# Secure Data Distribution Architecture in IoT Using MQTT
## 3 Distributed MQTT Architecture
### Authentication Service  
The authentication service issues JSON Web Tokens (JWTs) to other services which authenticates. It has a unique public key that is known to all the other services, which is used to verify the tokens it issues to other services. The process starts with a new broker or discovery service that communicates with the authentication service requesting an authentication token passing in their identity. A typical token is represented as follows:  
``` { header:{ ''alg'';''HS256'',

Figure 5: Illustration of the end to end delivery process. 'typ'':''JWT'' } } payload:{  username:''Broker service 1''  claims:{  blocked_publish_topics:[],  blocked_subscribe_topics:[],  blocked_brokers:[], ... } } } The requesting broker service can use this signed token to authenticate to all other broker services because the token is signed by the authentication service. The verification process does not require the verifier to contact the authentication service. Furthermore, the authentication service can also add additional parameters to the token such as authorization and expiration date [19]. The claims field above illustrates how a given broker service can be blocked from publishing certain topics or subscribing to topics published by certain brokers. This blocking is performed at two levels:

1. Discovery service level: Discovery service will not announce to a blocked broker service any new publishers that they are blocked from. Furthermore, it does not advertise NPAs to topics a broker service is blocked from. 2. Broker service level: A publishing broker service does not assign a blocked broker service to a group of a topic that they are blocked from. Finally, It is worth noting that the authentication service is a RESTful web service that exposes an endpoint called ''/auth\", where the consumer can send a POST request with their credentials to obtain a JWT. The authentication process is illustrated in Figure 6.

## 4 Performance Evaluation

In this section, we discuss the details of our implementation and performance evaluation setup. The implementation of the authentication service was performed in NodeJS using express and the JSON Web Tokens library. The broker service wraps a javascript implmentation of the MQTT protocol for the server, and uses websockets to communicate with other broker services and the discovery service. Finally, the discovery service is fully implemented using websockets in NodeJS. We use the following metrics to evaluate our architecture:

* Global delay (_GD_): Time it takes a message published within one broker to reach a single subscriber that is managed by a different broker. * Local delay(_LD_): Time it takes a message published within a broker to reach a single subscriber within the same broker. * Difference between global delay and local delay (_GD-LD_): Gives the overhead in terms of difference of end-to-end delays in milliseconds. * Ratio of global delay to local delay (_GD/LD_): Gives the overhead in terms of ratio of end to end delays. Figure 6: Communication with authentication service illustration. We implemented our architecture in javascript and set up three scenarios in order to evaluate it. These scenarios compute the overhead of migrating the data across broker services by comparing the time to reach local clients and a global ones. The first two scenarios are simulated on a single machine, as follows:

1. Single publisher and two subscribers residing within two different brokers. One subscriber is local to the publisher and the other subscriber is on the other broker. In this scenario, the publisher publishes messages of sizes 1, 10, 100, 1000 and 10,000 bytes to see the effects of payload size on the overhead of migrating the messages to the other broker in terms of end-to-end delay. For each size, 10 messages are sent at a rate of 1 message per second and the our metrics are computed. Then, descriptive statistics are computed for the collected values, which include the average, maximum and minimum for each metric.