Security Analysis of the MQTT-SN Protocol for the Internet of Things

被引:17
作者
Roldan-Gomez, Jose [1 ]
Carrillo-Mondejar, Javier [2 ]
Castelo Gomez, Juan Manuel [2 ]
Ruiz-Villafranca, Sergio [2 ]
机构
[1] Univ Oviedo, Dept Comp Sci, Oviedo 33003, Spain
[2] Univ Castilla La Mancha, Inst Informat I3A, Albacete 02071, Spain
来源
APPLIED SCIENCES-BASEL | 2022年 / 12卷 / 21期
关键词
Internet of Things; cybersecurity; protocols; MQTT-SN; CHALLENGES;
D O I
10.3390/app122110991
中图分类号
O6 [化学];
学科分类号
0703 ;
摘要
The expansion of the Internet of Things (IoT) paradigm has brought with it the challenge of promptly detecting and evaluating attacks against the systems coexisting in it. One of the most recurrent methods used by cybercriminals is to exploit the vulnerabilities found in communication protocols, which can lead to them accessing, altering, and making data inaccessible and even bringing down a device or whole infrastructure. In the case of the IoT, the Message Queuing Telemetry Transport (MQTT) protocol is one of the most-used ones due to its lightness, allowing resource-constrained devices to communicate with each other. Improving its effectiveness, a lighter version of this protocol, namely MQTT for Sensor Networks (MQTT-SN), was especially designed for embedded devices on non-TCP/IP networks. Taking into account the importance of these protocols, together with the significance that security has when it comes to protecting the high-sensitivity data exchanged in IoT networks, this paper presents an exhaustive assessment of the MQTT-SN protocol and describes its shortcomings. In order to do so, seven different highly heterogeneous attacks were designed and tested, evaluating the different security impacts that they can have on a real MQTT-SN network and its performance. Each one of them was compared with a non-attacked implemented reference scenario, which allowed the comparison of an attacked system with that of a system without attacks. Finally, using the knowledge extracted from this evaluation, a threat detector is proposed that can be deployed in an IoT environment and detect previously unmodeled attacks.
引用
收藏
页数:24
相关论文
共 43 条
  • [1] An overview of security and privacy in smart cities' IoT communications
    Al-Turjman, Fadi
    Zahmatkesh, Hadi
    Shahroze, Ramiz
    [J]. TRANSACTIONS ON EMERGING TELECOMMUNICATIONS TECHNOLOGIES, 2022, 33 (03)
  • [2] Andy S, 2017, 2017 4TH INTERNATIONAL CONFERENCE ON ELECTRICAL ENGINEERING, COMPUTER SCIENCE AND INFORMATICS (EECSI), P571
  • [3] [Anonymous], 2020, STATE IOT 2020 12 BI
  • [4] [Anonymous], 2022, State of IoT 2022: Number of Connected IoT Devices Growing 18% to 14.4 Billion Globally
  • [5] Arvind S., 2019, 2019 5th International Conference on Advanced Computing & Communication Systems (ICACCS), P655, DOI 10.1109/ICACCS.2019.8728533
  • [6] Design and evaluation of a novel White-box encryption scheme for resource-constrained IoT devices
    Bang, A. O.
    Rao, Udai Pratap
    [J]. JOURNAL OF SUPERCOMPUTING, 2022, 78 (08) : 11111 - 11137
  • [7] Security Against Rank Attack in RPL Protocol
    Boudouaia, Mohammed Amine
    Ali-Pacha, Adda
    Abouaissa, Abdelhafid
    Lorenz, Pascal
    [J]. IEEE NETWORK, 2020, 34 (04): : 133 - 139
  • [8] A stream processing architecture for heterogeneous data sources in the Internet of Things
    Corral-Plaza, David
    Medina-Bulo, Inmaculada
    Ortiz, Guadalupe
    Boubeta-Puig, Juan
    [J]. COMPUTER STANDARDS & INTERFACES, 2020, 70
  • [9] Dahiya Prachi, 2023, Emerging Technologies in Data Mining and Information Security: Proceedings of IEMIS 2022. Lecture Notes in Networks and Systems (490), P3, DOI 10.1007/978-981-19-4052-1_1
  • [10] Dunkels A, 2004, CONF LOCAL COMPUT NE, P455