Architectural design of token based authentication of MQTT protocol in constrained IoT device

An effective and secure authentication mechanism is one of the important part in implementation of communication protocol in a Internet of Things (IoT) based system. As one of the popular messaging protocol in IoT world, Message Queue Telemetry Transport (MQTT) offers a basic authentication using username and password. However, this authentication method might possibly have a problem in term of security and scalability. In this paper, we propose the design and implementation of token based authentication of MQTT protocol in constrained devices. The proposed design consists of four components : publisher, subscriber, MQTT broker and token authentication server. Publisher/subscriber first sends its username password to authentication server to get the token. Notice that, the token generating process is only performed at following conditions : 1) when token has not been generated yet and 2) when token has been expired. Once publisher get a valid token, it will store that token in its local storage and use it for further authentication. From usability and performance testing result, the proposed system can perform the authentication of valid and expired token in relatively acceptable time.