publish-subscribe security