Add security to your MQTT connections TUTORIAL
Add security to your MQTT connections Keep your IoT applications safe from prying eyes and remote takeover
M Rob Miles @robmiles Rob Miles has been playing with hardware and software since almost before there was hardware and software. You can find out more about his so-called life at robmiles.com.
QTT is a great way to connect devices together. But it can be insecure. We’re going to examine security on MQTT, and find out what you can do to protect your applications. Your author has made some resources, which you can find by following this link: hsmag.cc/MQTTSec.
WHAT IS MQTT? MQTT (Message Queuing Telemetry Transport) was developed by IBM as a system management tool. It uses a ‘publish and subscribe’ mechanism which allows connected devices to communicate. The MQTT broker maintains a list of ’topics’. A device connected to the broker can subscribe to topics and publish messages to a topic. For example, a broker could manage a topic called ‘greenhouseTemp’. A temperature sensor would publish readings to this topic and a heater controller would subscribe so that it gets a reading when the temperature in the greenhouse changes. Many devices can subscribe to a single topic and the broker will send out messages to all of them as required. Messages are just lumps of data as far as MQTT is concerned. A temperature reading could be a
Figure 1
An MQTT broker passing messages
MQTT Broker greenhouseTemp
Sensor
Heater
Network 78
simple numeric value, or a tiny chunk of text encoded using JSON. You can create completely open MQTT brokers that allow any device to connect. You might think this is OK. After all, who really cares about the temperature in the greenhouse? However, you must remember that someone could connect a device that publishes invalid temperature values and perhaps damage the heating system. If your MQTT broker is connected to a totally private network (for example, a local WiFi network hosted by a Raspberry Pi), you might be able to get away with no security, but it would be extremely dangerous to connect such an open network to the internet.
PASSWORD PLEASE You can add security by requiring devices to give a username and password when they connect. This is more complex to configure and manage because you need to set up the password and then configure your devices to use it. All the devices connected to
SECURITY AND RISK Security is always a trade-off between risk and effort. The more effort you put into managing security, the less risk you are exposed to. For any installation, you need to look at the risks you are running and decide which ones you can live with. Your author is happy to live with a lower level of security (just a passwordprotected connection) for data devices on his private networks, but always uses secure sockets if sending data to a server on the internet. If you want even higher levels of security, you can give each device a unique client certificate. This gives you the ability to control access at an individual device level, and allows authentication to expire after a particular time. This is much more secure, but now you must create and distribute keys into the devices. Search for 'MQTT and X509' to find out more about this.