I'm designing an IoT product, I'm searching solutions to secure the system.

The system's protocol is MQTT, while it's very helpful, it contains vulnerabilities.

I've read enough to come with this proposed system:

  • Using TLS: It's important, but it depends on support.
  • Apply a client-id prefix rule: The server wont accept any client-id other than ones meets a certain prefix, e.g. device-.
  • Authorization: Creating ACL (Access Control List) to allow each device to only subscribe to topics prefixed with its device-id rx/device00001/# and only publish to topics with the same property tx/device00001/.*
  • Limit the accepted messages lengths.*
  • Use authentication that depends on MCU's MAC address and a device-name:
    Use device-id as client-id, and both device-id and MAC as password. Where MAC and device-id are securely shared to the server at flashing the firmware process.
  • Use application payload encryption.
  • * Server terminates the client otherwise.
  • If TLS isn't used, an encrypted password is needed to secure-out the CONNECT packet sent to the server; because credentials are sent in plaintext.
    Beside that: the password should be a function of UNIX time, to limit replay attacks. The time is used at server-side to checkout the freshness of the request.
  • If all security layers are used, Is there a need for application payload encryption?

Can you tell whether this system is secured or it contains threats?

  • Seems like you already have some basics like TLS for encryption in transit and session timeout, You may run a few security scans as well it can tell you more on here is your weak point
    – Vcode
    Commented Apr 29, 2021 at 8:00
  • Thanks @Vcode, I don't have any experience making security scans, what could be the starting point for that? hopefully something relates to MQTT protocol. Commented Apr 29, 2021 at 8:26
  • A similar approach is described here Commented Mar 31, 2022 at 12:01
  • Using DeviceID alongwith the MAC as password is a bad idea, the attacker knows the device-id beforehand (If it's public e.g in WiFi provisioning), and also knows its MAC address for sure. Commented Aug 21, 2022 at 14:28
  • Application code encryption would really help, using AEAD (Authenticated Encryption with Associated Data), as associated data being the full topic. It's offers advanced security. Commented Aug 21, 2022 at 14:30

1 Answer 1


I haven't worked with MQTT myself but did some research and looks like TrendMicro have an article on that:


Some other Scanner tools are: Nessus and Tenable

you may give it a try on their trial version before you pay for any certificate. hope it helps to some extend.

  • Hi Vcode, Thank you for your input. which give me a research tip. I've read the article, and will read the research soon. I've searched Nessus, It seems produced by Tenable company, Is there a specific Tenable product you encourage me to look into it? Commented May 28, 2021 at 6:27
  • Nessus is the only product from them I have worked with, in general for vulnerability assessment and security scans. I suggest to take a look at that. good luck
    – Vcode
    Commented May 31, 2021 at 14:32
  • Thanks @Vcode, I've just finished the document you pointed to, while it's not answering my situation, it's very useful, if there's something against would be its time of publishing (2018), which somehow 'old' due to fast changing world. Despite of this, I've found a mentioned issue in the mqtt library I'm using, I've informed the author and he'll fix it. Thank you for pointing out to this document!! Commented Jun 1, 2021 at 10:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .