## 2 Background and Related Works
### Related Works  
This section reviews the current studies related to MQTT, which are categorized into three parts based on those involving only the authentication property, those involving only a distributed MQTT architecture with multiple brokers, and those applying an authentication scheme for a distributed MQTT architecture with multiple brokers. Among the studies that only focused on authentication mechanisms for MQTT, the authors of [7] proposed an approach called MQTT-Auth, which used two tokens, one to authenticate published topics and the other to grant authorizations to enable subscribers to have different access privileges. MQTT-Auth is based on the augmented PAKE (AugPAKE) algorithm, which is a client-server session key establishment protocol. AugPAKE establishes two session keys, one between the publisher and the broker and the other between the broker and the subscriber. The presented solution costs a high computation load and message exchanges [8]. The paper in [9] presented a token-based authentication mechanism for resource-constrained devices in the MQTT protocol. The mechanism is based on the JSON web token (JWT) authentication server, which is responsible for issuing tokens to publishers and subscribers after validating their credentials. After receiving the connection, then obtaining the token from the publisher and subscriber, the broker checks the validity of the token with the authentication server. The number of message exchanges in this system is high because each token provided to clients needs to be validated by a broker through JWT. In [10], a lightweight authentication mechanism was introduced using tokens and secret keys for secure connections. The secret key is periodically updated using the chaotic algorithm to provide high diversity among consecutive security keys. To maintain diversity among the consecutive keys, the appropriate chaotic parameters are selected based on the distance entropy. The paper did not calculate the performance of the chaotic algorithm for the broker. However, it can be said that the frequent updating of the key by the broker could cause communication and processing overhead. An extension for MQTT called authenticated publish and subscribe (AUPS) was proposed in [11]. AUPS ensures the authentication and authorization of data by integrating a policy enforcement mechanism that is based on attribute-based encryption (ABE), where the data are encrypted by the publisher based on a collection of conditions in relation to the access policy, and if the subscriber fulfills the access policy, the ciphertext can be decrypted. However, ABE is not recommended for resource-constrained devices because the cryptographic overhead increases as the number of attributes increases [8]. The paper in [12] provides an authentication and authorization mechanism for the MQTT protocol using an HMAC-based one-time password (HOTP) and the OAuth 2.0 framework. The authentication is conducted in two stages. The first stage is validating the access token, which is used as a username through the WSO2 is identity server. Secondly, the password, which is updated using HOTP, will be authenticated every time the connection is established between clients and brokers through MongoDB. The issue in this scheme is the increased message exchanges because of the number of stages that require more than one authentication entity. The paper in [13] proposes a multi-tier authentication mechanism called S-MQTT for delivering secure communication between end devices. The mechanism is based on key policy/cipher policy attribute-based encryption (KP/CP ABE) using lightweight elliptic curve cryptography (ECC). However, the issue with ABE is that the registration of nodes in the broker requires sending a set of attributes, which may cause high computation overhead. In [14], the authors proposed the Secure Reliable Message Communication (SEC-RMC) protocol for MQTT using a lightweight encryption algorithm to secure the data transmission at the transport layer.