Güvenliği geliştirilmiş hafif mesajlaşma protokolü

Internet of things (IoT) allows devices especially with low process capability and power consumption, to transmit data to each other using various communication technologies such as wired, wireless network and radio frequency. When huge number of devices with limited resources are connected to IoT application, provided security gains significant importance to ensure the integrity, confidentiality, accessibility of these sensitive data. In addition, the availability of a variety of specialized devices and communication technologies demonstrate the hassle of providing a standard security mechanism. When device features such as power and process capability are taken into account, message queue telemetry transport (MQTT) is the most appropriate lightweight communication protocol. In this study, the MQTT security is defined, and preliminary work related to MQTT on the basic security issues such as privacy, authentication and access control is examined. This study provides authorization mechanism by using open authorization (OAuth 2.0) protocol, which is recommended to gain authorization. In addition to the authenticator token, authentication is performed in two steps using a HMAC-based one-time password (HOTP) due to its short life span. Since MQTT protocol does not have bidirectional authentication other than using transport layer security (TLS), mutual authentication is provided by using OTP with hash chain. Advanced encryption standard (AES) is used for providing confidentiality to prevent against potential security vulnerabilities. Security analysis of the implementation has been discussed by giving an alternative solution by using these methods against selected attacks. It has been observed that various security vulnerabilities and difficulties have been successfully resolved.