MQTTRoute 3.1 – Custom  Secure MQTT Authentication Released

MQTTRoute 3.1 – Custom Secure MQTT Authentication Released

We are more excited to announce the fresh new update of MQTT Broker, MQTTRoute 3.1. The new version of MQTT Broker adds additional & custom security options / security extensions for secured communication & data transfer over MQTT connection. Security is an essential concern for any IoT solutions/applications. No matter what, enterprises have a keen insight into the security of the implementation as they need to prevent themselves from getting attacked by hackers/intruders. Hence, we thought of providing such full-fledged security options. We are adding custom authentication functionality to our MQTT Broker with the support of integrating IAM tools to authorize and have instant control / power over on their clients. Here is a detailed look at the security extensions of MQTT Broker.

Need for Centralized Authentication

In day to day life, whatever people use or designate is getting connected to the internet. For a full-fledged enterprise security, each & every port of entry must be supervised wholly for client connections, permissions & for secured data communications. This is to restrict the entry of hackers. Besides security, the cyclical/periodic maintenance tasks like asset monitoring, updating of firmware, provisioning or reprovisioning needs to be integrated. Hence it is necessary to bring all users into one common platform. This obligates the need for connecting the clients, sensors and everything to the central identity management of the organization. Centralized identity management means everything takes place in one environment. This is more or less like the user can sign into a single environment to access all the applications and tools. Hence, provisioning, de provisioning everything happens and are managed in one place with centralized ID & access management. Also, SAML single sign-on permits users to create one single password to ingress all of their applications & stuff. It removes the difficulty of creating & recollecting multiple passwords. Hence, we have added custom hooks into MQTT Broker to customize authentication for identity access management.

MQTT Broker Inbuilt MQTT Authentication

With the new update, MQTTRoute comes with an inbuilt custom plugin to customize/extend the authentication mechanism as per the need. We know that how important identity management is nowadays in terms of security for enterprises & businesses. To bring that centralized management into one common platform we have enabled a custom authentication functionality into the MQTT Broker which helps users to integrate IAM. IAM (Identity Access Management) enables enterprises/organization to control user access to critical information within an organization. Bevywise MQTT Broker can be used to build large scale IoT applications & solutions for multiple customers & for enterprises. With the help of custom authentication hooks, IAM can be integrated into the MQTT Broker. Now, IAM will supersede the built-in MQTT authentication & authorization to enable a gentle functioning with an enterprise IoT systems & its management.

Bundled HTTP Authentication

HTTP furnishes an extensive structure for authorization & access control. HTTP authentication is about restricting unauthorized users with the HTTP schema. It is a challenge response mechanism where the server will challenge a client request & the MQTT client will respond with the authentication details (User ID & Password credentials) in an authorization header. The User ID defines the identity of the client & the password authenticates the client as the correct possessor of that identity.

Here is how the challenge & response flow runs :

When the client makes a request & server expects authentication information, the server responds with a 401 (unauthorized) status code which provides the reason for authentication error along with the WWW-authenticate response header. The client will call for a user ID (client ID) & password from the user to manage the response from the server. Once the client acquires a user ID & password, it will send back the initial request with an authorization header. On the other hand, the client can send the authorization header when it makes its original request, and this header might be accepted by the server, avoiding the challenge and response process.

MQTTRoute now supports HTTP authentication that it initiates the request query permission & processes the authentication request through the returned HTTP response status.

MQTT Broker & Security Options

Bevywise MQTTRoute by default provides an option to enable encrypted data transmission for better MQTT data security. Such options can be enabled with just a few configuration changes. With regards to security in Enterprise MQTT Broker, identity, authentication, authorization, and encryption should be taken into account to protect your data. Bevywise MQTT Broker supporting MQTT protocol, provides Multiple MQTT Authentication, Encrypted MQTT message transfer with TLS/SSL  certificates, Authentication with X.509, Using username and password form of authentication method, Authorization with ACL & RBAC to make applications publish and subscribe only to their topics & more. It works with all standard SSL / TLS certificates and runs with a self-signed client certificate.  Moreover, you can also disable authentication as well, if you are running / in-action with the MQTT broker in a close environment and do not want to weigh down the system. Though we provide full-fledged security with our default security options, we want our customers/users to power over their clients with custom authentication.

To conclude, the new update of MQTT Broker provides custom client authentication functionality which enables you to integrate IAM tools for secured management & control of the clients. 

Feel free to write to support for a complete demo.

Download MQTT Broker now to get started with your IoT implementation. This version is currently available for Windows & Linux users. Also, MQTT Broker is now available with mobile app support to control MQTT devices using your android.

Tap the banner to download MQTT Broker 

download now
IoT Platform Enhanced – User Security & Permissions

IoT Platform Enhanced – User Security & Permissions

Bevywise IoT Platform is a versatile, highly extendable Server Implementation that help Solution providers scale up fast. With the Edge client, Mobile SDK , REST API & all, it helps get your service running in a few weeks. The IoT Platform caters to Industrial and Home needs with flexible charts and widgets and Voice controls. Bevywise IoT Platform enhanced with user security permissions.

Small & Medium business Solutions

When you build solutions targeting a particular industry / market, you will be hosting multiple customers on a single server. Only such a development will make the solution cost effective in maintenance and affordable to your customer. Bevywise IoT Platform by default supports multi tenancy. The Platform also provides enterprise scale dashboard, data visualization, device authentication and rule engine which helps the users to monitor & manage their device individually.

Users & Permissions for each Tenant.

Business of small and medium scale also needs better tracking / control of the operation done by each employee in the organization. With the current update, we are happy to provide a multiple login account for each of your customers (each tenant).

Each Tenant in the System will have a:

  • Super Admin
  • A few Admins
  • Normal Users

Grouping of Things

The new version will provide option to grouping of devices and machines based on departments to provide granular control. Permissions can be provided as read only or read / write based on the grouped devices. In a business organization, a few professionals can be allowed to send commands to the machines / devices while others can monitor the activity and view graphs.

Normal Users will be able to view / operate on single or multiple group of devices / machines for which they have been provided permissions.

Admins will be able to create new widgets & Dashboards (coming soon), provide permissions for users, create and manage created groups.

Super Admin is the account owner who will be able to add new users and do everything else Admin and Normal user can perform.

You can have a look at the complete set of Featurs of the Bevywise IoT Platform in the presentation

Feel free to write to support for a complete Demo.

IoT Simulator 2.0 Release

IoT Simulator 2.0 Release

Security is one of the major concerns of the IoT Manager applications. Keeping this in mind, we built the manager applications with different level of security. IoT Network Simulator is enhanced to support all manager applications based on their security practices. Similar to the previous version, the simulator supports all its options from the user interface itself.

IoT Network simulator for AWS IoT core / Azure IoT hub

The User interface will provide options based on the IoT applications. For example Azure IoT hub supports SAS Token and Certificate based authentication. Users will be able to create a specific network for the Azure IoT core and able to create devices that handshakes with the IoT hub based on the details specified when configuring the device. Similarly, this is possible for the AWS IOT as well.

Simulating IoT Network for Other Manager applications

For all other manager applications like Bevywise IoT Platform, Losant , and others, you will be able to specify a single certificate at the common settings page and get your devices connected to the manager application.

Device-level SSL Security

Azure IoT / AWS IoT manages every device to have a unique certificate. In addition, the IoT Network simulator supports the configuration of the root Certificate in the settings window and ensures that you specify each and every client certificate in the device configuration screen. The WILL, QoS, retain event messages and command messages configuration is the same as before.

Individual Device IP Address

The simulator runs on a single machine and simulates all its devices. But, The manager will be seeing all the devices from one Host (IP Address). This contradicts the real-time Simulation. In order to overcome this, the 2.0 version has added support for using Virtual IP Addresses. By this functionality, each simulated device will connect to the manager application from a different host Address.

Try the new IoT Simulator 2.0 now

download now


MQTT Broker – Manage devices better

MQTT Broker – Manage devices better

Today we are happy to announce an enhanced version of the MQTT Broker.The newly updated version will help you identify MQTT connection error, Manage devices better & also provides Dynamic MQTT Authentication.

MQTT Broker manage devices better

You will be able to initiate a command to any particular device from the User Interface of the MQTT Broker. This has been previously supported via REST API built over the broker. The REST APIs were used by customers to initiate a command from their application.

When you do a real time project, IP Address of the edge device helps you get more information & exact location of the device. The new update shows your the client IP Address on the UI. Going forward we will be adding alerts based on the changes in the client IPs to inform suspicious activity.

MQTT Connection Error Monitoring

There is no ideal system in the world. You may face some MQTT connection error while connecting your devices. But it is very important to know the issues and mitigate them. All Edge devices will not behave perfectly as per the Protocol. Any Edge device can be disconnected from the MQTT Broker for various reasons. In a similar way, any packet that is not as per the standard can be dropped as well. We have added support to highlight the actual cause for MQTT connection error. It helps you identify and clear the alarm easily. The following scenarios will show you a warning on the User Interface :

  1. Reuse of the Client identifier.
  2. Usage of wrong MQTT credentials.
  3. Inconsistency in connectivity & Timeout issues.
  4. Usage of invalid Certificates for SSL / TLS connections.
  5. Not supported characters in Client Identifier.
  6. Missing of required Client Details.
  7. Atypical disconnection.
  8. Error in the MQTT Packet formation.
  9. Server not able to handle new request.

Dynamic MQTT Authentication

You can now configure your MQTT Broker parameters from the User Interface. When the authentication is enabled, you will be able to add new MQTT Username and password and also delete authentication keys dynamically. This helps you in take actions swiftly when you find some wrong usage of authentication keys.

Further You will be able to enable / disable TLS and authentication from the User Interface. Also enable Custom Store option from the UI. But these setting changes need a restart of the broker from the terminal. We working on making these changes dynamic as possible.

The new version of the MQTT Broker can be hosted on AWS Securely. We would always recommend you to use Monit to run the MQTT Broker as a service and control over the web also.

Download the MQTT Broker now.

download now

We would be happy to answer your question and hear your feedback. Feel free to write your queries to support.

Generating SSL Certificates for Secure MQTT communication

Generating SSL Certificates for Secure MQTT communication

SSL Certificates plays a major role in enabling the security. Hence, MQTT Broker provides an option to enable SSL / TLS mode of encrypted data transfer for enhanced MQTT Security or secure MQTT Communication. Works with all standard SSL/TLS Certificate or run with self signed certificate.

SSL certificates are files that has digital data of encryption key to encrypt data for security. Hence, You can use the certificates to make sure the data encryption in the tunnel  and cannot be tampered. There is a need of key for decoding the data at the other end.

Must Read Other Related Post

This blog provides a detailed and a quick guide to create a self signed certificate using the openssl installed in ubuntu.

Create Root Certificate

The following command creates the private key file.

openssl genrsa -out root.key 2048

To create a password protected key by adding -des3.

openssl genrsa -des3 -out root.key 2048

The above command will create a root.key In the current folder. our next step is to generate Certificate signing request file using above generated RSA private Key. Besides that, It contains encrypted personal details of the Host ie. country, state, organization, common Name, email address, and public key.

openssl req -new -x509 -key root.key -out root.crt

The above command will prompt for the following details.

Country Name :
State or Province Name :
Locality Name :
Organization Name :
Organizational Unit Name :
Common Name (e.g. server FQDN or YOUR name):
Email Address :
A challenge password :(optional)
An optional company name :(optional)

You can use the above two files  to sign the certificate.

openssl x509 -req -days 365 -sha1 -extensions v3_ca -signkey root.key -in root.csr -out root.crt

The above command creates the X509 based root certificate which is considered as CA Root Certificate The above command generated a root certificate root.crt which is valid for 365 days.

Creating a MQTT Server certificate

You need to create the server key file using  the following command.

openssl genrsa -out server.key 2048

Create a Server csr file that holds the complete server details of the host. The following command will prompt for the company details.

openssl req -new -out server.csr -key server.key

Use the following command to create the Server certificate . Use the root certificate to create the server certificate.

openssl x509 -req -in server.csr -CA root.crt -CAkeyroot.key -CAcreateserial -out server.crt

Creating MQTT Client certificate

The above procedure followed for the server certificate can be used to create the client certificates. Please use appropriate name for the files.

The above certificates are also valid for 365 days. Same Certificate Authority is used for generating both the client and Server certificate.

Secure MQTT Communication in MQTT Broker

The root certificate, server certificate and server private key needs to be placed on the server side and the root certificate, client certificate and the client private key needs to be placed in the client side.

We can either have a common client certificate or individual certificate for each client. You can issue a certificate to client using your own root.key and root.crt. MqttRoute / MQTT Server verify the common name and the client IP during the connection process.  If both are same then only broker allows the client to connect otherwise reject the client’s connection request.

Follow the steps to run the MQTT Broker and the MQTT client in the MQTT Broker.

  • Broker certificate and Key file MUST be present in ./Certificate/server folder.
  • Client certificate and Key file MUST be present in ./Certificate/client folder.
  • CA Certificate MUST present in ./Certificate/root folder.
  • Broker and Client certificates MUST be signed by same CA.

Download the makefile and follow the above procedure to secure MQTT communication in minutes.

Please make sure the necessary information is provided during the prompt.

MQTTRoute is designed to secure the data from the device to the enterprise system. Learn more about the data security for secure MQTT Communication.

Write to support for any assistance regarding MQTT Security.

To get started sign up for hosted setup or download a forever free version for local installation.

Download Bevywise MQTT Broker for free