A Blockchain-Based OTP-Authentication Scheme for Constrainded IoT Devices Using MQTT

The importance of the Internet of Things is constantly growing, together with the proliferation of IoT devices which are changing our daily life and empowering industrial processes. However, the most IoT devices and protocols were not designed with security in mind, and economic and energyconsumption constraints make the implementation of security measures a non-trivial problem. One of the most used messaging protocol in IoT, which is MQTT (Message Queuing Telemetry Transport), leaves to developers the task to implement security, as native security services provided by the protocol are very weak. This paper focuses on MQTT authentication, which is definitely insecure in the protocol, even though the implementations can combine MQTT with other mechanisms to obtain a suitable level of security. The aim of the present work is to propose an innovative OTP-authentication scheme for MQTT which uses Ethereum to implement an independent logic channel for the second-factor authentication. The implementation of the proposed scheme relies on the trusted behavior of smart contracts and adopts suitable strategies to preserve the privacy of users.