Distributed Denial of Service attack analysis and mitigation for MQTTv5 shared subscription

Abstract

Sixth-generation (6G) networks will feature Massive IoT (M-IoT) deployments with a huge number of interconnected devices, enabling fast and reliable IoT applications. To address scalability and enhance message delivery, MQTTv5 introduces the shared subscription mechanism. However, the increased interconnectivity amplifies security vulnerabilities, posing significant risks with potentially severe consequences. In light of these challenges, this work aims to conduct a security-focused analysis of the shared subscription feature. Our study highlights the potential extent of damage from such an attack, which can potentially lead to indefinite starvation among legacy subscribers, and proposes a countermeasure to mitigate its impact. Additionally, to provide comprehensive security to the proposed mitigation mechanism, we design an Authenticated Encryption with Associated Data (AEAD)-based protection to counteract external malicious entities as well as an attacker detection mechanism based on a trust-based approach combined with the z-score statistical method to protect the proposed mitigation against internal attackers. These countermeasures are designed to accommodate the lightweight nature of MQTT and are characterized by a low protocol footprint while effectively mitigating the impact of the attack. Through an extensive experimental campaign, we tested this solution under real IoT traffic patterns to demonstrate its effectiveness and capability to restore the performance of the MQTT system targeted by the discovered attack.