# Security Analysis of the MQTT-SN Protocol for the Internet of Things
## 3 State-of-the-Art
To achieve lightweight encryption over the MQTT and MQTT-SN protocol, the authors propose to use ChaCha20, which is a stream cipher protocol. In addition, they also propose to use Poly1305 as a one-time authenticator. In this way, they achieved a lightweight and secure encryption scheme. Another proposal in the field of lightweight encryption is _Design and evaluation of a novel white-box encryption scheme for resource-constrained IoT devices_ by [PERSON], [PERSON] and [PERSON], U.P. [31]. This work focused on generating a scheme capable of protecting IoT environments from white box attacks, those in which the attacker has full view of the execution environment and uses it to break the encryption. The authors, to achieve their goal, propose a scheme to hide the private key in ciphers with elliptic curves. With regard to comparisons between already existing algorithms, we find the proposal _Safe MQTT-SN: a lightweight secure encrypted communication in IoT_ by [PERSON] et al. [32], which proposes a secure encryption scheme for MQTT-SN systems. They propose to use the digital signature (ECDSA), hash function, key exchange (ECDHE), ChaCha20, and Poly1305. The authors compared the delay time introduced by the MQTT-TLS handshake with respect to their proposed scheme. Within the comparisons of the protocols, although not part of the analysis of security, we find a paper that makes a brief comparison from the performance point of view of the IoT protocols, namely _Survey on State of Art IoT Protocols and Applications_ by [PERSON] and [PERSON]. [33]. It is observed that the results of MQTT-SN are good, especially in the packet loss vs. bandwidth contribution. A very interesting paper, although not focused on any IoT protocol in particular, is _A Large-Scale Empirical Study on the Vulnerability of Deployed IoT Devices_ by [PERSON] et al. [34]. In it, the authors surveyed 1,362,906 IoT devices over 10 months. All the conclusions they drew were very interesting, but of special interest is the huge number of vulnerable MQTT servers, a fact that gives an idea of the importance of the matter at hand. Table 6 shows a brief comparison of the different state-of-the-art works. As we can see, the topic of analyzing the security of the MQTT-SN protocol is an unexplored one. Other novelties introduced in this research are the study of the protocol to detect vulnerabilities, as well as how to exploit them. In addition, we analyzed the impact that they have on the system, and we propose a threat detection system to detect such \begin{table}
\begin{tabular}{c c c} \hline \hline
**Reference** & **Target Protocol** & **Highlights** \\ \hline
[22] & RPL &
\begin{tabular}{c} **Presents and evaluates different attacks against RPL.** \\ \end{tabular} \\
[25] & CoAP & Brief analysis of the protocol; concludes that it is not safe due to the lack of encryption. \\
[26] & MQTT & Known attacks against MQTT analyzed. \\
[27] & ZigBee & They describe two different attacks against ZigBee. \\
[28] & MQTT-SN & Reflective attacks employing MQTT-SN to cause DoS. \\
[29; 30; 31; 32] & General encryption & All of them propose improvements to achieve a lightweight encryption. \\
[33] & Various & Comparison of protocols; MQTT-SN obtains good results. \\
[34] & Various & Empirical analysis; there are many unsecured MQTT servers. \\ This work & MQTT-SN & Several attacks are implemented and evaluated, and countermeasures are proposed. \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Comparison of the state-of-the-art works. attacks. Furthermore, as demonstrated by the high number of vulnerable MQTT servers currently deployed, working on the security of the lighter version MQTT-SN is necessary before this protocol is used globally and replaces or coexists with MQTT.