###### Abstract  
Ensuring accountability and integrity in MQTT communications is important for enabling several IoT applications. This paper presents a novel approach that combines blockchain technology and the interplanetary file system (IPFS) to achieve non-repudiation and data integrity in the MQTT protocol. Our solution operates in discrete temporal rounds, during which the broker constructs a Merkle hash tree (MHT) from the messages received. Then the broker publishes the root on the blockchain and the MHT itself on IPFS. This mechanism guarantees that both publishers and subscribers can verify the integrity of the message exchanged. Furthermore, the interactions with the blockchain made by the publishers and the broker ensure they cannot deny having sent the exchanged messages. We provide a detailed security analysis, showing that under standard assumptions, the proposed solution achieves both data integrity and accountability. Additionally, we provided an experimental campaign to study the scalability and the throughput of the system. Our results show that our solution scales well with the number of clients. Furthermore, from our results, it emerges that the throughput reduction depends on the integrity check operations. However, since the frequency of these checks can be freely chosen, we can set it so that the throughput reduction is negligible. Finally, we provided a detailed analysis of the costs of our solution showing that, overall, the execution costs are relatively low, especially given the critical security and accountability benefits it guarantees. Furthermore, our analysis shows that the higher the number of subscribers in the system, the lower the costs per client in our solution. Again, this confirms that our solution does not present any scalability issues. M +
Footnote †: journal: date  
eurmstyle=Footnote  
example, if a publisher sends wrong information, it must be held liable for any damage caused by the sent data. Similarly, on the broker's side, accountability is also important. Brokers often should enforce access control and ensure that only verified publishers are allowed to publish on specific topics. For example, subscribers relying on critical information, such as in financial or health-related applications, must be assured that their data come from verified publishers. By providing accountability on the broker side, our solution guarantees that brokers perform these verification checks. Addressing these security concerns requires robust mechanisms to guarantee that messages are not tampered with and that the involved parties, i.e., publishers and brokers, cannot deny having sent their messages. This paper proposes a novel approach to achieving both accountability and data integrity in MQTT. Our proposal integrates blockchain technology [10; 11; 12] and the interplanetary file system (IPFS) [13; 14] into the MQTT protocol. In particular, the immutability property of the blockchain ledger is fundamental to achieving accountability. However, storing large amounts of data in the blockchain has a non-negligible economic cost, as well as leading to scalability problems in the blockchain [15]. IPFS, on the other hand, provides an efficient and decentralized way to store message data off the blockchain. By storing only the hash on the blockchain and the actual file on IPFS, the blockchain scalability issues are mitigated, as only the critical data are stored on-chain [16]. Our solution is as follows. The broker builds a Merkle hash tree (MHT) of the messages received from the publisher during discrete temporal rounds. It then publishes the root of the MHT on the blockchain and stores the tree itself on IPFS. This allows both publishers and subscribers to verify the integrity of the exchanged messages. It also ensures that both publishers and the broker cannot repudiate the messages they have sent. In our study, we performed a security analysis to demonstrate that our approach achieves accountability and data integrity in MQTT communications under standard assumptions.