Constrained Protocol

HTTP over TLS is unremarkable on a laptop and unusable on a battery-powered sensor on a cellular link: the header overhead can exceed the payload by an order of magnitude, connection setup dominates the energy budget, and a request-response model does not fit devices that must receive commands while mostly asleep.

MQTT is the common answer — a publish-subscribe protocol over a persistent TCP connection with very small headers, three quality-of-service levels, a last-will message so the broker announces unexpected disconnection, and retained messages so a subscriber gets current state immediately on connect. The persistent connection is both its strength for receiving commands and its cost in keeping a radio and a broker connection alive per device.

CoAP takes the opposite approach: a compact request-response protocol over UDP with REST-like semantics, optional confirmable messages, and no connection to maintain — better for devices that sleep deeply and wake rarely.

The architectural consequences to plan for: broker scale, since a million persistently connected devices is a specific and demanding engineering problem; and the security model, since these protocols' authentication is typically per-connection and coarse, so authorisation of what a device may publish or subscribe to must be enforced deliberately rather than assumed. A device able to publish to any topic can impersonate the entire fleet.