Message Queuing Telemetry Transport (MQTT) Security: A Cryptographic Smart Card Approach

Abstract

The Message Queuing Telemetry Transport (MQTT) protocol is one of the most extended protocols on the Internet of Things (IoT). However, this protocol does not implement a strong security scheme by default, which does not allow a secure authentication mechanism between participants in the communication. Furthermore, we cannot trust the confidentiality and integrity of data. Lightweight IoT devices send more and more sensible data in areas of Smart Building, Smart City, Smart House, Smart Car, Connected Car, Health Care, Smart Retail, Industrial IoT (IIoT), etc. This makes the security challenges in the protocols used in the IoT particularly important. The standard of MQTT protocol strongly recommends implement it over Transport Layer Security (TLS) instead of plain TCP. Nonetheless, this option is not possible in most lightweight devices that make up the IoT ecosystem. Quite often, the constrained resources of IoT devices prevent the use of secure asymmetric cryptography algorithms implemented by themselves. In this article, we propose making a security schema in MQTT protocol using Cryptographic Smart Cards, for both challenges, the authentication schema and the trusted data confidentiality and data integrity. We carry out this security schema without modifying the standard protocol messages. And finally, we present a time results experiment using an example implementation model with JavaCard library. INDEX TERMS Internet of things (IoT), javacard, message queuing telemetry transport (MQTT), mutual authentication, smart card

A Secure Internet of Things Smart Home Network: Design and Configuration

“…The performance overhead of HTTP and MQTT are compared in [7] using a case study of public bus tracking system. A more comprehensive review of the existing messaging protocols is presented in [8] where they compared applicability of the protocols across various IoT environments.…”

SCB-HC-ECC–Based Privacy Safeguard Protocol for Secure Cloud Storage of Smart Card–Based Health Care System

“…Ganesh et al ( 34 ) propose the smart, automated health machine using IoT, which provides health services to the local area. They discuss the authentication phase using the smart card system to secure their privacy, but the system is not integrated with the cloud ( 35 , 36 ).…”

Designing Multi-Layer Security Using Chaotic Map in Cloud Environment

“…MQTT assists this model to have better influence. MQTT protocol is one of the most extended protocol on the IoT that leads to less capacity for easy implementation on light weight, cheap, low-power and low memory devices [35] . The client can be a publisher or subscriber.…”

“…As per A. Cerrada and et al [35] each MQTT has three types of participants: Broker that is charge of the exchange of messages between the other participants. Publisher/ subscriber (client) is send data to the broker and provider service receives data from broker.…”