# Security Analysis of the MQTT-SN Protocol for the Internet of Things
## 1 Introduction  
The Internet of Things (IoT) is a new technology paradigm that is on the path to change the way we interact with computers and machines. It can be explained as a global network composed of devices (also called _things_) capable of communicating with each other [1, 2], which, by doing so, brings with it new possibilities in many fields such as health, the economy, engineering, resource management, and everyday life. As a result, a wide range of industries are researching applications that use this paradigm in the race to having the upper hand in a scenario that has the potential to become a key area in future technology. This is evidenced by the fast-paced growth rate of the IoT, whose number of devices connected to the Internet surpassed the total of the non-IoT ones [3] in the year 2020; even with the chip shortage caused by the pandemic, there are 12.3 billion IoT devices connected to the Internet, and the predictions are for this figure to grow and reach 27 billion by 2025 [4]. The IoT has several peculiarities. For example, networks are usually dynamic and heterogeneous, giving rise to many different protocols, such as MQTT [5], Bluetooth Low-Energy (BLE) [6], ZigBee (based on the IEEE 802.15.4 standard) [7], and the constrained Application Protocol (CoAP) [8], among others. However, this feature also applies to IoT devices, which can range from the simplest sensors to computing hardware with more resources that sends information to the cloud. Although this environment has many applications and benefits for industry, from a security point of view, it constitutes a new vector for attacks from cybercriminals [9]. Most of the safety concepts that are widely accepted and applied in network communications have not been taken into account in the IoT. This is due to the fact that IoT systems are usually constrained by a lack of resources related to memories, processors, network bandwidths, and power consumptions, which do not support the implementation of security measures [10]. The diversity of IoT systems and their limitations cause new problems associated with this paradigm [11], for example the need to improve lightweight encryption algorithms and the weak defenses against Denial of Service (DoS) due to the lack of memory, processor power, and bandwidth. Battery consumption gains importance since there are many applications that require the use of devices that only have batteries. Furthermore, it is hard to keep IoT devices updated because they are very heterogeneous [12]. These vulnerabilities are being exploited by criminals to the extent that the evolution of malware specifically targeting IoT Linux has vastly increased in recent years. Figure 1 shows the quarterly growth of samples registered against IoT Linux since the appearance of the Mirai malware, a botnet that interrupted Internet access for millions of people. It can be seen that, from August 2016 to May 2022, there has been a huge increase in samples, fifty-nine-times higher in May 2022 compared to August 2016. In the IoT, most attacks are successful because the devices are misconfigured by default, and this indicates that old problems are present in the IoT as well. At this point, it is vital to evaluate the protocols involved in the IoT for a security audit in order to determine their deficiencies and, on that basis, propose improvements. There are many challenges to be addressed by the research community in the field of IoT cybersecurity. Some of the main ones are listed in the paper _An overview of security and privacy in smart cities IoT communications_ by [PERSON] et al. [13], which identifies the main threats to IoT security. According to the authors, malware, false information, traffic modification, traffic eavesdropping, and identity theft are the most common IoT threats. There are other articles that study the challenges and trends posed by the IoT, and cybersecurity is a key area in all the analyses [14; 15; 16], highlighting the protocols and their heterogeneity as a crucial element that needs to be scrutinized.