MARAS: Mutual Authentication and Role-Based Authorization Scheme for Lightweight Internet of Things Applications
The Internet of things (IoT) accommodates lightweight sensor/actuator devices with limited resources; hence, more efficient methods for known challenges are sought after. Message queue telemetry transport (MQTT) is a publish/subscribe-based protocol that allows resource-efficient communication among...
| Main Authors: | , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
MDPI AG
2023-06-01
|
| Series: | Sensors |
| Subjects: | |
| Online Access: | https://www.mdpi.com/1424-8220/23/12/5674 |
| _version_ | 1797592657562697728 |
|---|---|
| author | Özlem Şeker Gökhan Dalkılıç Umut Can Çabuk |
| author_facet | Özlem Şeker Gökhan Dalkılıç Umut Can Çabuk |
| author_sort | Özlem Şeker |
| collection | DOAJ |
| description | The Internet of things (IoT) accommodates lightweight sensor/actuator devices with limited resources; hence, more efficient methods for known challenges are sought after. Message queue telemetry transport (MQTT) is a publish/subscribe-based protocol that allows resource-efficient communication among clients, so-called brokers, and servers. However, it lacks viable security features beyond username/password checks, yet transport-layer security (TLS/HTTPS) is not efficient for constrained devices. MQTT also lacks mutual authentication among clients and brokers. To address the issue, we developed a mutual authentication and role-based authorization scheme for lightweight Internet of things applications (MARAS). It brings mutual authentication and authorization to the network via dynamic access tokens, hash-based message authentication code (HMAC)-based one-time passwords (HOTP), advanced encryption standard (AES), hash chains, and a trusted server running OAuth2.0 along with MQTT. MARAS merely modifies “publish” and “connect” messages among 14 message types of MQTT. Its overhead to “publish” messages is 49 bytes, and to “connect” messages is 127 bytes. Our proof-of-concept showed that the overall data traffic with MARAS remains lower than double the traffic without it, because “publish” messages are the most common. Nevertheless, tests showed that round-trip times for a “connect” message (and its “ack”) are delayed less than a percentile of a millisecond; for a “publish” message, the delays depend on the size and frequency of published information, but we can safely say that the delay is upper bounded by 163% of the network defaults. So, the scheme’s overhead to the network is tolerable. Our comparison with similar works shows that while our communication overhead is similar, MARAS offers better computational performance as it offloads computationally intensive operations to the broker side. |
| first_indexed | 2024-03-11T01:57:17Z |
| format | Article |
| id | doaj.art-ac75e627ce0f4ceb99127ede50fe329b |
| institution | Directory Open Access Journal |
| issn | 1424-8220 |
| language | English |
| last_indexed | 2024-03-11T01:57:17Z |
| publishDate | 2023-06-01 |
| publisher | MDPI AG |
| record_format | Article |
| series | Sensors |
| spelling | doaj.art-ac75e627ce0f4ceb99127ede50fe329b2023-11-18T12:34:28ZengMDPI AGSensors1424-82202023-06-012312567410.3390/s23125674MARAS: Mutual Authentication and Role-Based Authorization Scheme for Lightweight Internet of Things ApplicationsÖzlem Şeker0Gökhan Dalkılıç1Umut Can Çabuk2Graduate School of Natural and Applied Sciences, Dokuz Eylul University, Izmir 35390, TurkeyDepartment of Computer Engineering, Dokuz Eylul University, Izmir 35390, TurkeyDepartment of Electrical & Computer Engineering, San Diego State University, San Diego, CA 92182, USAThe Internet of things (IoT) accommodates lightweight sensor/actuator devices with limited resources; hence, more efficient methods for known challenges are sought after. Message queue telemetry transport (MQTT) is a publish/subscribe-based protocol that allows resource-efficient communication among clients, so-called brokers, and servers. However, it lacks viable security features beyond username/password checks, yet transport-layer security (TLS/HTTPS) is not efficient for constrained devices. MQTT also lacks mutual authentication among clients and brokers. To address the issue, we developed a mutual authentication and role-based authorization scheme for lightweight Internet of things applications (MARAS). It brings mutual authentication and authorization to the network via dynamic access tokens, hash-based message authentication code (HMAC)-based one-time passwords (HOTP), advanced encryption standard (AES), hash chains, and a trusted server running OAuth2.0 along with MQTT. MARAS merely modifies “publish” and “connect” messages among 14 message types of MQTT. Its overhead to “publish” messages is 49 bytes, and to “connect” messages is 127 bytes. Our proof-of-concept showed that the overall data traffic with MARAS remains lower than double the traffic without it, because “publish” messages are the most common. Nevertheless, tests showed that round-trip times for a “connect” message (and its “ack”) are delayed less than a percentile of a millisecond; for a “publish” message, the delays depend on the size and frequency of published information, but we can safely say that the delay is upper bounded by 163% of the network defaults. So, the scheme’s overhead to the network is tolerable. Our comparison with similar works shows that while our communication overhead is similar, MARAS offers better computational performance as it offloads computationally intensive operations to the broker side.https://www.mdpi.com/1424-8220/23/12/5674authorizationHOTPIoTMQTTmutual authentication |
| spellingShingle | Özlem Şeker Gökhan Dalkılıç Umut Can Çabuk MARAS: Mutual Authentication and Role-Based Authorization Scheme for Lightweight Internet of Things Applications Sensors authorization HOTP IoT MQTT mutual authentication |
| title | MARAS: Mutual Authentication and Role-Based Authorization Scheme for Lightweight Internet of Things Applications |
| title_full | MARAS: Mutual Authentication and Role-Based Authorization Scheme for Lightweight Internet of Things Applications |
| title_fullStr | MARAS: Mutual Authentication and Role-Based Authorization Scheme for Lightweight Internet of Things Applications |
| title_full_unstemmed | MARAS: Mutual Authentication and Role-Based Authorization Scheme for Lightweight Internet of Things Applications |
| title_short | MARAS: Mutual Authentication and Role-Based Authorization Scheme for Lightweight Internet of Things Applications |
| title_sort | maras mutual authentication and role based authorization scheme for lightweight internet of things applications |
| topic | authorization HOTP IoT MQTT mutual authentication |
| url | https://www.mdpi.com/1424-8220/23/12/5674 |
| work_keys_str_mv | AT ozlemseker marasmutualauthenticationandrolebasedauthorizationschemeforlightweightinternetofthingsapplications AT gokhandalkılıc marasmutualauthenticationandrolebasedauthorizationschemeforlightweightinternetofthingsapplications AT umutcancabuk marasmutualauthenticationandrolebasedauthorizationschemeforlightweightinternetofthingsapplications |