Assessing Initial Attacks and Defense with Retry Function in MQTT Over QUIC

MQTT over QUIC protocol has recently garnered attention in the IoT field. This protocol enables faster communication than the traditional MQTT. However, the security risks arising from the new combination of MQTT and QUIC still need to be explained. In particular, the MQTT over QUIC broker's availability could be compromised by initial attacks that exploit specific vulnerabilities of the QUIC protocol. Initial attacks target the handshake process of the QUIC protocol and unfairly consume server-side resources. This study examines the impact of initial attacks on MQTT over QUIC brokers and proposes defensive measures. Our verification shows that initial attacks can indeed compromise the availability of MQTT over QUIC brokers. Furthermore, we confirmed that maintaining session continuity can preserve broker availability against initial attacks.

I. Introduction

Advancing the development of information sharing and communication enabled by the Internet, the field of the Internet of Things (IoT), which aims to realize a society where objects are interconnected, is rapidly increasing in importance alongside the evolution of digital technology in contemporary society. IoT holds the potential to introduce new values and lifestyles to us. By 2025, the existence of approximately 40 billion IoT devices is predicted, highlighting the significance of IoT and underscoring the necessity for reliable means of communication between devices [1].