![](bg8.png)
stems and should be enforced by all the actors invol-
ved in production and manufacturing of components
that can be used to create an IoT ecosystem. Conside-
ring the projected growth rate of these devices and the
open nature of the hardware and software components
that are typically used, it would appear that this shift
in mentality should have highest importance and prio-
rity in everyone who is involved in the IoT arena. Ba-
sed on the status quo and on the fact that Moore’s law
certainly applies also to small-size devices, the aut-
hors are inclined to believe that a good mid-term so-
lution to large-scale MQTT security problems could
be represented by implementation of TLS. Strength
points of this approach would be the utilization of a
standard technology, continually tested for weaknes-
ses by the global IT security community; this would
allow easier implementation and interconnection of
different systems. At the same time, certificates ma-
nagement may remain an obstacle to a wide-spread
adoption of TLS, especially in all cases where low-
throughput networks (e.g., LPWANs) are used. For
these situations, single key ciphering or network se-
gregation could represent a more viable solution.
REFERENCES
Apollo (2016). Apache ActiveMQ Apollo homepage. avai-
lable: http://activemq.apache.org/apollo/. accessed:
March 21, 2017.
Artemis (2016). Apache ActiveMQ Artemis homepage.
available: http://activemq.apache.org/artemis/. acces-
sed: March 21, 2017.
Bethencourt, J., Sahai, A., and Waters, B. (2007).
Ciphertext-policy attribute-based encryption. In 2007
IEEE symposium on security and privacy (SP’07), pa-
ges 321–334. IEEE.
Chase, M. (2007). Multi-authority Attribute Based Encryp-
tion. In Proceedings of the 4
th
Conference on The-
ory of Cryptography, TCC’07, pages 515–534, Berlin,
Heidelberg. Springer-Verlag.
CORDIS (2016). CORDIS: Community Research
and Development Information Service. available:
http://cordis.europa.eu/. accessed: March 21, 2017.
DC24 (2016). The DEFCON homepage. available:
http://www.defcon.org/.
EMQTT (2016). EMQTT homepage. available:
http://emqtt.io/. accessed: March 21, 2017.
Ericsson (2016). Ericsson Mobility Report. available:
http://www.ericsson.com/res/docs/2016/ericsson-
mobility-report-2016.pdf. accessed: March 21,
2017.
Espinosa-Aranda, J. L., Vallez, N., Sanchez-Bueno, C.,
Aguado-Araujo, D., Bueno, G., and Deniz, O. (2015).
Pulga, a tiny open-source MQTT broker for flexible
and secure IoT deployments. In 2015 IEEE Con-
ference on Communications and Network Security
(CNS), pages 690–694.
Lesjak, C., Hein, D., Hofmann, M., Maritsch, M., Aldrian,
A., Priller, P., Ebner, T., Ruprechter, T., and Pregart-
ner, G. (2015). Securing smart maintenance services:
Hardware-security and TLS for MQTT. In 2015 IEEE
13
th
International Conference on Industrial Informa-
tics (INDIN), pages 1243–1250.
Mosquitto (2016). Mosquitto homepage. available:
http://mosquitto.org/. accessed: March 21, 2017.
Neisse, R., Steri, G., Fovino, I. N., and Baldini, G. (2015).
SecKit: A Model-based Security Toolkit for the Inter-
net of Things. Computers & Security, 54:60–76.
Oasis (2014). MQTT Version 3.1.1 Speci-
fications. available: http://docs.oasis-
open.org/mqtt/mqtt/v3.1.1/os/mqtt-v3.1.1-os.html.
accessed: March 21, 2017.
Rizzardi, A., Sicari, S., Miorandi, D., and Coen-Porisini,
A. (2016). AUPS: An Open Source AUthenticated
Publish/Subscribe system for the Internet of Things.
Information Systems, 62:29–41.
Ross, R., McEvilley, M., and Carrier Oren, J. (2016).
NIST Special Publication 800-160: Systems
Security Engineering Considerations for a
Multidisciplinary Approach in the Engineer-
ing of Trustworthy Secure Systems. available:
http://nvlpubs.nist.gov/nistpubs/SpecialPublications/
NIST.SP.800-160.pdf. accessed: March 21, 2017.
Sahai, A. and Waters, B. (2005). Fuzzy identity-based
encryption. In Annual International Conference on
the Theory and Applications of Cryptographic Techni-
ques, pages 457–473.
Sheffer, Y., Holz, R., and Saint-Andre, P. (2015). Sum-
marizing Known Attacks on Transport Layer Security
(TLS) and Datagram TLS (DTLS). Internet Engineer-
ing Task Force (IETF), Request for Comments: 7457.
Sicari, S., Rizzardi, A., Grieco, L., and Coen-Porisini,
A. (2015). Security, privacy and trust in Internet
of Things: The road ahead. Computer Networks,
76:146–164.
Singh, M., Rajan, M., Shivraj, V., and Balamuralidhar, P.
(2015). Secure MQTT for Internet of Things (IoT). In
2015 5
th
International Conference on Communication
Systems and Network Technologies, pages 746–751.
US-CERT (2016). Alert (TA16-288A): Heightened DDoS
Threat Posed by Mirai and Other Botnets. availa-
ble: http://www.us-cert.gov/ncas/alerts/TA16-288A.
accessed: March 21, 2017.
Weber, R. (2010). Internet of Things–New security and pri-
vacy challenges. Computer Law & Security Review,
26(1):23–30.
The Day After Mirai: A Survey on MQTT Security Solutions After the Largest Cyber-attack Carried Out through an Army of IoT Devices
253