device manually attacks, such as denial of service [30], or even disclose sen-
is impractical, so discovery mechanisms need to scale well. sitive information, such as user location, regular schedule, or
Resource discovery is the process used by a device to search even live video. The implications of such data being exposed
for the desired resources, where the entire network is probed are limitless, and platforms should do their best to protect user
for services [10]. data, while also providing intrusion detection mechanisms.
2) Resource Management: Every application requires qual- 5) Privacy: A substantial amount of Facebook and Google
ity of service (QoS) to be reliable, and that is only possible revenue comes from collecting user data and selling to adver-
through fair resource allocation. Platforms should be able to tisers (users consent to this practice in the service agreement).
estimate device battery-time, current memory usage, and other However, there is no way of being sure what data they collect.
relevant internal data to facilitate resource allocation and sat- Privacy issues are related to the willing disclosure of data are
isfy application needs. An efficient resource management can an enormous concern. This problem is even more severe when
guarantee that a device that is handling many requests or is VoiceLabs (devices that are always listening) [31], such as
low on battery is requested less often if other devices are able Amazon Alexa and Google assistant are used. An IoT plat-
to perform the same task. form escalates the risks further with the amount of collected
3) Data Management: Data are critical in every application. data. A business model that could be popular in the future
It holds a big part of IoT value, so it should be appropriately is for users to consume cloud systems available in the form
handled. In this paragraph, data refers to what is sensed by the of platform as a service (PaaS) for free with the tradeoff of
thing, or any other information that is interesting to the appli- the data being sold to advertisers and other interested parties.
cation. Data management consists of acquiring information, The advantage of PaaS solutions is that they are located in the
storing in a database, and processing through analytics. cloud, and authenticated users can access the data located on
4) Event Management: IoT applications can generate the server from anywhere around the globe without having to
a massive number of events. Event management is an exten- worry about deploying or managing the infrastructure [32].
sion of data management. After storing data, other applications 6) Ease of Deployment, Maintenance, and Use: These plat-
make use of it; meaning that accurate decisions can be made forms will be handled by users, who might not have technical
in real-time with the information provided by the data, and expertise. The average user should be able to install, maintain,
the proper events are generated. and use the platform easily. Software that are easy to use are
5) Code Management: Updating every device in person is preferred by the public and usability without compromising
unpractical, and IoT will have a plethora of them. Platforms security will probably be one of the key aspects of successful
should facilitate updating operations since they possess a con- IoT solutions.
nection to devices. 7) Interoperability: The platform should be compatible
with various devices and applications with minimal effort from
developers. If the platform supports many devices, it will gain
B. Nonfunctional Requirements a boost in popularity and will indirectly turn the solution more
Nonfunctional requirements are certain aspects that a system scalable. A way of reaching interoperability is if besides the
should ensure, to guarantee QoS [29]. These requirements are popular HTTP(S), the platform also supports common IoT
described as follows. communication protocols, such as CoAP and MQTT. Also,
1) Scalability: An IoT platform needs to be scalable, since platforms should expose some functionalities through applica-
the things connected to a network grow exponentially, so will tion programming interfaces (APIs). APIs allow software to
the amount of data. Platforms should provide a similar QoS expose functionalities to other applications and things without
as time passes and more devices are added. sharing actual code [9].
2) Real-Time or Timeliness: Most applications will rely on 8) Spontaneous Interaction: New devices will continuously
real-time data, so data must continuously be updated. In com- be added to the network, or even repositioned. These changes
puter science, the term real-time means that the user barely in the network will occur at any time. Platforms should help
perceives the delay between sending data, and the amount of devices discover and interact each other with minimal human
time the computer takes to receive and process the data. interference.
Reliability is the likelihood that the software will experience 9) Multiplicity: Multiple devices are expected to commu-
no failures in a specified timeframe. The specified timeframe nicate simultaneously; when various devices offer the same
depends on the scenario. This means that the timeframe can service, platforms should help other IoT intervenients decide
be the duration of a single task or even the entire software which one provides the best service. If instead of querying
lifecycle. a single entity, the device merely broadcasts a service solicita-
3) Availability: Platforms supporting critical IoT applica- tion to the entire network, the device would then have to decide
tions must be available at all times. The platform should which is the best (in the case that more than one entity provides
remain operational when executing tasks, even if it is the desired service). If a single entity is enquired for the best
DA CRUZ et al.: REFERENCE MODEL FOR IoT MIDDLEWARE 875

TABLE I
device for a service, the decision of the most suitable service AVAILABLE I OT P LATFORMS AND C ORRESPONDING TARGETED A REAS
is delegated to a “smarter” player. The problem with query-
ing a single entity is that better devices will be prioritized.
Therefore, better devices will not always be able to provide
the best service due to memory constraints (too many requests
being processed), or even constraints from the physical world
such as distance. These are issues related to multiplicity [33],
and platforms should take them into account when
replying.
10) Adaptability and Flexibility: The platform should be
able to adapt to long-term changes, as well as be flexible
enough for short-term alterations. The platform should also
be viable across multiple scenarios.

C. IoT Platform Categories

The best would be for IoT platforms to support all the men-
tioned requirements. Instead, most IoT platforms are built to
support some of the previous requirements and fall under three
categories that are described as follows: 1) device manage-
ment; 2) application development; and 3) application enable-
ment. Table I displays a list of IoT platforms in alphabetical
order, and it also displays which categories each one targets.
No category is more important than another. Nevertheless, the
focus of this paper is on application enablement platforms.
Device management platforms are focused on remote device
management and the optimization of network resources. The
definition of device management that is going to be used
in this paper is inspired in open mobile alliance device
management specification. According to this standard, device
management consists (but is not restricted) to setting ini-
tial configuration (provisioning), changing parameters or set-
tings (maintenance), delivering updates (upgrading), query
device status, diagnostics, error reporting (reporting), and
event processing [34]. These platforms also focus on connec-
tivity, as well as optimizing the usage of network resources.
They collect the network capabilities and optimize the network
resources by offering tools that facilitate data delivery, device
detection, and network diagnostics. If a specific gateway in
the network is overloaded or is short on battery, the plat-
form should notice and take proper actions. Plug and play
is another concern for this type of platform, so when new
devices enter the network or get repositioned, little configu- Application enablement platforms are focused on enabling
ration by the user is necessary. It is important to notice that and integrating external applications. They provide means
device management usually requires that additional software to manage and visualize data, which accelerates applica-
is installed on the device. Notice that some software frame- tion development and facilitates integration with enterprise
works that enable device to device connectivity will also be systems, such as customer relationship management (CRM)
included in this category. and enterprise resource planning (ERP). Additionally, these
Application development platforms are focused on develop- platforms also secure user data and enable information
ing secure applications that can scale to many users, and deal exchange among various devices/applications. This type of
with the heterogeneity present in IoT environments. This type platform is also called IoT middleware platform, or IoT
of platforms also offers built-in tools to integrate with pop- middleware, and are the focus of this paper. It is very
ular service providers allowing the developed applications to common for this kind of platform to also advertise them-
be compatible with them. Platforms that merely provide basic selves as supporting device management. However, most
software development kits (SDKs) to send/receive data on their do not offer ways of delivering updates. From here on,
platform will not be included in this category. However, soft- the terms middleware, IoT middleware, and IoT middleware
ware development frameworks and toolkits specifically for IoT platform will be used interchangeably. The middleware is
will be included in this group. one of the enabling technologies for IoT [3], [10]. Further
876 IEEE INTERNET OF THINGS JOURNAL, VOL. 5, NO. 2, APRIL 2018

advantages of Amazon IoT is that it easily allows interaction

with other Amazon services, such as S3, machine learning,
CloudWatch, and many more. Their business model is PaaS.
Artik cloud [37] is a platform developed by Samsung. It pro-
vides application enablement as well as device management. It
supports MQTT, REST, Websockets, and CoAP communica-
tions with its server. One of the advantages of Artik Cloud is
that popular IoT apps and devices, such as Amazon echo and
Google Home can be easily integrated with it. Their business
model is PaaS.
Autodesk fusion connect [38] is an IoT middleware plat-
form developed by Autodesk. It is marketed as supporting all
(a) (b) machine to machine protocols and vendor-specific technology
from over 50 devices. One of its biggest strength is the fact
Fig. 3. Illustration of the communication (a) without middleware and (b) with that it provides comprehensive analytics tools. Their business
middleware.
model is PaaS.
Carriots [39] is a platform developed by Carriots. It pro-
details regarding IoT middleware platforms can be found vides application enablement as well as device management.
in Section IV. It supports MQTT and REST communications with its server.
Their business model is PaaS, and it can integrate with external
systems, such as Dropbox.
IV. I OT M IDDLEWARE P LATFORMS Cloudplugs [42] is an IoT middleware platform developed
As the name suggests, middleware is a software that is by Cloudplugs. It supports MQTT, REST, and Websockets
located in the middle (between two things). The primary goal communications with its server. Their business model is PaaS.
of a middleware is bringing different systems together so they Devicehive [43] is an open-source middleware platform cre-
can interact with each other [70]. The role of middleware is ated by DataArt and is distributed under Apache license 2.0.
not only to enable communication but to facilitate it. No mid- It supports MQTT, REST, and Websockets communications
dleware can be applied to every scenario, so they are generally with its server. Although it is open-source, an online version
built for specific or set of scenarios. In the literature, IoT mid- is available as PaaS where users can trial for free, or expand to
dleware solutions are sometimes referred to as IoT platforms or a paid version. To successfully deploy the solution, users must
IoT middleware platforms because generally, the middleware install PostgreSQL, Apache Kafka, and Java 8 or above. The
is a platform, but it is not the only type of IoT platform. downside of Devicehive (when deploying a private server) is
In IoT, middleware acts as a translator. To illustrate it, that measurement data from devices is cached, meaning that
imagine a scenario where three people from different nation- if the server is restarted, or runs out of memory all data are
alities debate. If they do not have a common language among lost. If the user desires this feature, it is necessary to create
them (the standardization option), they would need a translator an additional connector or modify backend logic. However,
mediating the conversation. Now, imagine that the three people Devicehive plans to support this feature in next releases.
are different applications (APPs). APPs communicate through EVRYTHNG [44] is an IoT middleware platform developed
APIs (the language), each APP has its own API. Without by EVRYTHNG. It supports MQTT, REST, Websockets, and
a middleware (the translator) each APP must understand every CoAP communications with its server. An interesting feature
other API. This simple idea allows users to focus on the is that it allows integration with external business intelligence
problem and it is illustrated in Fig. 3, because instead of know- systems. Their business model is PaaS.
ing how each application works, users manipulate data from Fiware (Orion+STH): It is common for Fiware to be
one application (the middleware). referred as a middleware platform. In reality, Orion Context
There are many IoT middleware solutions available in the broker is the middleware. Orion is an open-source middleware
literature as well as the market. Some of these solutions platform created and maintained by Fiware and is licensed
are open-source and free to download, trial, like most open- under Affero General Public Licence version 3. It is a Pub/Sub
source, the code can be altered at will. Other solutions are implementation of the NGSI-9 and NGSI-10 Open RESTful
closed-source, and are only available in the cloud in the form API specifications. It only supports REST communications
of PaaS. The advantage of PaaS solutions is that they are with its server. To successfully deploy the solution, users
located in the cloud, and authenticated users can access the must have MongoDB installed. The downside of Orion (when
data located on the server from anywhere around the globe deploying a private server) is that its specification states
without having to worry about deploying or managing the that only the last collected value is stored in the database,
infrastructure [32]. Both open- and closed-source middleware meaning that chronological data consultation is not possible.
solutions from Table I are described below. Recognizing the limitations of Orion, Cygnus, and short time
Amazon IoT platform [36] is an IoT middleware plat- historic (STH) were developed by Fiware. They both subscribe
form developed by Amazon. It supports MQTT, REST, and to Orion notifications, and when values are changed, they are
Websockets communications with its server. One of the biggest persisted to the database. The main difference between Cygnus
DA CRUZ et al.: REFERENCE MODEL FOR IoT MIDDLEWARE 877

and STH is that Cygnus only stores data, and no consultation learning, data warehousing, and much more. Their business
is possible, while STH allows both. Fiware officially supports model is PaaS.
both Cygnus and STH. Nitrogen [56] is an open-source middleware platform. Some
InatelPlat is a middleware platform created in August 2017, of its modules are licensed under MIT license, while oth-
at Instituto Nacional de Telecomunicações’s (INATEL) ICC ers are under the Apache license 2.0. To successfully deploy
(INATEL Competence Center). The goal is to provide PaaS for the solution, users must have Nodejs installed. The disad-
interested buyers. Currently, it only supports REST communi- vantage is that only Nitrogen enabled devices (devices that
cations with its server, but the intention is to support other run Nitrogen software) can communicate with the server. The
protocols by early 2018. No further information regarding project has received no updates to its Github repository since
implementation was provided because INATEL desires to keep March 2015, and the official website domain (nitrogen.io) is
that information private. The name InatelPlat is temporary, and for sale [75]. Which leads this paper to conclude that the
the final version will have a different name. project was terminated.
Kaa [49] is an open-source middleware platform created and Nimbits [55] is an open-source middleware platform cre-
maintained by KaaIoT and is licensed under Apache license ated and maintained by Nimbits; it is licensed under Apache
2.0. Although it is open-source, users can expand to a paid license 2.0. It supports MQTT and REST communications
version by contacting the KaaIoT [71]. It supports REST com- with its server. Although it is open-source, an online version
munications with its server, and SDKs can be deployed to is available as PaaS where users can trial for free. To suc-
devices. To successfully deploy the solution, users must have cessfully deploy the solution, users must have Java, Redis,
Oracle Java SDK, either MariaDB or PostgreSQL, MongoDB a java server application, and Mosquitto MQTT installed. The
or Cassandra, and Zookeeper. The downside of Kaa (when problem with Nimbits is that it is going through a restructure
deploying a private server) is that it is not possible to inquiry and all documentation related to usage was erased from the
the stored data from the server through the REST API, mean- official documentation, and the public cloud is down with no
ing that the user has to develop another application for this estimated date of return.
feature. To those who are interested, it is possible to build an OpenIoT [57] is an open-source platform that supports
REST API that returns data from a MongoDB database using device management, as well as application enablement.
free tools, such as Spring tool suite [72]. Created and maintained by the OpenIoT consortium, it is
Konker [50] is an open-source middleware platform created licensed under Apache license 2.0. It supports REST and
and maintained by the Brazilian KonkerLabs. It is licensed GSN communications with its server. To successfully deploy
under Apache license 2.0. Although it is open-source, an the solution, users must have Java, Maven, JBoss, and
online version is available as PaaS where users can trial for Local Virtuoso installed. Although it is a fascinating project,
free, or expand to a paid version. It supports REST and MQTT it has received no updates to its Github repository since
communications with its server. To successfully deploy the November 2015.
solution, users must have Java SDK, MongoDB, Cassandra, Sitewhere [58] is an open-source middleware platform cre-
an application server that supports servlets. ated and maintained by Sitewhere and is licensed under
Linksmart [51], formerly known as Hydra [73], is a com- Common Public Attribution License version 1.0). Although
plete IoT platform that supports device management, as well it is open-source, users can expand to a paid version by
as application enablement. The app enablement module is contacting Sitewhere. It supports MQTT, AMQP, and REST
called Linksmart historical datastore (HDS). HDS is an open- communications with its server. To successfully deploy the
source middleware platform that is licensed under Apache solution, users must have Java, MongoDB, HiveMQ, and
license 2.0. It supports REST communications with its server, Apache Tomcat.
and data visualization is made through Grafana. To success- Tago [61] is an IoT middleware platform developed by Tago.
fully deploy the solution, users must have either influxDB or It supports MQTT and REST communications with its server.
MongoDB installed. Regarding the platforms that are present Their business model is PaaS.
in this paper, it is the only one that uses Sensor Markup Telit IoT platform [62] is an IoT platform developed by
Language (SenML) [74]. Telit. It supports MQTT and REST communications with its
Losant [52] is a platform developed by Losant. It pro- server. It provides application enablement as well as device
vides application enablement as well as device management. management. One of its biggest advantages is that besides
It supports MQTT and REST communications with its server. analytics it can also be used on the edge of IoT devices.
Although the application development tools offered by them ThingSpeak [64] is an IoT middleware developed by
are to communicate with their own middleware, the tools are ThingSpeak. It supports REST communications with its server.
very advanced. One of its biggest advantages is that besides The differential of this platform is that it offers MATLAB
analytics it can also be used on the edge of IoT devices. Their analytics. ThingSpeak started as an open-source project, but
business model is PaaS. currently offers its service in the form of PaaS, although the
Microsoft Azure IoT Suite [54] is an IoT middleware plat- old version of the server is still up in the Github repository.
form developed by Microsoft. It supports MQTT, AMQP, Thingworx IoT platform [65] is an IoT platform developed
and REST communications with its server. One of the by PTC. It supports REST communications with its server, and
biggest advantages of Azure IoT suite is that it easily additional connectors are available in its marketplace. It pro-
allows interaction with other Azure services, such as machine vides application enablement as well as device management.
878 IEEE INTERNET OF THINGS JOURNAL, VOL. 5, NO. 2, APRIL 2018

One of its biggest advantages is that besides analytics it can

also be used on the edge of IoT devices.
Ubidots [66] is an IoT middleware platform developed by
Ubidots. It supports MQTT and REST communications with
its server. Their business model is PaaS.
Xively [69] is an IoT platform developed by LogMeIn. It
provides application enablement as well as device manage-
ment. Xively supports MQTT and REST communications with
its server. One of its biggest advantages is that besides ana-
lytics it can be easily integrated with Amazon Web services,
Salesforce Device Bridge, and custom integrations with exter-
nal CRM and ERP tools are also possible. Their business
model is PaaS.
Webinos [68] is an open-source service platform that sup-
ports device management, as well as application enablement. Fig. 4. Illustration of the proposed reference model for IoT platform modules.
It was developed as part of the EU FP7 ICT Programme and
is licensed under Apache license 2.0. Webinos uses the con-
cept of personal zones, which allows communication between The module should also support standard data representation
services and devices. Personal zones are divided into two methods, like XML and JSON, as well as binary encodings
parts: 1) personal zone hub (PZH) and 2) personal zone (Apache thrift, Google protocol buffer), another data repre-
proxy (PZP). A PZH possesses a public IP address and runs in sentation that is emerging for IoT is SenML [74]. To further
the cloud [76]. The PZP is a device that is able to run Webinos extend interoperability, the middleware should provide basic
services. To successfully deploy a personal zone, users must SDKs, so the code can quickly be deployed to devices, and
have Nodejs installed. The disadvantage is that only Webinos they can send/receive data to/from the middleware platform.
enabled devices (devices that run Webinos software) can com- SDKs can be vital, because adding new devices to the mid-
municate with the server, besides that, it is not suitable for dleware is relatively easy, but is not scalable in the sense
real systems, because many critical features are still unimple- that it is tedious for the user to add various devices at once.
mented. It has received no updates to its Github repository PZP Then, adding new devices should be further simplified (with-
module since February 2014, and PZH since March 2015. out compromising security). This module is intended for future
expansions, and is ideal for new and unforeseen technologies
to be integrated here.
V. R EFERENCE M ODEL FOR I OT M IDDLEWARE 2) Persistence and Analytics Module: IoT produces a mas-
When IoT is promoted, beautiful scenarios are presented sive amount of data, which needs to be quickly and con-
where gadgets study user habits and also react to them, tinuously stored for chronological consultation and further
improving quality of life and user experience. Most of the processing [77]. IoT middleware should use NoSQL databases
presented scenarios finish with a sentence similar to this one: to store data since they are generally faster than SQL databases
“all of this with minimal human intervention.” These scenarios because their data model is simpler [78]. It is commonly
are only possible because of middleware platforms that inte- said that in IoT, Things learn from user habits. In practice,
grate data from all the devices and acts upon it. For this reason, devices are constrained in resources, and the middleware is
middleware are present in most IoT scenarios. Collecting data the one who learns from collected data. Therefore, middle-
and react accordingly is a crucial feature in IoT because ware least it should provide basic analytics, such as simple
most devices are small, and resource constrained to make graphs, averages, or min/max values [8]. However, the best is
complex decisions. Therefore, the middleware platforms are further data processing through data warehousing, big data, or
responsible for part of the intelligence in IoT. To fulfill their even feeding these data to deep/machine learning algorithms
goals, the modules of an IoT middleware platform architecture because the collected data are highly valuable, especially after
should reflect IoT requirements as follows: 1) interoperability; being processed [79].
2) persistence and analytics; 3) context; 4) resource and event; 3) Context Module: In a communication, context provides
5) security; and 6) graphical user interface (GUI). The mod- meaning to a conversation. IoT environments are expected
ules of a considered ideal IoT middleware are presented in to adapt to surroundings and context will play a significant
Fig. 4 and described as follows. role in this regard [4]. A system is context-aware if it is
1) Interoperability Module: The IoT is a heterogeneous capable of providing relevant information or services accord-
environment, and the middleware platform is the integra- ing to the task demanded by the user [80]. Regarding user
tor. Therefore, it should provide an API that allows soft- interaction, systems are classified into three levels of context-
ware to expose functionalities to other applications and awareness [80]: 1) personalization; 2) passive; and 3) active.
things without sharing actual code [9]. API requests made by Context-awareness personalization is when the user states to
things/applications can be performed through any protocol, so the system precisely what he wants, and the system merely
the middleware should at least support the most popular IoT follows what was programmed (e.g., user programs the lights
application protocols, such as CoAP, MQTT, and HTTP(S) [9]. to go on when he enters the room). Passive context-awareness
DA CRUZ et al.: REFERENCE MODEL FOR IoT MIDDLEWARE 879

is when the system monitors the environment and suggests important, it is common for open-source middleware platforms
actions according to the monitored data (e.g., a user walks do not possess a native GUI, relying instead on integra-
into a room, and the system asks if he should turn on the tions with third-party applications such as Freeboard [82] or
lights). Active context-awareness is when the system monitors Grafana [83] to provide dashboards. These third-party applica-
the environment and acts on the changes to the environ- tions can be deployed on private instances, are very powerful
ment autonomously (e.g., a user walks into a room, and and relatively easy to use, as the hardest part is having to
the system autonomously identifies if the user can navigate configure data-sources when using them.
through the room and turns on the light with the right degree of 6) Security Module: IoT will not become popular without
luminosity). Context-awareness affects the ability to adapt to plug-and-play. This means that middleware should be flexible
new circumstances or environments, and is deeply connected enough for the average user to handle. Unfortunately, ease of
to event detection/management. For context-awareness to be use (usability) is difficult to achieve with the level of secu-
achieved, it has to be modeled. In recent years the ontology- rity needed by middleware. If the data could be tampered or
based modeling has become mainstream, spawning different retrieved by a malicious user or application, the threats would
standards. A popular standard is Web Ontology language that be limitless. IoT devices are not known for their security,
is backed by World Wide Web Consortium). More information and middleware platforms should not follow the same trend
regarding other context modeling techniques, as well as con- because they are the brain of IoT. The amount and value of the
text in general can be found in [80]. Semantic interpretation collected data are significant and must be secure, but the solu-
and ontologies are expected in this module because people tion is not simple for any IoT scenario including middleware,
communicate semantically and the same is expected when because devices are very constrained in resources. Encryption,
humans interact with machines in IoT environments. For the for example, is costly (regarding processing), so lightweight
IoT that is envisioned the best is artificial intelligence in encryption tools or algorithms must be used for this goal,
this module (one of the most challenging fields in this tech- along with a lightweight cryptographic protocol [84]. Public
nology), but the middleware platform can use external APIs keys require that certificates are updated when they expire, and
to achieve this goal. Currently, some middleware proposals, propagating these updates to every device is not a simple task.
such as Linksmart and OpenIoT rely on ontologies to reach Both cryptography and public keys are basic security features
semantic interoperability between the sensed data [81]. that are common on the current Internet, and their limitations
4) Resource and Event Module: For devices to be efficient in IoT display the problem in hand, so every security aspect
in their actions, they must know what they can perform and that is efficient and can be included exclusively on a power-
their internal operation status (battery level, internal/external ful server is welcome. With that in mind, the paper proposes
temperature, and current memory usage), so they can advertise essential security aspects for middleware security in IoT. They
their resources and discover resources from others. Multiple are: 1) per device authentication; 2) the credentials to consult
devices are expected to communicate with each other simul- and publish data should be different; 3) devices should access
taneously; they can even offer the same service, and better other device data using their own credentials; and 4) mid-
devices are supposed to be requested more often than the dleware should know device habits and store their MAC and
others. This means that they will not always be able to pro- IP. More details regarding the proposed security measures, and
vide the best service, due to memory constraints (too many the reasons behind them can be found later in this section.
requests being processed), or even constraints from the physi- An IoT environment is characterized by its heterogeneity
cal world such as distance. These issues are a concern related considering different technologies and data collected will be
to the multiplicity of actions and the limitations of the tiny used across many IoT verticals. However, some scenarios are
device [33]. Middleware platforms can minimize these prob- broader than others. Small solutions like weather stations will
lems by managing and optimizing these interactions. When just consider data collection and storage, as most of their
connecting for the first time to a middleware platform, devices data are predictable and repetitive; then, it will most likely per-
and external applications should announce their capabilities form basic analytics and expose data for external consultation.
through some sort of text message (e.g., in JSON). Then, In big verticals, such as smart cities, that can include energy
the context module semantically interprets the capabilities, management, smart parking, smart transportation, mobility,
and when a device or application needs an individual ser- etc., data are unpredictable. The middleware platform should
vice, it can query the middleware for nearby devices that be equipped with AI mechanisms to analyze broader scenarios.
are able to fulfill the task. The middleware understands all In practice, this means that not all possible scenarios require
capabilities provided by the environment and can generate the all the presented modules since in small scenarios such as
proper events. Middleware should also facilitate events update a weather station, a simple middleware platform that facilitates
through devices [9], as it is not expected a person can man- data consultation and storage might suffice.
ually manage every single device in large environments, such
as smart cities.
5) Graphical User Interface: A GUI is a must for every A. Security Aspects Related to IoT Middleware
modern software, as it makes applications user-friendly. In Security is an essential aspect of any system, and it seems
IoT middleware, the GUI is often referred as Dashboard, IoT developers are relegating it to second plan, so that products
because many data will be exchanged, and dashboards present can be developed faster, and the exploits can be later resolved.
data in a way that is easy to read. Despite GUIs being so It is this paper’s view that IoT middleware should not follow
880 IEEE INTERNET OF THINGS JOURNAL, VOL. 5, NO. 2, APRIL 2018

the same path, and should ensure data security. For this reason, middleware notices that a device is consulting or publishing
four fundamental aspects are proposed in this paper with the in different intervals than it regularly does, or is consulting
intention of increasing security in IoT middleware, and are devices that it usually does not, it is an indicator that the
based on the assumption that device credentials were somehow device was compromised, and the user should be alerted of the
compromised. anomaly to take proper actions. However, if the attacker knows
1) Per Device Authentication: is crucial for the safety of this security feature, he can just disable the original device
middleware data. Every device should have its individual and keeps sending tampered data from any part of the globe.
credentials when accessing the middleware platform. If cre- The middleware platform can counter this if it can extract
dentials get compromised, and the user notices, the threat the MAC and IP address directly from the HTTP header, and
is eliminated by revoking or updating the device credentials. alert the user. In the Internet, IP changes, so the middleware
However, if all devices share the same authentication, besides has to detect if the device IP has changed in a reasonable
revoking or updating the credentials, the user also has to insert range. The only scenario where the credential theft is not
them into every other device. Some middleware platforms detected with this security features is if the attacker manages
already follow this guidance. to spoof the device regular IP address, clone the MAC address,
2) Devices Should Use Different Credentials to Publish and keeps the device transmission habits. To the best of this
and Consult Data From the Middleware: Some already com- paper’s knowledge, none of the existing middleware platforms
ply with the guidance that every device should have its own implements this security measure.
authentication. However, the implementation is limited, as the
same credentials to publish device data are the same that are
used to consult. This means that an organization cannot safely
expose its device data to external users, without risking that VI. O PEN I SSUES AND R ESEARCH O PPORTUNITIES
data is tampered. For this reason, authentication per device is IoT poses significant challenges and opportunities for com-
not enough, and different credentials should be used to publish panies and scholars in every field. The significant number
and retrieve data. To the best of this paper’s knowledge, none of connected devices that are expected calls the attention of
of the existing middleware platforms implements this security academia, industry, and regulators, as the total annual eco-
measure. nomic impact due to IoT is estimated to range from $2.7 to
3) Devices Should Access Other Device Data Using Their $6.2 trillion by 2025 [85]. New needs will emerge, and an
Own Credentials: The former scenario is an excellent example entirely new ecosystem might rise; researchers should be
of a weather station, where device data can be retrieved by any quick identifying new fields, the industry should be quick
interested party, but makes it difficult to discover which device implementing innovative ideas.
credentials were compromised. Imagine that one day a close When organizations choose a particular software, it is
friend visits the user house and says he hacked one of the a long-term commitment, in IoT, it will not be different.
devices and now he always knows what is in the refrigerator. Middleware who are not supported by the community or
The solution would be to change the consultation credentials major players are in disadvantage, as currently, hundreds are
of the refrigerator and propagate them to every device that available (especially as services in the cloud).
needs it (and that is the problem). A few days later the same It is extremely important developing an objective and
friend is back, and compliments for changing the password detailed way for comparing middleware systems. Currently,
but says he can consult it again. The friend also says that comparing middleware solutions comes down to preference.
changing the refrigerator password is pointless, because he The “go to” for researchers currently consists of elaborating
hacked another device to get the password. The cycle would a list of relevant features (that reflect some requirements of
go infinitely, because the user cannot determine which device middleware), and mark which ones accomplish them, such
was breached. However, if it is possible for devices to access approach is often confusing for the readers because in theory,
other device data using their own credentials, by checking the they all accomplish the same goals. Comparing middleware
middleware logs, one can determine which device credential located in the cloud is even harder since a fair comparison
was used from an external source, and the user can take proper among different solutions implies that the conditions for all of
actions. When configuring devices, users should be able to them are the same across all the experiments. For software,
determine what other devices or predefined group of devices this means that they will have the same available resources
have access to consulting rights. Also, some devices that sim- (memory, processing power, disk space, etc.). This precon-
ply sensor data and never retrieve it should not have rights to dition turns the comparison between solutions that are only
either consult other devices, or its own data. To the best of this available in the cloud, and local instances very complicated.
paper’s knowledge, none of the existing middleware platforms As it is not possible to determine what resources are allocated
implements this security measure. to the cloud instance. In practice, this means that with more
4) Middleware Should Know Device Habits and Store Their resources, the local instance can perform better in comparison
MAC and IP Address: All past scenarios assume that the user with fewer resources. Another challenge related to compar-
notices credential theft, but in real life it is hard to notice ing cloud solutions is related to the cost. The current business
such breaches, especially if the middleware does not compre- model of most cloud platforms consists on billing monthly
hend the devices habits. For this reason, middleware should or yearly per number of requests, analysis, stored records, or
know device habits and store their MAC and IP address. If the sent emails. Perhaps the biggest challenge in IoT is related to
DA CRUZ et al.: REFERENCE MODEL FOR IoT MIDDLEWARE 881

security. Many tech experts do not advise consumers to pur- [11] J.-C. Lee, J.-H. Jeon, and S.-H. Kim, “Design and implementation of
chase devices, such as, door locks or children toys that are healthcare resource model on IoTivity platform,” in Proc. Int. Conf.
Inf. Commun. Technol. Convergence (ICTC), Jeju-do, South Korea,
connected to the Internet. They mention such advises because Oct. 2016, pp. 887–891.
IoT is seen as insecure, mainly, because developers neglect [12] O. Tomanek and L. Kencl, “Security and privacy of using AllJoyn IoT
important security aspects to deliver products faster. If IoT framework at home and beyond,” in Proc. 2nd Int. Conf. Intell. Green
Build. Smart Grid (IGBSG), Prague, Czech Republic, Jun. 2016, pp. 1–6.
image does not change soon, regaining public (users) trust [13] J. Zhou, Z. Cao, X. Dong, and A. V. Vasilakos, “Security and privacy
will be difficult. for cloud-based IoT: Challenges,” IEEE Commun. Mag., vol. 55, no. 1,
pp. 26–33, Jan. 2017.
[14] K. Wang, Y. Wang, Y. Sun, S. Guo, and J. Wu, “Green industrial Internet
VII. C ONCLUSION of Things architecture: An energy-efficient perspective,” IEEE Commun.
Mag., vol. 54, no. 12, pp. 48–54, Dec. 2016.
The IoT is a scenario where most devices are constrained [15] R. K. Ghosh, Wireless Networking and Mobile Data
in resources, which means that the intelligence will be del- Management. Singapore: Springer, 2017. [Online]. Available: http://
egated to a more capable entity. This entity is a software www.springer.com/gp/book/9789811039409
[16] B. Reynders, W. Meert, and S. Pollin, “Range and coexistence analy-
identified as IoT middleware or IoT middleware platform, and sis of long range unlicensed communication,” in Proc. 23rd Int. Conf.
sometimes it is simply referred as IoT platform although it is Telecommun. (ICT), Thessaloniki, Greece, May 2016, pp. 1–6.
not the only type of IoT platform. Choosing the right plat- [17] M. Centenaro, L. Vangelista, A. Zanella, and M. Zorzi, “Long-range
communications in unlicensed bands: The rising stars in the IoT and
form for a particular scenario can be the difference between smart city scenarios,” IEEE Wireless Commun., vol. 23, no. 5, pp. 60–67,
a good and bad IoT solution because it is a long-term invest- Oct. 2016.
ment. Understanding what middleware should accomplish, [18] B. Badihi et al., “Performance evaluation of IEEE 802.11ah actuators,”
in Proc. IEEE 83rd Veh. Technol. Conf. (VTC Spring), vol. 9. Nanjing,
and recognizing their role in IoT solutions will be crucial China, 2016, pp. 1–5.
for organizations or individuals interested in the IoT market. [19] J. G. Andrews et al., “What will 5G be?” IEEE J. Sel. Areas Commun.,
Middleware developers should spend additional time making vol. 32, no. 6, pp. 1065–1082, Jun. 2014.
[20] A. Al-Fuqaha, A. Khreishah, M. Guizani, A. Rayes, and
them more user-friendly without compromising security, as M. Mohammadi, “Toward better horizontal integration among IoT
usability with a certain degree of quality might be the key to services,” IEEE Commun. Mag., vol. 53, no. 9, pp. 72–79, Sep. 2015.
prosperity in this already overloaded market. Currently, there [21] S. Bandyopadhyay and A. Bhattacharyya, “Lightweight Internet proto-
cols for Web enablement of sensors using constrained gateway devices,”
is no objective way of comparing the different middleware. in Proc. Int. Conf. Comput. Netw. Commun. (ICNC), San Diego, CA,
Therefore, a performance assessment based on objective met- USA, Jan. 2013, pp. 334–340.
rics can substantially contribute to selecting middleware for [22] D. Thangavel, X. Ma, A. Valera, H.-X. Tan, and C. K.-Y. Tan,
“Performance evaluation of MQTT and CoAP via a common middle-
each environment, so further effort should be placed in this ware,” in Proc. IEEE 9th Int. Conf. Intell. Sensors Sensor Netw. Inf.
regard. Process. (ISSNIP), Singapore, Apr. 2014, pp. 1–6.
[23] E. P. Frigieri, D. Mazzer, and L. F. C. G. Parreira, “M2M protocols
for constrained environments in the context of IoT?: A comparison of
ACKNOWLEDGMENT approaches,” in Proc. 33rd Brazil. Telecommun. Symp., Juiz de Fora,
Brazil, Sep. 2015, pp. 1–5.
The authors are grateful for the support of this work. [24] M. Nurseitov, R. Paulson, R. Reynolds, and C. Izurieta, “Comparison
of JSON and XML data interchange formats: A case study,” in Proc.
R EFERENCES ISCA 22nd Int. Conf. Comput. Appl. Ind. Eng. (CAINE), San Francisco,
CA, USA, Nov. 2009, pp. 157–162.
[1] S. Huckle, R. Bhattacharya, M. White, and N. Beloff, “Internet [25] H. Lampesberger, “Technologies for Web and cloud service interaction:
of Things, blockchain and shared economy applications,” Procedia A survey,” Service Orient. Comput. Appl., vol. 10, no. 2, pp. 71–110,
Comput. Sci., vol. 98, pp. 461–466, 2016. [Online]. Available: Jun. 2016.
https://www.sciencedirect.com/science/article/pii/S1877050916322190 [26] A. Clements, Principles of Computer Hardware, 4th ed. Oxford, U.K.:
[2] A. Al-Fuqaha, M. Guizani, M. Mohammadi, M. Aledhari, and Oxford Univ. Press, 2006.
M. Ayyash, “Internet of Things: A survey on enabling technologies, pro- [27] A. Tiwana, Platform Ecosystems Aligning Architecture, Governance, and
tocols, and applications,” IEEE Commun. Surveys Tuts., vol. 17, no. 4, Strategy. Burlington, MA, USA: Elsevier, 2013.
pp. 2347–2376, 4th Quart., 2015. [28] I. Sommerville, Software Engineering, 10th ed. Harlow, U.K.: Addison-
[3] J. Gubbi, R. Buyya, S. Marusic, and M. Palaniswami, “Internet of Things Wesley, 2010.
(IoT): A vision, architectural elements, and future directions,” Future [29] M. Glinz, “On non-functional requirements,” in Proc. 15th IEEE Int.
Gener. Comput. Syst., vol. 29, no. 7, pp. 1645–1660, Sep. 2013. Requirements Eng. Conf. (RE), Delhi, India, 2007, pp. 21–26.
[4] L. Atzori, A. Iera, and G. Morabito, “The Internet of Things: A survey,” [30] K. Wang, X. Qi, L. Shu, D. Deng, and J. J. P. C. Rodrigues, “Toward
Comput. Netw., vol. 54, no. 15, pp. 2787–2805, Oct. 2010. trustworthy crowdsourcing in the social Internet of Things,” IEEE
[5] “Overview of the Internet of Things,” Int. Telecommun. Union, Geneva, Wireless Commun., vol. 23, no. 5, pp. 30–36, Oct. 2016.
Switzerland, ITU-Recommendation ITU-T Y.2060, pp. 1–22, Jun. 2012. [31] P. Dempsey, “The teardown: Google home personal assistant,” Eng.
[6] D. Evans, “The Internet of Things—How the next evolution of the Technol., vol. 12, no. 3, pp. 80–81, Apr. 2017.
Internet is changing everything,” San Jose, CA, USA, CISCO, White [32] L. Miller, Public PaaS for Dummies, 2nd ed. Hoboken, NJ, USA: Wiley,
Paper, pp. 1–11, Apr. 2011. 2016.
[7] The Communications Market Report: U.K., Ofcom, London, U.K., [33] M. A. Chaqfeh and N. Mohamed, “Challenges in middleware solutions
Aug. 2015, pp. 1–431. for the Internet of Things,” in Proc. Int. Conf. Collaboration Technol.
[8] A. H. H. Ngu, M. Gutierrez, V. Metsis, S. Nepal, and M. Z. Sheng, Syst. (CTS), Denver, CO, USA, May 2012, pp. 21–26.
“IoT middleware: A survey on issues and enabling technologies,” IEEE [34] Device Management Requirements: Approved Version 2.0, Open Mobile
Internet Things J., vol. 4, no. 1, pp. 1–20, Feb. 2016. Alliance, San Diego, CA, USA, 2016, pp. 1–14.
[9] M. A. Razzaque, M. Milojevic-Jevric, A. Palade, and S. Clarke, [35] Slashdot Media. SourceForge—Download, Develop and Publish Free
“Middleware for Internet of Things: A survey,” IEEE Internet Things Open Source Software. Accessed: Oct. 22, 2017. [Online]. Available:
J., vol. 3, no. 1, pp. 70–95, Feb. 2016. https://sourceforge.net/
[10] A. Farahzadi, P. Shams, J. Rezazadeh, and R. Farahbakhsh, [36] Amazon Web Services. AWS IoT—Amazon Web Services. Accessed:
“Middleware technologies for cloud of things-a survey,” Digit. Commun. Oct. 22, 2017. [Online]. Available: https://aws.amazon.com/iot/
Netw., Apr. 2017. [Online]. Available: https://www.sciencedirect.com/ [37] SAMSUNG. IoT Cloud Platform—Samsung ARTIK Cloud. Accessed:
science/article/pii/S2352864817301268 Dec. 22, 2017. [Online]. Available: https://artik.cloud/
882 IEEE INTERNET OF THINGS JOURNAL, VOL. 5, NO. 2, APRIL 2018

[38] Autodesk Inc. Autodesk Fusion Connect. Enterprise IoT [68] Webinos Foundation. Webinos |The Webinos Foundation. Accessed:
Software Platform. Accessed: Oct. 22, 2017. [Online]. Available: Oct. 22, 2017. [Online]. Available: http://webinos.org/
https://autodeskfusionconnect.com/ [69] Xively. IoT Platform for Connected Devices|Xively by LogMeIn.
[39] Carriots. Carriots—Internet of Things Platform |Home. Accessed: Accessed: Oct. 22, 2017. [Online]. Available: https://www.xively.com/
Oct. 22, 2017. [Online]. Available: https://www.carriots.com/ [70] A. R. Simon and T. C. Hammergren, Data Warehousing for Dummies,
[40] M. Autili, P. Inverardi, and M. Tivoli, “Choreography realizability 2nd ed. Hoboken, NJ, USA: Wiley, 2009.
enforcement through the automatic synthesis of distributed coordination [71] KaaIoT. Kaa IoT Product Development Platform—IoT Application
delegates,” Sci. Comput. Program., vol. 1, pp. 1–27, Oct. 2017. Enablement. Accessed: Oct. 22, 2017. [Online]. Available:
[41] Chorevolution. Chorevolution.eu: (Main.WebHome). Accessed: https://www.kaaiot.io/
Dec. 22, 2017. [Online]. Available: http://www.chorevolution.eu/ [72] Pivotal Software Inc. Tools. Accessed: Oct. 22, 2017. [Online].
bin/view/Main/ Available: https://spring.io/tools
[42] CloudPlugs Inc. CloudPlugs :: Internet of Things Platform, IoT, [73] M. Eisenhauer, P. Rosengren, and P. Antolin, “A development platform
Public Cloud :: Accessed: Oct. 22, 2017. [Online]. Available: for integrating wireless devices and sensors into ambient intelligence
https://cloudplugs.com/ systems,” in Proc. 6th IEEE Annu. Commun. Soc. Conf. Sensor Mesh
[43] DataArt Solutions. DeviceHive—Open Source IoT Data Platform With Ad Hoc Commun. Netw. Workshops, Rome, Italy, Jun. 2009, pp. 1–3.
the Wide Range of Integration Options. Accessed: Oct. 22, 2017. [74] X. Su et al., “Connecting IoT sensors to knowledge-based systems
[Online]. Available: https://devicehive.com/ by transforming SenML to RDF,” Procedia Comput. Sci., vol. 32,
[44] EVRYTHNG. EVRYTHNG IoT Smart Products Platform |. Accessed: pp. 215–222, 2014. [Online]. Available: https://www.sciencedirect.com/
Oct. 22, 2017. [Online]. Available: https://evrythng.com/ science/article/pii/S1877050914006176
[45] Fiware. Fiware-Orion. Accessed: Oct. 22, 2017. [Online]. Available: [75] nitrogen.io. Accessed: Oct. 22, 2017. [Online]. Available:
https://fiware-orion.readthedocs.io/en/develop/ http://domain.hacker.sh/parked.html?domain=nitrogen.io
[46] Fiware. Fiware-STH-Comet. Accessed: Oct. 22, 2017. [Online]. [76] Webinos. D3.7: Final Webinos Specification. Accessed: Dec. 18, 2017.
Available: https://fiware-sth-comet.readthedocs.io/en/latest/ [Online]. Available: http://webinos.org/files/2015/03/webinos-
[47] Grovestreams. Welcome—Storage and Analytics for the Internet specification-D3.7.pdf
of Things. Accessed: Oct. 22, 2017. [Online]. Available: [77] G. Fersi, “Middleware for Internet of Things: A study,” in Proc.
https://grovestreams.com/ Int. Conf. Distrib. Comput. Sensor Syst., Fortaleza, Brazil, Jun. 2015,
[48] Linux Foundation. Home |IoTivity. Accessed: Oct. 22, 2017. [Online]. pp. 230–235.
Available: https://www.iotivity.org/ [78] N. Leavitt, “Will NoSQL databases live up to their promise?” Computer,
[49] KaaIoT Technologies. Kaa Open-Source IoT Platform 2017—IoT vol. 43, no. 2, pp. 12–14, Feb. 2010.
Cloud Platform the Internet of Things Solutions and Applications [79] L. Jiang et al., “An IoT-oriented data storage framework in cloud
That Set the Standard. Accessed: Oct. 22, 2017. [Online]. Available: computing platform,” IEEE Trans. Ind. Informat., vol. 10, no. 2,
https://www.kaaproject.org/ pp. 1443–1451, May 2014.
[50] Konker Labs. Konker—Your Solutions Connected in a Fast [80] C. Perera, A. Zaslavsky, P. Christen, and D. Georgakopoulos, “Context
and Simple Way! Accessed: Oct. 22, 2017. [Online]. Available: aware computing for the Internet of Things: A survey,” IEEE Commun.
http://www.konkerlabs.com/ Surveys Tuts., vol. 16, no. 1, pp. 414–454, 1st Quart., 2014.
[51] Linksmart. LinkSmart Documentation Home—Home— [81] F. C. Delicato, P. F. Pires, and T. Batista, Middleware Solutions for the
LinkSmart Docs. Accessed: Oct. 22, 2017. [Online]. Available: Internet of Things. London, U.K.: Springer, 2013. [Online]. Available:
https://docs.linksmart.eu/ http://www.springer.com/gp/book/9781447154808
[52] Losant IoT. Losant |Losant. Accessed: Oct. 22, 2017. [Online]. [82] Freeboard—Dashboards For the Internet of Things. Accessed: Sep. 27,
Available: https://www.losant.com/ 2017. [Online]. Available: https://freeboard.io/
[53] M2MLabs. Home |m2mlabs.com. Accessed: Oct. 22, 2017. [Online]. [83] Grafana—The Open Platform for Analytics and Monitoring. Accessed:
Available: http://www.m2mlabs.com/ Sep. 27, 2017. [Online]. Available: https://grafana.com/
[54] Microsoft IoT. Azure IoT Suite—IoT Cloud Solution [84] S. Singh, P. K. Sharma, S. Y. Moon, and J. H. Park, “Advanced
|Microsoft. Accessed: Oct. 22, 2017. [Online]. Available: lightweight encryption algorithms for IoT devices: Survey, chal-
https://www.microsoft.com/en-us/internet-of-things/azure-iot-suite lenges and solutions,” J. Ambient Intell. Humanized Comput.,
[55] Nimbits Inc. Nimbits Platform. Accessed: Oct. 22, 2017. [Online]. pp. 1–18, May 2017. [Online]. Available: https://link.springer.com/
Available: https://www.nimbits.com/ article/10.1007%2Fs12652-017-0494-4
[56] Nitrogen. nitrogenjs · GitHub. Accessed: Oct. 22, 2017. [Online]. [85] J. Manyika et al., Disruptive Technologies: Advances That Will
Available: https://github.com/nitrogenjs Transform Life, Business, and the Global Economy, McKinsey Glob.
[57] OpenIoT Consortium. OpenIoT—Open Source Cloud Solution for the Inst., May 2013, p. 163. [Online]. Available: https://www.mckinsey.
Internet of Things. Accessed: Oct. 22, 2017. [Online]. Available: com/∼/media/McKinsey/Business%20Functions/McKinsey%20Digital/
http://www.openiot.eu/ Our%20Insights/Disruptive%20technologies/MGI_Disruptive_technolog
[58] SiteWhere. SiteWhere |The Open Platform for the Internet of Things. ies_Full_report_May2013.ashx
Accessed: Oct. 22, 2017. [Online]. Available: http://www.sitewhere.org/
[59] F. Longo, D. Bruneo, S. Distefano, G. Merlino, and A. Puliafito,
“Stack4Things: A sensing-and-actuation-as-a-service framework for IoT
and cloud integration,” Annales des Telecommun., vol 72, nos. 1–2,
pp. 53–70, Feb. 2017.
[60] Stack4Things. Stack4Things |An OpenStack-Based Internet of
Things Framework. Accessed: Oct. 22, 2017. [Online]. Available:
http://stack4things.unime.it/
[61] Tago LLC. Tago—Home. Accessed: Oct. 22, 2017. [Online]. Available:
https://tago.io/
[62] Telit. IoT Platform Overview—Telit. Accessed: Oct. 22, 2017.
[Online]. Available: https://www.telit.com/products/iot-platforms/iot-
platform-overview/
[63] Temboo Inc. Temboo. Accessed: Oct. 22, 2017. [Online]. Available:
Mauro A. A. da Cruz received the master’s degree
https://temboo.com/
in telecommunications from the National Institute of
[64] The MathWorks Inc. IoT Analytics—ThingSpeak Internet of Things.
Telecommunications, Santa Rita do Sapucaí, Brazil,
Accessed: Oct. 22, 2017. [Online]. Available: https://thingspeak.com/
and a five-year B.Sc. degree (licentiate) in informat-
[65] PTC. ThingWorx IoT Platform |PTC. Accessed: Oct. 22, 2017.
ics engineering from the Universidade Católica de
[Online]. Available: https://www.ptc.com/en/products/iot/technology-
Angola, Luanda, Angola.
platform-thingworx
His current research interests include Internet of
[66] Ubidots. IoT Platform |Internet of Things |Ubidots. Accessed: Oct. 22,
Things, middleware for IoT, and mobile computing.
2017. [Online]. Available: https://ubidots.com/
[67] WSO2. WSO2 IoT Server—Flexible Open Source IoT Platform.
Accessed: Oct. 22, 2017. [Online]. Available: https://wso2.com/iot
DA CRUZ et al.: REFERENCE MODEL FOR IoT MIDDLEWARE 883

Joel José P. C. Rodrigues (S’01–M’06–SM’06) is Valery V. Korotaev received the Honorary Doctor
a Professor and a Senior Researcher with the degree in engineering, Ph.D. degree in optical engi-
National Institute of Telecommunications (Inatel), neering, and Specialist degree in optical-electronic
Santa Rita do Sapucaí, Brazil, and a Senior systems from the Institute of Fine Mechanics
Researcher with the Instituto de Telecomunicações, and Optics (currently, ITMO University), Saint
Lisbon, Portugal. He is the Leader of the Internet Petersburg, Russia.
of Things Research Group (CNPq), Inatel. He has He is the Head of the Department of
authored or co-authored over 550 papers in refereed Optical-Electronic Devices and Systems, ITMO
international journals and conferences, 3 books, and University, where he is the Leader of the
2 patents. International Laboratory “Technosphere Safety”
Prof. Rodrigues was a recipient of several (http://irc.ifmo.ru/en/87809/), the Honorary Worker
Outstanding Leadership and Outstanding Service Awards of the IEEE of Higher Professional Education of the Russian Federation, a corresponding
Communications Society and several Best Papers Awards. He is a member member of the Prokhorov Academy of Engineering Sciences, a member of
of the IEEE ComSoc Board of Governors as the Director for Conference the Rozhdestvensky Optical Society (part of the EOS), a member of the
Development, an IEEE Distinguished Lecturer, the President of the Scientific Educational Council for the direction “Optical engineering,” and a member
Council with ParkUrbis—Covilhã Science and Technology Park, the Past- of the Educational Association of Russian Universities for Instrumentation
Chair of the IEEE ComSoc Technical Committee on eHealth and on Technology and Optical Engineering. He has authored over 200 papers in
Communications Software, a Steering Committee member of the IEEE Life refereed international and domestic journals and conferences and 21 patents.
Sciences Technical Community and the Publications Co-Chair, and a member His current research interests include optical-electronic measuring devices
representative of the IEEE Communications Society on the IEEE Biometrics and systems, linear and angular measurements, the polarization properties
Council. He is the Editor-in-Chief of the International Journal of E-Health of optical systems and their components, nondestructive testing and fault
and Medical Communications, Recent Advances on Communications and detection, and inspection of large-scale objects.
Networking Technology, and the Journal of Multimedia Information Systems,
and an Editorial Board member of several high-reputed journals. He has been
the General Chair and the TPC Chair of many international conferences. He
is a member of many international TPCs and has participated in several inter-
national conferences organization. He is a Licensed Professional Engineer (as Victor Hugo C. de Albuquerque (M’17) received
a Senior Member), a member of the Internet Society, and a Senior Member the graduation degree in mechatronics technology
of the ACM. from the Federal Center of Technological Education
of Ceará, Fortaleza, Brazil, in 2006, the M.Sc. degree
in teleinformatics engineering from the Federal
University of Ceará, Fortaleza, in 2007, and the
Ph.D. degree in mechanical engineering with empha-
Jalal Al-Muhtadi received the M.S. and Ph.D. sis on materials from the Federal University of
degrees in computer science from the University Paraíba, João Pessoa, Brazil, in 2010.
of Illinois at Urbana–Champaign, Champaign, He is currently an Assistant VI Professor with
IL, USA. the Graduate Program in Applied Informatics at the
He is the Director of the Center of Excellence University of Fortaleza, Fortaleza. He has experience in computer systems,
in Information Assurance, King Saud University, mainly in the research fields of applied computing, intelligent systems,
Riyadh, Saudi Arabia, where he is an Assistant visualization and interaction, with specific interest in pattern recognition,
Professor with the Department of Computer Science. artificial intelligence, image processing and analysis, Internet of Things,
His current research interests include cybersecu- Internet of Health Things, as well as automation with respect to biolog-
rity, information assurance, privacy, and Internet ical signal/image processing, image segmentation, biomedical circuits, and
of Things. He has authored or co-authored over human/brain–machine interaction, including augmented and virtual reality
50 scientific publications in the areas of cybersecurity and IoT. simulation modeling for animals and humans.