Visible to the public Biblio

Filters: Keyword is MQTT  [Clear All Filters]
Conference Paper
Hänel, T., Bothe, A., Helmke, R., Gericke, C., Aschenbruck, N..  2017.  Adjustable security for RFID-equipped IoT devices. 2017 IEEE International Conference on RFID Technology Application (RFID-TA). :208–213.

Over the last years, the number of rather simple interconnected devices in nonindustrial scenarios (e.g., for home automation) has steadily increased. For ease of use, the overall system security is often neglected. Before the Internet of Things (IoT) reaches the same distribution rate and impact in industrial applications, where security is crucial for success, solutions that combine usability, scalability, and security are required. We develop such a security system, mainly targeting sensor modules equipped with Radio Frequency IDentification (RFID) tags which we leverage to increase the security level. More specifically, we consider a network based on Message Queue Telemetry Transport (MQTT) which is a widely adopted protocol for the IoT.

Andy, S., Rahardjo, B., Hanindhito, B..  2017.  Attack scenarios and security analysis of MQTT communication protocol in IoT system. 2017 4th International Conference on Electrical Engineering, Computer Science and Informatics (EECSI). :1–6.
Various communication protocols are currently used in the Internet of Things (IoT) devices. One of the protocols that are already standardized by ISO is MQTT protocol (ISO / IEC 20922: 2016). Many IoT developers use this protocol because of its minimal bandwidth requirement and low memory consumption. Sometimes, IoT device sends confidential data that should only be accessed by authorized people or devices. Unfortunately, the MQTT protocol only provides authentication for the security mechanism which, by default, does not encrypt the data in transit thus data privacy, authentication, and data integrity become problems in MQTT implementation. This paper discusses several reasons on why there are many IoT system that does not implement adequate security mechanism. Next, it also demonstrates and analyzes how we can attack this protocol easily using several attack scenarios. Finally, after the vulnerabilities of this protocol have been examined, we can improve our security awareness especially in MQTT protocol and then implement security mechanism in our MQTT system to prevent such attack.
Protskaya, Yanina, Veltri, Luca.  2019.  Broker Bridging Mechanism for Providing Anonymity in MQTT. 2019 10th International Conference on Networks of the Future (NoF). :110—113.
With the growth of the number of smart devices the range of fields where they are used is growing too, and it is essential to protect the communication between them. In addition to data integrity and confidentiality, for which standard mechanisms exists, a security service that may also be required is anonymity, allowing entities to communicate with each other in such a way that no third party knows that they are the participants of a certain message exchange. In this paper we propose a mechanism for creating anonymous communications using MQTT protocol. The design of our solution is based on dynamic broker bridging mechanism and allows clients to subscribe and to publish to a topic remaining incognito.
Hastings, John C., Laverty, David M., Jahic, Admir, Morrow, D John, Brogan, Paul.  2020.  Cyber-security considerations for domestic-level automated demand-response systems utilizing public-key infrastructure and ISO/IEC 20922. 2020 31st Irish Signals and Systems Conference (ISSC). :1–6.
In this paper, the Authors present MQTT (ISO/IEC 20922), coupled with Public-key Infrastructure (PKI) as being highly suited to the secure and timely delivery of the command and control messages required in a low-latency Automated Demand Response (ADR) system which makes use of domestic-level electrical loads connected to the Internet. Several use cases for ADR are introduced, and relevant security considerations are discussed; further emphasizing the suitability of the proposed infrastructure. The authors then describe their testbed platform for testing ADR functionality, and finally discuss the next steps towards getting these kinds of technologies to the next stage.
Morales-Caporal, Roberto, Reyes-Galaviz, Adrián S., Federico Casco-Vásquez, J., Martínez-Hernández, Haydee P..  2020.  Development and Implementation of a Relay Switch Based on WiFi Technology. 2020 17th International Conference on Electrical Engineering, Computing Science and Automatic Control (CCE). :1—6.
This article presents the design and development of a relay switch (RS) to handle electrical loads up to 20A using WiFi technology. The hardware design and the implementation methodology are explained, both for the power supply and for the wireless communication that are embedded in the same small printed circuit board. In the same way, the design of the implemented firmware to operate the developed RS is shown. An ESP-12E module is used to achieve wireless communication of the RS, which can be manipulated through a web page using an MQTT protocol or via and iOS or Arduino app. The developed RS presents at least three differentiators in relation to other similar devices on the market: it can handle a higher electrical load, has a design in accordance with national and international security standards and can use different cybersecurity strategies for wireless communication with the purpose of safe and reliable use. Experimental results using a lamp and a single-phase motor as electrical loads demonstrate an excellent performance and reliability of the developed relay switch.
Alhazmi, Omar H., Aloufi, Khalid S..  2019.  Fog-Based Internet of Things: A Security Scheme. 2019 2nd International Conference on Computer Applications Information Security (ICCAIS). :1–6.

Internet of Things (IoT) stack models differ in their architecture, applications and needs. Hence, there are different approaches to apply IoT; for instance, it can be based on traditional data center or based on cloud computing. In fact, Cloud-based IoT is gaining more popularity due to its high scalability and cost effectiveness; hence, it is becoming the norm. However, Cloud is usually located far from the IoT devices and some recent research suggests using Fog-Based IoT by using a nearby light-weight middleware to bridge the gap and to provide the essential support and communication between devices, sensors, receptors and the servers. Therefore, Fog reduces centrality and provides local processing for faster analysis, especially for the time-sensitive applications. Thus, processing is done faster, giving the system flexibility for faster response time. Fog-Based Internet of Things security architecture should be suitable to the environment and provide the necessary measures to improve all security aspects with respect to the available resources and within performance constraints. In this work, we discuss some of these challenges, analyze performance of Fog based IoT and propose a security scheme based on MQTT protocol. Moreover, we present a discussion on security-performance tradeoffs.

Nasution, A. P., Suryani, V., Wardana, A. A..  2020.  IoT Object Security towards On-off Attack Using Trustworthiness Management. 2020 8th International Conference on Information and Communication Technology (ICoICT). :1–6.
Internet of Things (IoT) can create the world with the integration of the physical things with the seamlessly network of information purposely to give a sophisticated and smart service for human life. A variety of threats and attacks to IoT object, however, can lead to the misuse of data or information to the IoT objects. One of the attacks is On-off Attack in which the attacker acts not only as an object with a good manner by sending the valid trust value but also sometimes as a bad object by sending invalid one. To respond this action, there is a need for the object security to such attacks. Here the writer used the Trustworthiness Management as a method to cope with this attack. Trustworthiness Management can use the aspect of trust value security as a reference for detecting an attack to the object. In addition, with the support of security system using the authentication provided by MQTT, it is expected that it can provide an additional security. The approach used in this research was the test on On-Off Attack detection directly to the object connected to the network. The results of the test were then displayed on the webpage made using PHP and MySQL database as the storage of the values sent by the object to the server. The test on the On-off Attack detection was successfully conducted with the success level of 100% and the execution to detection took 0.5518318 seconds. This then showed that Trustworthiness Management can be used as one of the methods to cope with On-off Attack.
Potrino, Giuseppe, de Rango, Floriano, Santamaria, Amilcare Francesco.  2019.  Modeling and evaluation of a new IoT security system for mitigating DoS attacks to the MQTT broker. 2019 IEEE Wireless Communications and Networking Conference (WCNC). :1–6.
In recent years, technology use has assumed an important role in the support of human activities. Intellectual work has become the main preferred human activity, while structured activities are going to become ever more automatized for increasing their efficiency. For this reason, we assist to the diffusion of ever more innovative devices able to face new emergent problems. These devices can interact with the environment and each other autonomously, taking decisions even without human control. This is the Internet of Things (IoT) phenomenon, favored by low cost, high mobility, high interaction and low power devices. This spread of devices has become uncontrolled, but security in this context continues to increase slowly. The purpose of this work is to model and evaluate a new IoT security system. The context is based on a generic IoT system in the presence of lightweight actuator and sensor nodes exchanging messages through Message Queue Telemetry Transport (MQTT) protocol. This work aims to increase the security of this protocol at application level, particularly mitigating Denial of Service (DoS) attacks. The system is based on the use of a host Intrusion Detection System (IDS) which applies a threshold based packet discarding policy to the different topics defined through MQTT.
Mukhandi, M., Portugal, D., Pereira, S., Couceiro, M. S..  2019.  A novel solution for securing robot communications based on the MQTT protocol and ROS. 2019 IEEE/SICE International Symposium on System Integration (SII). :608—613.

With the growing use of the Robot Operating System (ROS), it can be argued that it has become a de-facto framework for developing robotic solutions. ROS is used to build robotic applications for industrial automation, home automation, medical and even automatic robotic surveillance. However, whenever ROS is utilized, security is one of the main concerns that needs to be addressed in order to ensure a secure network communication of robots. Cyber-attacks may hinder evolution and adaptation of most ROS-enabled robotic systems for real-world use over the Internet. Thus, it is important to address and prevent security threats associated with the use of ROS-enabled applications. In this paper, we propose a novel approach for securing ROS-enabled robotic system by integrating ROS with the Message Queuing Telemetry Transport (MQTT) protocol. We manage to secure robots' network communications by providing authentication and data encryption, therefore preventing man-in-the-middle and hijacking attacks. We also perform real-world experiments to assess how the performance of a ROS-enabled robotic surveillance system is affected by the proposed approach.

Dikii, D. I..  2020.  Remote Access Control Model for MQTT Protocol. 2020 IEEE Conference of Russian Young Researchers in Electrical and Electronic Engineering (EIConRus). :288–291.
The author considers the Internet of Things security problems, namely, the organization of secure access control when using the MQTT protocol. Security mechanisms and methods that are employed or supported by the MQTT protocol have been analyzed. Thus, the protocol employs authentication by the login and password. In addition, it supports cryptographic processing over transferring data via the TLS protocol. Third-party services on OAuth protocol can be used for authentication. The authorization takes place by configuring the ACL-files or via third-party services and databases. The author suggests a device discretionary access control model of machine-to-machine interaction under the MQTT protocol, which is based on the HRU-model. The model entails six operators: the addition and deletion of a subject, the addition and deletion of an object, the addition and deletion of access privileges. The access control model is presented in a form of an access matrix and has three types of privileges: read, write, ownership. The model is composed in a way that makes it compatible with the protocol of a widespread version v3.1.1. The available types of messages in the MQTT protocol allow for the adjustment of access privileges. The author considered an algorithm with such a service data unit build that the unit could easily be distinguished in the message body. The implementation of the suggested model will lead to the minimization of administrator's involvement due to the possibility for devices to determine access privileges to the information resource without human involvement. The author suggests recommendations for security policies, when organizing an informational exchange in accordance with the MQTT protocol.
Nikolov, N..  2020.  Research of MQTT, CoAP, HTTP and XMPP IoT Communication protocols for Embedded Systems. 2020 XXIX International Scientific Conference Electronics (ET). :1—4.

This paper describe most popular IoT protocols used for IoT embedded systems and research their advantage and disadvantage. Hardware stage used in this experiment is described in this article - it is used Esp32 and programming language C. It is very important to use corrected IoT protocol that is determines of purpose, hardware and software of system. There are so different IoT protocols, because they are cover vary requirements for vary cases.