A MQTT-API-compatible IoT security-enhanced platform

Abstract

Owing to its lightweight and easiness, the message queue telemetry transport (MQTT) has become one of the most popular communication protocols in the internet-of-things (IoT). However, the security supports in the MQTT are very weak. In this paper, we systematically examine the security requirements of a MQTT-based IoT system, identify the gap between the requirements and the supported functions, and design a security-enhanced MQTT framework. The framework facilitates device authentication, key agreement, and policy authorisation. Additionally, it is desirable that any MQTT-security enhancements should be compatible with existent MQTT Application Programming Interfaces (API). We propose a two-phase authentication approach that can smoothly integrate secure key agreement schemes with the current MQTT-API. To evaluate its effectiveness and efficiency, we implement prototype. Compared to its counterparts, the results show the merits of improved communication performance, MQTT-API compliance, and security robustness.

A survey on COVID-19 impact in the healthcare domain: worldwide market implementation, applications, security and privacy issues, challenges and future prospects

“…In contrast to the CoAP Request/response approach, it employs the publish/subscribe mechanism, which is better suited for the IoT. Furthermore, despite the availability of newer protocols, such as MQTT [ 112 ], it is an early internet protocol that has been supported. It is based on the Internet Engineering Task Force (IETF) standards for cross messaging, telepresence, and video and audio calling [ 113 ].…”

Data immutability and event management via blockchain in the Internet of things

“…All included MQTT clients can send and receive messages within a related channel, named a topic. The MQTT broker(s), on the other hand, is responsible for distributing messages coming from publisher clients to the subscriber clients (and to other devices, if any), depending on the topics they are interested in [20]. Mosca JS, an MQTT brokerage system, is preferred for broker implementation due to its simplicity and ease of use (as well as potential performance benefits).…”

Two-Level-Composite-Hashing Facilitating Highly Efficient Anonymous IoT and D2D Authentication

“…Some proposals like [40] propose authenticated key agreement schemes for MQTT systems. Chien et al [41] proposed a two-phase authentication framework in which any secure key agreement scheme can be performed in the first phase, and then the hash value of the session key is supplied as a password in the second phase MQTT CONNECT API. Chien [35] proposed an anonymous IoT protocol in the MQTT 3.11 CONNECT API.…”

“…In this section, we describe how we can apply our proposed D2S anonymous scheme in the MQTT 5.0 context. Chien et al [41] has shown how to implement their two-phase challenge-response protocol for enhancing the MQTT authentication, using the MQTT v3.1 [43] CONNECT API. The new MQTT standards v5.0 [5] has extended the MQTT v.3.1 API to incorporate a new feature called the enhanced authentication.…”