MQTT · Study deck
MQTT Security Fundamentals
Picture a message that tells a factory valve to open.
Broker Bex is your guide for this deck.
After studying this chapter
Learning objectives
You will be able to:
- Implement Transport Security: Configure TLS/SSL on port 8883 for encrypted MQTT communication and explain why plaintext port 1883 is unacceptable in production
- Compare Authentication Methods: Distinguish between username/password, client certificates, and JWT-based authentication, and justify when each is most appropriate
- Design Access Control Policies: Construct topic-level ACL rules that enforce least-privilege access for sensors, actuators, and dashboards
- Analyze Attack Surfaces: Evaluate which attack vectors (eavesdropping, injection, impersonation, DoS) remain open under different security configurations
Major section
In 60 Seconds
The system must hide it from strangers, prove who sent it, and reject any sender who lacks permission.
- Telemetry means data sent from a device for remote use.
- Message Queuing Telemetry Transport (MQTT) is a set of rules for sending such small messages through a central service.
- A topic is the named route used for that choice.
Major section
In 60 Seconds (continued)
That central service receives each message and sends it to the right listeners.
- Transport layer security is the protected-link method often shortened to TLS.
- Third, limit each identity to the few topics and actions it needs.
- An access control list is the central service's written set of those limits.
Major section
Protecting Our Messages
It stops random devices from joining your network and publishing fake data.".
- "Someone could be listening to my temperature readings!" Temperature Terry whispered nervously.
- the microcontroller got serious. "That's why MQTT security has three layers.
- the battery added the third layer: "Authorization controls what each device can do.
Major section
Protecting Our Messages (continued)
"Second, authentication," said the LED. "Every device needs a username and password -- or even better, a unique certificate -- to connect to the broker.
- Sammy can publish to garden/temperature but NOT to security/door-lock.
- It's like having a library card that lets you borrow books but not take the computers home.
- All three layers together -- encryption, authentication, authorization -- keep our IoT network safe!".
Major section
Putting Numbers to It: TLS Handshake Overhead
Enabling TLS on MQTT adds a one-time handshake cost per connection.
- Amortized per message (connect once, send $N$ messages): $$ E_{\text{per\msg}} = \frac{0.72}{N} + E{\text{MQTT}} $$.
- Reconnecting for every message adds 100--200 ms latency (1 RTT for TLS 1.3, 2 RTT for TLS 1.2) and proportional energy overhead per reconnect.
- Modern brokers support JWT tokens for scalable device authentication.
Major section
Access Control Lists (ACLs)
Wildcards and pattern substitution reduce rule count significantly compared to per-device exact rules.
- Security principle:: Least privilege - devices only access topics they need.
- A single-level wildcard in topic write sensors/+/data accepts one device level, while topic read sensors/# includes every descendant and therefore carries a much larger blast radius.
- This progression connects topic syntax to least privilege instead of treating wildcard convenience as harmless.
Major section
Deep-Dive Note: Broker-Enforced Security Boundaries
MQTT security has to be reviewed as three independent broker-enforced layers: transport encryption, authentication, and authorization.
- TLS on port 8883 protects credentials and payloads in transit, while plaintext MQTT on 1883 exposes the CONNECT credentials and PUBLISH payloads to anyone on path.
- For authentication, confirm every device has a distinct revocable identity.
Major section
Deep-Dive Note: Broker-Enforced Security Boundaries (continued)
This ordered review connects the architecture to the negative evidence required below.
- Authentication proves which client identity is connecting, using username/password, JWT, or preferably per-device certificates for high-value fleets.
- For transport, verify clients reach the TLS listener, validate the broker certificate chain, and fail closed on invalid or expired trust.
- MQTT 5 helps narrow fault diagnosis instead of loosening every control at once.
Major section
Deep-Dive Note: Broker-Enforced Security Boundaries (continued)
For authorization, prove that a telemetry device cannot publish to site/line1/cmd/# and that a dashboard cannot read maintenance-only topics without explicit permission.
- Enhanced authentication uses the AUTH packet for challenge-response exchanges such as SCRAM, and reason codes such as Not Authorized (0x87) make denied connects, publishes, or subscribes explicit.
- TLS still does not protect payloads at rest inside broker queues, so end-to-end payload confidentiality remains an application-level design choice.
- Some papers and legacy course notes use Secure MQTT (SMQTT) to mean more than MQTT over TLS.
Deck summary
Key takeaways
The system must hide it from strangers, prove who sent it, and reject any sender who lacks permission.
- That central service receives each message and sends it to the right listeners.
- It stops random devices from joining your network and publishing fake data.".
- "Second, authentication," said the LED. "Every device needs a username and password -- or even better, a unique certificate -- to connect to the broker.
- Enabling TLS on MQTT adds a one-time handshake cost per connection.
Retrieval practice
Recall check 1 of 3
Broker Bex says: answer from memory, then check your reasoning.
Q1Complete the MQTT username/password authentication:
Show answer
Answer: A username_pw_set() must be called BEFORE connect().
Q2A temperature sensor in a smart building should only be able to publish its own readings. Which ACL rule best enforces this least-privilege requirement?
Show answer
Answer: B Correct!
Retrieval practice
Recall check 2 of 3
Broker Bex says: answer from memory, then check your reasoning.
Q3Your company deploys MQTT sensors in customer buildings. A sensor is configured with client_id='sensor' and username='device' with a shared password. What's the main security risk?
Show answer
Answer: D MQTT brokers allow one active connection per client_id, so a second sensor using 'sensor' forces the previous session off and can cause connection loops and data loss.
Retrieval practice
Recall check 3 of 3
Broker Bex says: answer from memory, then check your reasoning.
Q4Place each MQTT security control where it lives so you can diagnose whether a failure is transport, identity, or topic authority.
Show answer
Answer: A Separate the protected channel, the connecting client identity, and broker topic authority so you can test each security boundary independently.
Print reference
Answers
Answer key.
- A · username_pw_set() must be called BEFORE connect().
- B · Correct!
- D · MQTT brokers allow one active connection per client_id, so a second sensor using 'sensor' forces the previous session off and can cause connection loops and data loss.
- A · Separate the protected channel, the connecting client identity, and broker topic authority so you can test each security boundary independently.