Why the Backend Said Yes

The observed MQTT, HTTPS, and SMS failures look different because they affect different resources, but their diagnosis starts in the same place. A valid certificate, token, or session was treated as if it were broad permission. This chapter separates that symptom from the missing checks that caused it, then examines why inconsistent deployment, legacy vehicles, and cloud centralization magnified the consequences.

One symptom, three missing bindings

“The credential was valid” is an incomplete diagnosis because it answers only who established the channel. It does not answer what the channel may address. In the evaluated systems, the recurring omission was the relationship between the authenticated identity and the target resource.

For MQTT, the missing relationship was between the vehicle session and the topic namespace or command scope. The broker could recognize a valid session yet fail to apply the same vehicle-specific boundary to the topic operation. The relevant symptom was a cross-tenant command or message flow. The underlying cause was not that the certificate stopped authenticating correctly. It was that topic authorization did not consistently prove that the authenticated vehicle owned the namespace it was using.

For HTTPS, the missing relationship was per-request object ownership. The server accepted an authenticated request and resolved a vehicle-scoped object, but did not verify that the requester was authorized for that object. A valid session became a broad permission to name resources. The media URL then extended the problem into the storage path. The root question is not whether the URL was valid. It is whether the principal requesting the object was allowed to receive it.

For SMS, the missing relationship connected a command to its sender, freshness, and target vehicle. A payload that matched the expected format could pass without proving that it came from an authorized source or that it was approved for the vehicle receiving it. Format validation was present, but format validation was not command authorization. The system recognized the shape of the message without establishing its authority.

These are three enforcement points, not three unrelated bugs. A broker must bind a session to its topic scope. An API must bind a requester to the object selected on each request. A fallback receiver must bind a command to an authenticated and fresh origin and to the intended vehicle. The paper’s technical analysis treats the shared failure as authentication without scope enforcement, while vendor feedback specifically explained the inconsistent MQTT ACL deployment. Those evidence levels should remain distinct: a vendor-confirmed deployment cause is stronger than an inferred internal configuration detail, while observed post-disclosure behavior can support a mitigation effect without revealing every implementation decision.

The diagnosis also rules out several tempting but inaccurate explanations. The study did not require breaking TLS, forging a certificate, or making the backend misidentify the seed vehicle. The transport layer performed its intended identity function. The failure appeared after that function, when the application request supplied a target and the service decided what the authenticated principal could do with it.