MQTT is a widely accepted Application Layer protocol for IoT. MQTT consists of a central entity named broker to facilitate communication among end devices. The main purpose for comprising the broker is to reduce communication overhead from end devices. However, a DDoS attack can be performed on the broker by exploiting the vulnerabilities of the MQTT protocol. An attacker can perform a DDoS attack in MQTT by sending fake connect requests to the broker or by sending fake data packets to the broker. As a prevention strategy, connect command uses a credentials-based authentication method to prevent an unauthorized user from connecting to the broker. As these credentials are sent in plain text form, an attacker could obtain them and use them for later authentication. This paper investigates an advanced Challenge Response based authentication mechanism which calculates the hash value followed by symmetric encryption of a randomly selected message. Randomly select message and its encrypted hash value are sent as username and password to the broker, respectively. Experimental evaluation shows that the proposed scheme incurs minimal overhead, which is acceptable considering the additional security provided. Moreover, the Security analysis of the proposed scheme shows that it can protect the system against various attacks, including man-in-the-middle attack, rainbow attack, and dictionary-based attacks.