A Framework for Secure Internet of Things Applications

MQTT is the de facto standard protocol for Internet of Things (IoT) devices. It is a messaging protocol based on lightweight publish-subscribe architecture, tailored specifically for devices with limited computational capabilities. Being a lightweight protocol, it lacks security and privacy features. The OASIS standard suggests some mechanisms to enhance the MQTT protocol. Therefore it is the implementer’s responsibility to include these mechanisms as part of their design. In this paper, we identify three main missing features in MQTT, which are: (1) the presence of weak authentication procedures, (2) the lack of end-to-end security mechanisms, and (3) the lack of privacy mechanisms. Therefore, we propose to fill these gaps with three solutions from the literature, all leveraging the standard MQTT primitives. Finally, we propose a comprehensive framework showing how to combine the three above solutions with the security guidelines presented in the OASIS standard.