An Architecture for Automated Security Test Case Generation for MQTT Systems

Sochor, Hannes; Ferrarotti, Flavio; Ramler, Rudolf

doi:10.1007/978-3-030-59028-4_5

Cited by 2 publications

(7 citation statements)

References 25 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In previous work, we developed a framework (and associated tools) for automated test case generation for testing security of MQTT-based systems. 10 The application of this framework allowed us to uncover security risks 11 in different MQTT broker implementations. Testing for security issues in this context requires to systematically explore many different interaction scenarios between MQTT clients and brokers.…”

Section: Security Testing Frameworkmentioning

confidence: 99%

“…The framework was originally designed for security testing of MQTT-based systems by interacting with a single, central broker instance. 10 We evaluated the approach in our previous work by generating security tests for a number of individual MQTT broker implementations. In contrast to our previous approach, the goal of this work is to perform pairwise testing, where two broker implementations are executed simultaneously in order to evaluate their compatibility.…”

Section: System Under Test (Sut)mentioning

confidence: 99%

“…Finally, we provide an overview of the approach and framework we developed for security testing of MQTT systems as part of our previous work. 10,11 In this paper, we adapt the approach and the framework for detecting compatibility issues among MQTT brokers instead. Nevertheless, the attack patterns used for security testing in the original approach allow us to study the behavior of broker implementations in critical scenarios and to detect compatibility issues that can have a negative impact on security.…”

Section: Introductionmentioning

confidence: 99%

“…We discuss the terms interoperability and compatibility. Finally, we provide an overview of the approach and framework we developed for security testing of MQTT systems as part of our previous work 10,11 . In this paper, we adapt the approach and the framework for detecting compatibility issues among MQTT brokers instead.…”

Section: Introductionmentioning

confidence: 99%

“…In previous work, we developed a framework (and associated tools) for automated test case generation for testing security of MQTT‐based systems 10 . The application of this framework allowed us to uncover security risks 11 in different MQTT broker implementations.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

An automated evaluation of broker compatibility for the Message Queuing Telemetry Transport protocol

Sochor

Ferrarotti

Ramler

2021

J Software Evolu Process

Self Cite

View full text Add to dashboard Cite

Message Queuing Telemetry Transport (MQTT) is the most widely used protocol within the communication layer of the Internet of Things (IoT). Message brokers are a key component of the MQTT protocol and a single point of failure. Incompatibilities between different MQTT brokers or broker versions with their clients can cause critical failures and become a source of security risks. Thus, every MQTT broker change or update needs to be accompanied by an evaluation of the compatibility between the new and the previous broker. In this work, we develop an automated framework for compatibility evaluation of MQTT brokers, which can be easily generalized to other similar IoT components. We apply this framework to perform a comprehensive experiment conducted with 16 different versions of 6 popular MQTT brokers. We report inconsistencies in the behavior of different MQTT brokers and broker versions. Based on the experiment results, we calculate and provide a visualization of compatibility among the evaluated brokers in terms of their distance, which indicates the risk of incompatibilities when replacing a broker with another one. The calculation of distance measures can be adjusted by giving higher weights to important features. We use this method to show security‐related differences between the brokers.

show abstract

Section: Security Testing Frameworkmentioning

confidence: 99%

Section: System Under Test (Sut)mentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations