## 1 Introduction  
The evolution and expansion of networking technologies have enabled the establishment of large-scale connectivity among devices and applications, which has led to the emergence of the Internet of Things (IoT) concept. According to [1, 2], the number of connected IoT devices in 2016 was 4.6 billion, then 10 billion in 2019, and is expected to be more than 14 and 27 billion in 2022 and 2025, respectively. This rapid growth of internet-connected devices can cause several challenges, such as high latency, network congestion, and bandwidth consumption, due to the fact that the cloud architecture does not meet the requirements of the massive growth of data that are generated by IoT devices [3]. The challenges will be more critical in applications that require fast responses, as in the Industrial Internet of Things (IIoT), in which machine-to-machine (M2M) communication is an underlying technology where devices (e.g., sensors, actuators, controllers, and gateways) are enabled to exchange data with each other in an autonomous way without human intervention. In industrial applications, low latency and real-time processing are fundamental features that are not supported sufficiently in cloud computing [4]. As a consequence, the fog computing paradigm emerged as a complementary technology with cloud computing to solve such challenges. Fog computing can provide characteristics such as low latency, location awareness, geo-distribution, increased data security, and real-time processing [5]. In addition, it aims to bring computing, storage, and network capabilities closer to the end users. Message queue telemetry transport (MQTT) is a messaging protocol and one of the promising M2M protocols in the IoT based on the publish-subscribe model, which allows multiple clients (publishers/subscribers) to communicate with each other through a broker, can encounter the aforementioned challenges. This is because the communication between clients relies on a central broker in the cloud. To mitigate and overcome these challenges, we need to leverage fog computing capabilities to develop MQTT architecture by deploying multiple brokers in the fog layer. In this case, the load of data transmission, processing, and storage will be coordinated between brokers in the fog and the cloud, and thus, the overhead on the cloud will be reduced. However, this integration between the fog and the cloud for MQTT architecture will create new security challenges. Since this paper focuses on authentication, the major concern in designing the authentication system for MQTT based on fog computing is providing a reliable authentication mechanism while enhancing performance and scalability. The reasons are, firstly, that the current authentication mechanisms do not satisfy resource-constrained IoT devices due to the complex computational costs involved in these mechanisms, which consume the processing, memory, and storage capabilities of IoT devices. Secondly, since existing solutions utilize the central cloud entity as an authentication server, scalability issues will arise due to the growing number of devices, which may cause bottlenecks, network congestion, and high delays. Thirdly, the large computational load and high communication overhead on a remote central authentication entity might cause high transmission, queuing, or processing delays. The main objectives of this paper are as follows:  
1. Propose a scalable MQTT architecture with multi-tier brokers that are based on fog computing. 2. Present a lightweight mutual authentication scheme that is based on hash function and XOR operation. 3. Build an authentication manager associated with each broker to conduct the authentication process for that broker and its connected group of clients/brokers independently. The lightweight mutual authentication scheme and scalable authentication architecture for the publish-subscribe model (MQTT) that is based on multiple brokers' communication is still an open challenge, and this is the motivation for our study.