Introducing Usage Control in MQTT protocol for IoT

Author (ESR): 
Athanasios Rizos (Consiglio Nazionale Delle Ricerche)
Antonio La Marra
Fabio Martinelli
Paolo Mori
Andrea Saracino

MQTT is a widely-used general purpose IoT application layer protocol, usable in both constrained and powerful devices, which coordinates data exchanges through a publish/subscribe approach. In this paper we propose a methodology to increase the security of the MQTT protocol, by including Usage Control in its operative workflow. The inclusion of Usage Control enables a fine-grained dynamic control of the rights of subscribers to access data and data-streams over time, by monitoring mutable attributes related to the subscriber, the environment or data itself. We will present the architecture and workflow of MQTT enhanced through Usage Control, also presenting a real implementation on Raspberry Pi 3 for performance evaluation.

3rd Workshop On The Security Of Industrial Control Systems & Of Cyber-Physical Systems (CyberICPS 2017) In Conjunction With ESORICS
Monday, September 11, 2017 to Friday, September 15, 2017