Visible to the public Biblio

Filters: Keyword is IoT security  [Clear All Filters]
Swarna Sugi, S. Shinly, Ratna, S. Raja.  2020.  Investigation of Machine Learning Techniques in Intrusion Detection System for IoT Network. 2020 3rd International Conference on Intelligent Sustainable Systems (ICISS). :1164–1167.
Internet of Things (IoT) combines the internet and physical objects to transfer information among the objects. In the emerging IoT networks, providing security is the major issue. IoT device is exposed to various security issues due to its low computational efficiency. In recent years, the Intrusion Detection System valuable tool deployed to secure the information in the network. This article exposes the Intrusion Detection System (IDS) based on deep learning and machine learning to overcome the security attacks in IoT networks. Long Short-Term Memory (LSTM) and K-Nearest Neighbor (KNN) are used in the attack detection model and performances of those algorithms are compared with each other based on detection time, kappa statistic, geometric mean, and sensitivity. The effectiveness of the developed IDS is evaluated by using Bot-IoT datasets.
Chatterjee, Runa, Chakraborty, Rajdeep.  2020.  A Modified Lightweight PRESENT Cipher For IoT Security. 2020 International Conference on Computer Science, Engineering and Applications (ICCSEA). :1—6.
Of late, the massive use of pervasive devices in the electronics field has raised the concerns about security. In embedded applications or IoT domain implementing a full-fledged cryptographic environment using conventional encryption algorithms would not be practical because of the constraints like power dissipation, area and speed. To overcome such barriers the focus is on lightweight cryptography. In this paper a new lightweight PRESENT cipher has been proposed which has modified the original PRESENT cipher by reducing encryption round, modifying the Key Register updating technique and adding a new layer in between S-box layer and P-layer of the existing encryption-decryption process. The key register is updated by encrypting its value by adding delta value function of TEA (Tiny encryption algorithm), which is another lightweight cipher. The addition of extra layer helps us to reduce the PRESENT round from 31 to 25 which is the minimum round required for security. The efficiency of the proposed algorithm is increased by encrypting the key register. The proposed algorithm proves its superiority by analyzing different software parameter analysis like N-gram, Non-Homogeneity, Frequency Distribution graph and Histogram.
Tang, Jie, Xu, Aidong, Jiang, Yixin, Zhang, Yunan, Wen, Hong, Zhang, Tengyue.  2020.  Secret Key Attaches in MIMO IoT Communications by Using Self-injection Artificial Noise. 2020 IEEE International Conference on Artificial Intelligence and Information Systems (ICAIIS). :225–229.
Internet of Things (IoT) enable information transmission and sharing among massive IoT devices. However, the key establishment and management in IoT become more challenging due to the low latency requirements and resource constrained IoT devices. In this work, we propose a practical physical layer based secret key sharing scheme for MIMO (multiple-input-multiple-output) IoT devices to reduce the communication delay caused by key establishment of MIMO IoT devices. This is because the proposed scheme attachs secret key sharing with communication simultaneously. It is achieved by the proposed MIMO self-injection AN (SAN) tranmsission, which is designed to deliberately maximum the receive SNR (signal to noise ratio) at different antenna of the legitimate IoT device, based on the value of secret key sharing to him. The simulation results verified the validity and security of the proposed scheme.
Kim, Byoungkoo, Yoon, Seoungyong, Kang, Yousung, Choi, Dooho.  2020.  Secure IoT Device Authentication Scheme using Key Hiding Technology. 2020 International Conference on Information and Communication Technology Convergence (ICTC). :1808—1810.
As the amount of information distributed and processed through IoT(Internet of Things) devices is absolutely increased, various security issues are also emerging. Above all, since IoT technology is directly applied to our real life, there is a growing concern that the dangers of the existing cyberspace can be expanded into the real world. In particular, leaks of keys necessary for authentication and data protection of IoT devices are causing economic and industrial losses through illegal copying and data leakage. Therefore, this paper introduces the research trend of hardware and software based key hiding technology to respond to these security threats, and proposes IoT device authentication techniques using them. The proposed method fundamentally prevents the threat of exposure of the authentication key due to various security vulnerabilities by properly integrating hardware and software based key hiding technologies. That is, this paper provides a more reliable IoT device authentication scheme by using key hiding technology for authentication key management.
Jung, Junyoung, Cho, Jinsung, Lee, Ben.  2020.  A Secure Platform for IoT Devices based on ARM Platform Security Architecture. 2020 14th International Conference on Ubiquitous Information Management and Communication (IMCOM). :1—4.
Recent IoT services are being used in various fields such as smart homes, smart factories, smart cars and industrial systems. These various IoT services are implemented through hyper-connected IoT devices, and accordingly, security requirements of these devices are being highlighted. In order to satisfy the security requirements of IoT devices, various studies have been conducted such as HSM, Security SoC, and TrustZone. In particular, ARM proposed Platform Security Architecture (PSA), which is a security architecture that provide execution isolation to safely manage and protect the computing resources of low- end IoT devices. PSA can ensure confidentiality and integrity of IoT devices based on its structural features, but conversely, it has the problem of increasing development difficulty in using the security functions of PSA. To solve this problem, this paper analyzes the security requirements of an IoT platform and proposes secure platform based on PSA. To evaluate the proposed secure platform, a PoC implementation is provided based on hardware prototype consisting of FPGA. Our experiments with the PoC implementation verify that the proposed secure platform offers not only high security but also convenience of application development for IoT devices.
Karie, Nickson M., Sahri, Nor Masri, Haskell-Dowland, Paul.  2020.  IoT Threat Detection Advances, Challenges and Future Directions. 2020 Workshop on Emerging Technologies for Security in IoT (ETSecIoT). :22—29.
It is predicted that, the number of connected Internet of Things (IoT) devices will rise to 38.6 billion by 2025 and an estimated 50 billion by 2030. The increased deployment of IoT devices into diverse areas of our life has provided us with significant benefits such as improved quality of life and task automation. However, each time a new IoT device is deployed, new and unique security threats emerge or are introduced into the environment under which the device must operate. Instantaneous detection and mitigation of every security threat introduced by different IoT devices deployed can be very challenging. This is because many of the IoT devices are manufactured with no consideration of their security implications. In this paper therefore, we review existing literature and present IoT threat detection research advances with a focus on the various IoT security challenges as well as the current developments towards combating cyber security threats in IoT networks. However, this paper also highlights several future research directions in the IoT domain.
Weissman, David.  2020.  IoT Security Using Deception – Measuring Improved Risk Posture. 2020 IEEE 6th World Forum on Internet of Things (WF-IoT). :1—2.
Deception technology is a useful approach to improve the security posture of IoT systems. The deployment of replication techniques as a deception tactic is presented with a summary of our research progress towards quantifying the defensive improvement as part of overall risk management considerations.
Zheng, Yifeng, Pal, Arindam, Abuadbba, Sharif, Pokhrel, Shiva Raj, Nepal, Surya, Janicke, Helge.  2020.  Towards IoT Security Automation and Orchestration. 2020 Second IEEE International Conference on Trust, Privacy and Security in Intelligent Systems and Applications (TPS-ISA). :55—63.
The massive boom of Internet of Things (IoT) has led to the explosion of smart IoT devices and the emergence of various applications such as smart cities, smart grids, smart mining, connected health, and more. While the proliferation of IoT systems promises many benefits for different sectors, it also exposes a large attack surface, raising an imperative need to put security in the first place. It is impractical to heavily rely on manual operations to deal with security of massive IoT devices and applications. Hence, there is a strong need for securing IoT systems with minimum human intervention. In light of this situation, in this paper, we envision security automation and orchestration for IoT systems. After conducting a comprehensive evaluation of the literature and having conversations with industry partners, we envision a framework integrating key elements towards this goal. For each element, we investigate the existing landscapes, discuss the current challenges, and identify future directions. We hope that this paper will bring the attention of the academic and industrial community towards solving challenges related to security automation and orchestration for IoT systems.
Abbas, Syed Ghazanfar, Husnain, Muhammad, Fayyaz, Ubaid Ullah, Shahzad, Farrukh, Shah, Ghalib A., Zafar, Kashif.  2020.  IoT-Sphere: A Framework to Secure IoT Devices from Becoming Attack Target and Attack Source. 2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom). :1402—1409.
In this research we propose a framework that will strengthen the IoT devices security from dual perspectives; avoid devices to become attack target as well as a source of an attack. Unlike traditional devices, IoT devices are equipped with insufficient host-based defense system and a continuous internet connection. All time internet enabled devices with insufficient security allures the attackers to use such devices and carry out their attacks on rest of internet. When plethora of vulnerable devices become source of an attack, intensity of such attacks increases exponentially. Mirai was one of the first well-known attack that exploited large number of vulnerable IoT devices, that bring down a large part of Internet. To strengthen the IoT devices from dual security perspective, we propose a two step framework. Firstly, confine the communication boundary of IoT devices; IoT-Sphere. A sphere of IPs that are allowed to communicate with a device. Any communication that violates the sphere will be blocked at the gateway level. Secondly, only allowed communication will be evaluated for potential attacks and anomalies using advance detection engines. To show the effectiveness of our proposed framework, we perform couple of attacks on IoT devices; camera and google home and show the feasibility of IoT-Sphere.
Johari, Rahul, Kaur, Ishveen, Tripathi, Reena, Gupta, Kanika.  2020.  Penetration Testing in IoT Network. 2020 5th International Conference on Computing, Communication and Security (ICCCS). :1—7.
Penetration testing, also known as Pen testing is usually performed by a testing professional in order to detect security threats involved in a system. Penetration testing can also be viewed as a fake cyber Security attack, done in order to see whether the system is secure and free of vulnerabilities. Penetration testing is widely used for testing both Network and Software, but somewhere it fails to make IoT more secure. In IoT the security risk is growing day-by-day, due to which the IoT networks need more penetration testers to test the security. In the proposed work an effort has been made to compile and aggregate the information regarding VAPT(Vulnerability Assessment and Penetrating Testing) in the area of IoT.
Awadelkarim Mohamed, Awad M., Abdallah M. Hamad, Yahia.  2020.  IoT Security: Review and Future Directions for Protection Models. 2020 International Conference on Computing and Information Technology (ICCIT-1441). :1—4.
Nowadays, Internet of Things (IoT) has gained considerable significance and concern, consequently, and in particular with widespread usage and adoption of the IoT applications and projects in various industries, the consideration of the IoT Security has increased dramatically too. Therefore, this paper presents a concise and a precise review for the current state of the IoT security models and frameworks. The paper also proposes a new unified criteria and characteristics, namely Formal, Inclusive, Future, Agile, and Compliant with the standards (FIFAC), in order to assure modularity, reliability, and trust for future IoT security models, as well as, to provide an assortment of adaptable controls for protecting the data consistently across all IoT layers.
Shin, Sanggyu, Seto, Yoichi.  2020.  Development of IoT Security Exercise Contents for Cyber Security Exercise System. 2020 13th International Conference on Human System Interaction (HSI). :1—6.
In this paper, we discuss the development of the IoT security exercise content and the implementation of it to the CyExec. While the Internet of Things (IoT) devices are becoming more popular, vulnerability countermeasures are insufficient, and many incidents have occurred. It is because there is insufficient protection against vulnerabilities specific to IoT equipment. Also, the developers and users have low awareness of IoT devices against vulnerabilities from the past. Therefore, the importance of security education on IoT devices is increasing. However, the enormous burden of introduction and operation costs limited the use of commercial cybersecurity exercise systems. CyExec (Cyber Security Exercise System), consisting of a virtual environment using VirtualBox and Docker, is a low-cost and flexible cybersecurity exercise system, which we have proposed for the dissemination of security education. And the content of the exercises for CyExec is composed of the Basic exercises and Applied exercises.
Jaigirdar, Fariha Tasmin, Rudolph, Carsten, Bain, Chris.  2020.  Prov-IoT: A Security-Aware IoT Provenance Model. 2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom). :1360—1367.
A successful application of an Internet of Things (IoT) based network depends on the accurate and successful delivery of a large amount of data collected from numerous sources. However, the highly dynamic nature of IoT network prevents the establishment of clear security perimeters and hampers the understanding of security aspects. Risk assessment in such networks requires good situational awareness with respect to security. Therefore, a comprehensive view of data propagation including information on security controls can improve security analysis and risk assessment in each layer of data propagation in an IoT architecture. Documentation of metadata is already used in data provenance to identify who generates which data, how, and when. However, documentation of security information is not seen as relevant for data provenance graphs. In this paper, we discuss the importance of adding security metadata in a data provenance graph. We propose a novel IoT Provenance model, Prov-IoT, which documents the history of data records considering data processing and aggregation along with security metadata to enable a foundation for trust in data. The model portrays a comprehensive framework and outlines the identification of information to be included in designing a security-aware provenance graph. This can be beneficial for uncovering system fault or intrusion. Also, it can be useful for decision-based systems for security analysis and risk estimation. We design an associated class diagram for the Prov-IoT model. Finally, we use an IoT healthcare example scenario to demonstrate the impact of the proposed model.
Zhou, Eda, Turcotte, Joseph, De Carli, Lorenzo.  2020.  Enabling Security Analysis of IoT Device-to-Cloud Traffic. 2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom). :1888—1894.
End-to-end encryption is now ubiquitous on the internet. By securing network communications with TLS, parties can insure that in-transit data remains inaccessible to collection and analysis. In the IoT domain however, end-to-end encryption can paradoxically decrease user privacy, as many IoT devices establish encrypted communications with the manufacturer's cloud backend. The content of these communications remains opaque to the user and in several occasions IoT devices have been discovered to exfiltrate private information (e.g., voice recordings) without user authorization. In this paper, we propose Inspection-Friendly TLS (IF-TLS), an IoT-oriented, TLS-based middleware protocol that preserves the encryption offered by TLS while allowing traffic analysis by middleboxes under the user's control. Differently from related efforts, IF-TLS is designed from the ground up for the IoT world, adding limited complexity on top of TLS and being fully controllable by the residential gateway. At the same time it provides flexibility, enabling the user to offload traffic analysis to either the gateway itself, or cloud-based middleboxes. We implemented a stable, Python-based prototype IF-TLS library; preliminary results show that performance overhead is limited and unlikely to affect quality-of-experience.
Santos, Bernardo, Dzogovic, Bruno, Feng, Boning, Jacot, Niels, Do, Van Thuan, Do, Thanh Van.  2020.  Improving Cellular IoT Security with Identity Federation and Anomaly Detection. 2020 5th International Conference on Computer and Communication Systems (ICCCS). :776—780.

As we notice the increasing adoption of Cellular IoT solutions (smart-home, e-health, among others), there are still some security aspects that can be improved as these devices can suffer various types of attacks that can have a high-impact over our daily lives. In order to avoid this, we present a multi-front security solution that consists on a federated cross-layered authentication mechanism, as well as a machine learning platform with anomaly detection techniques for data traffic analysis as a way to study devices' behavior so it can preemptively detect attacks and minimize their impact. In this paper, we also present a proof-of-concept to illustrate the proposed solution and showcase its feasibility, as well as the discussion of future iterations that will occur for this work.

Bazari, Aditya Shyam, Singh, Aditya, Khan, Abdul Ahad, Jindal, Rajni.  2020.  Filter Based Scalable Blockchain for Domestic Internet of Things. 2020 5th International Conference on Communication and Electronics Systems (ICCES). :1051—1056.

With the advancements in technology, the ease of interconnectedness among devices has increased manifold, leading to the widespread usage of Internet of Things. Internet of Things has also reached our homes, often referred to as domestic Internet of Things. However, the security aspect of domestic Internet of Things has largely been under question as the increase in inter-device communication renders the system more vulnerable to adversaries. Largely popular blockchain technology is being extensively researched for integration into the Internet of Things framework in order to improve the security aspect of the framework. Blockchain, being a cryptographically linked set of data, has a few barriers which prevent it from being successfully integrated to Internet of Things. One of the major barrier is the high computational requirements and time latency associated with it. This work tries to address this research gap and proposes a novel scalable blockchain optimization for domestic Internet of Things. The proposed blockchain model uses a flow based filtering technique as an added security layer to facilitate the scenario. This work then evaluates the performance of the proposed model in various scenarios and compares it with that of traditional blockchain. The work presents a largely encompassing evaluation, explanation and assessment of the proposed model.

Li, Y., Yang, Y., Yu, X., Yang, T., Dong, L., Wang, W..  2020.  IoT-APIScanner: Detecting API Unauthorized Access Vulnerabilities of IoT Platform. 2020 29th International Conference on Computer Communications and Networks (ICCCN). :1—5.

The Internet of Things enables interaction between IoT devices and users through the cloud. The cloud provides services such as account monitoring, device management, and device control. As the center of the IoT platform, the cloud provides services to IoT devices and IoT applications through APIs. Therefore, the permission verification of the API is essential. However, we found that some APIs are unverified, which allows unauthorized users to access cloud resources or control devices; it could threaten the security of devices and cloud. To check for unauthorized access to the API, we developed IoT-APIScanner, a framework to check the permission verification of the cloud API. Through observation, we found there is a large amount of interactive information between IoT application and cloud, which include the APIs and related parameters, so we can extract them by analyzing the code of the IoT application, and use this for mutating API test cases. Through these test cases, we can effectively check the permissions of the API. In our research, we extracted a total of 5 platform APIs. Among them, the proportion of APIs without permission verification reached 13.3%. Our research shows that attackers could use the API without permission verification to obtain user privacy or control of devices.

Zhang, Y., Weng, J., Ling, Z., Pearson, B., Fu, X..  2020.  BLESS: A BLE Application Security Scanning Framework. IEEE INFOCOM 2020 - IEEE Conference on Computer Communications. :636—645.
Bluetooth Low Energy (BLE) is a widely adopted wireless communication technology in the Internet of Things (IoT). BLE offers secure communication through a set of pairing strategies. However, these pairing strategies are obsolete in the context of IoT. The security of BLE based devices relies on physical security, but a BLE enabled IoT device may be deployed in a public environment without physical security. Attackers who can physically access a BLE-based device will be able to pair with it and may control it thereafter. Therefore, manufacturers may implement extra authentication mechanisms at the application layer to address this issue. In this paper, we design and implement a BLE Security Scan (BLESS) framework to identify those BLE apps that do not implement encryption or authentication at the application layer. Taint analysis is used to track if BLE apps use nonces and cryptographic keys, which are critical to cryptographic protocols. We scan 1073 BLE apps and find that 93% of them are not secure. To mitigate this problem, we propose and implement an application-level defense with a low-cost \$0.55 crypto co-processor using public key cryptography.
Kasah, N. b H., Aman, A. H. b M., Attarbashi, Z. S. M., Fazea, Y..  2020.  Investigation on 6LoWPAN Data Security for Internet of Things. 2020 2nd International Conference on Computer and Information Sciences (ICCIS). :1–5.
Low-power wireless network technology is one of the main key characteristics in communication systems that are needed by the Internet of Things (IoT). Nowadays, the 6LoWPAN standard is one of the communication protocols which has been identified as an important protocol in IoT applications. Networking technology in 6LoWPAN transfer IPv6 packets efficiently in link-layer framework that is well-defined by IEEE 802.14.5 protocol. 6Lo WPAN development is still having problems such as threats and entrust crises. The most important part when developing this new technology is the challenge to secure the network. Data security is viewed as a major consideration in this network communications. Many researchers are working to secure 6LoWPAN communication by analyzing the architecture and network features. 6LoWPAN security weakness or vulnerability is exposed to various forms of network attack. In this paper, the security solutions for 6LoWPAN have been investigated. The requirements of safety in 6LoWPAN are also presented.
Zhang, Jiliang, Qu, Gang.  2020.  Physical Unclonable Function-Based Key Sharing via Machine Learning for IoT Security. IEEE Transactions on Industrial Electronics. 67:7025—7033.

In many industry Internet of Things applications, resources like CPU, memory, and battery power are limited and cannot afford the classic cryptographic security solutions. Silicon physical unclonable function (PUF) is a lightweight security primitive that exploits manufacturing variations during the chip fabrication process for key generation and/or device authentication. However, traditional weak PUFs such as ring oscillator (RO) PUF generate chip-unique key for each device, which restricts their application in security protocols where the same key is required to be shared in resource-constrained devices. In this article, in order to address this issue, we propose a PUF-based key sharing method for the first time. The basic idea is to implement one-to-one input-output mapping with lookup table (LUT)-based interstage crossing structures in each level of inverters of RO PUF. Individual customization on configuration bits of interstage crossing structure and different RO selections with challenges bring high flexibility. Therefore, with the flexible configuration of interstage crossing structures and challenges, crossover RO PUF can generate the same shared key for resource-constrained devices, which enables a new application for lightweight key sharing protocols.

Fang, Zheng, Fu, Hao, Gu, Tianbo, Qian, Zhiyun, Jaeger, Trent, Mohapatra, Prasant.  2019.  ForeSee: A Cross-Layer Vulnerability Detection Framework for the Internet of Things. 2019 IEEE 16th International Conference on Mobile Ad Hoc and Sensor Systems (MASS). :236–244.
The exponential growth of Internet-of-Things (IoT) devices not only brings convenience but also poses numerous challenging safety and security issues. IoT devices are distributed, highly heterogeneous, and more importantly, directly interact with the physical environment. In IoT systems, the bugs in device firmware, the defects in network protocols, and the design flaws in system configurations all may lead to catastrophic accidents, causing severe threats to people's lives and properties. The challenge gets even more escalated as the possible attacks may be chained together in a long sequence across multiple layers, rendering the current vulnerability analysis inapplicable. In this paper, we present ForeSee, a cross-layer formal framework to comprehensively unveil the vulnerabilities in IoT systems. ForeSee generates a novel attack graph that depicts all of the essential components in IoT, from low-level physical surroundings to high-level decision-making processes. The corresponding graph-based analysis then enables ForeSee to precisely capture potential attack paths. An optimization algorithm is further introduced to reduce the computational complexity of our analysis. The illustrative case studies show that our multilayer modeling can capture threats ignored by the previous approaches.
Paudel, Ramesh, Muncy, Timothy, Eberle, William.  2019.  Detecting DoS Attack in Smart Home IoT Devices Using a Graph-Based Approach. 2019 IEEE International Conference on Big Data (Big Data). :5249–5258.
The use of the Internet of Things (IoT) devices has surged in recent years. However, due to the lack of substantial security, IoT devices are vulnerable to cyber-attacks like Denial-of-Service (DoS) attacks. Most of the current security solutions are either computationally expensive or unscalable as they require known attack signatures or full packet inspection. In this paper, we introduce a novel Graph-based Outlier Detection in Internet of Things (GODIT) approach that (i) represents smart home IoT traffic as a real-time graph stream, (ii) efficiently processes graph data, and (iii) detects DoS attack in real-time. The experimental results on real-world data collected from IoT-equipped smart home show that GODIT is more effective than the traditional machine learning approaches, and is able to outperform current graph-stream anomaly detection approaches.
Gauniyal, Rishav, Jain, Sarika.  2019.  IoT Security in Wireless Devices. 2019 3rd International conference on Electronics, Communication and Aerospace Technology (ICECA). :98—102.

IoT is evolving as a combination of interconnected devices over a particular network. In the proposed paper, we discuss about the security of IoT system in the wireless devices. IoT security is the platform in which the connected devices over the network are safeguarded over internet of things framework. Wireless devices play an eminent role in this kind of networks since most of the time they are connected to the internet. Accompanied by major users cannot ensure their end to end security in the IoT environment. However, connecting these devices over the internet via using IoT increases the chance of being prone to the serious issues that may affect the system and its data if they are not protected efficiently. In the proposed paper, the security of IoT in wireless devices will be enhanced by using ECC. Since the issues related to security are becoming common these days, an attempt has been made in this proposed paper to enhance the security of IoT networks by using ECC for wireless devices.

Reddy, Vijender Busi, Negi, Atul, Venkataraman, S, Venkataraman, V Raghu.  2019.  A Similarity based Trust Model to Mitigate Badmouthing Attacks in Internet of Things (IoT). 2019 IEEE 5th World Forum on Internet of Things (WF-IoT). :278—282.

In Internet of Things (IoT) each object is addressable, trackable and accessible on the Internet. To be useful, objects in IoT co-operate and exchange information. IoT networks are open, anonymous, dynamic in nature so, a malicious object may enter into the network and disrupt the network. Trust models have been proposed to identify malicious objects and to improve the reliability of the network. Recommendations in trust computation are the basis of trust models. Due to this, trust models are vulnerable to bad mouthing and collusion attacks. In this paper, we propose a similarity model to mitigate badmouthing and collusion attacks and show that proposed method efficiently removes the impact of malicious recommendations in trust computation.

Su, Wei-Tsung, Chen, Wei-Cheng, Chen, Chao-Chun.  2019.  An Extensible and Transparent Thing-to-Thing Security Enhancement for MQTT Protocol in IoT Environment. 2019 Global IoT Summit (GIoTS). :1—4.

Message Queue Telemetry Transport (MQTT) is widely accepted as a data exchange protocol in Internet of Things (IoT) environment. For security, MQTT supports Transport Layer Security (MQTT-TLS). However, MQTT-TLS provides thing-to-broker channel encryption only because data can still be exposed after MQTT broker. In addition, ACL becomes impractical due to the increasing number of rules for authorizing massive IoT devices. For solving these problems, we propose MQTT Thing-to-Thing Security (MQTT-TTS) which provides thing-to-thing security which prevents data leak. MQTT-TTS also provides the extensibility to include demanded security mechanisms for various security requirements. Moreover, the transparency of MQTT-TTS lets IoT application developers implementing secure data exchange with less programming efforts. Our MQTT-TTS implementation is available on for evaluation.