Three concepts are essential to MQTT security: identity, authentication, and authorization. Identity is about naming the client authorized and given authority under the Azure IoT hub. Authentication is about verifying the client’s identity, and consent manages the rights granted to the client under MQTT.

Akenza

Akenza is one of the defeaters of the IoT Breakthrough Award 2021, and the technology supplier received the title “Smart construction result of the year” in the area of IoT.

With this competition, the inventors of the IOT Breakthrough Award recognize, according to their declarations, “outstanding achievements and innovation, hard work and the accomplishment of IoT companies, technologies, and products.”

Concepts of MQTT:

Identity

• Identify an MQTT client by client qualifier, User ID, or public digital document. One or other of these features defines the client’s identity under the Azure IoT hub.

• An MQTT server verifies the certificate sent by the customer with the SSL agreement or the client’s identity with a password set by the client under MQTT. The server controls which resources the client can acquire based on the client’s identity.

• The MQTT client utilizes the SSL protocol to validate the certificate sent by the server under the Azure IoT hub. The MQTT server recognizes itself to the customer with its IP address and digital certificate under MQTT.

• Sometimes, it uses the server’s DNS name to verify that the server that sent the certificate is recorded as the certificate owner.

Authentication

• A client shows a server with the SSL protocol under the Azure IoT hub. An MQTT server validates a client with the SSL protocol, with a password, or both.

• An MQTT client can validate the MQTT server it links to, and the server can validate the client connecting to it under MQTT.

• It is common to establish an unknown client connection over SSL and then show the client a password encrypted by the SSL session under the Azure IoT hub.

• You will likely find client certificates in high-value tools, such as ATMs and chip-and-pin appliances, and custom devices, such as smart electricity meters, under MQTT.

Authorization

• Authorization is not part of the MQTT agreement. MQTT servers provide it.

• MQTT servers are published brokers, and appropriate MQTT validation rules control which clients can connect to the server and which topics a customer can post or subscribe to under the Azure IoT hub.

• If an MQTT client can administer the server, more authorization rules control which clients can assist different server aspects under the Azure IoT hub.

• The number of possible clients is enormous, so it is impossible to authorize each client separately under MQTT. An MQTT server will be able to group clients by profiles or groups.

• Do not equate the identity of a client with the client identifier. From the point of view of access and authorization, the client’s identity is not unique to an MQTT client under the Azure IoT hub.

• For example, you probably have a common user name across several services, and some of these services cooperate in “single sign-on.”

• An enterprise-scale MQTT server will likely call an authorization service that offers common identities and authorities for different applications under the Azure IoT hub.

Few basic concepts of MQTT that we need to understand:

Publish – In a publish and subscribe system, a device can post a message on a topic or subscribe to a particular topic to receive notifications under the Azure IoT hub.

Messages are the information we want to exchange between our devices. It can either be a command or data.

Topics are how we register interest in incoming messages or specify where we want to publish the news under MQTT.

Broker – The broker is primarily essential for receiving all messages, clarifying the notifications, deciding who is interested in them, and publishing the news to all subscribed clients under the Azure IoT hub.

The MQTT agreement provides a lightweight procedure of messaging using a publish model. It is suitable for IoT messaging, such as low-power sensors or mobile devices like phones, embedded computers, or microcontrollers under the Azure IoT hub.

In other words, MQTT is a published protocol that allows edge-of-network devices to post to a broker.

Open-source brokers of MQTT

Mosquito

• Indeed, written in C programming language.
• It supports MQTT protocol versions 3.1 and 3.1.1.
• Available for Windows, FreeBSD, Mac OS, and GNU distributions under the Azure IoT hub.

Mosquito pulse

• Created by Roger Light in 2010
• Cedalo AG has sponsored the development since 2018

Mosca

• It is a Free and open-source broker of MQTT indeed, written in JavaScript under the Azure IoT hub
• It can be utilized standalone or implanted in another Node.js application
• It supports MQTT protocol version 3.1 and 3.1.1
• It also supports web sockets

SQM

• It is a free and open-source broker of MQTT written in OTP under the Azure IoT hub
• It also supports web sockets, MQTT-SN, CoAP
• Available for Windows, FreeBSD, and Mac OS under MQTT.