A Novel MQTT-ZT Secure Broker: Zero Trust Architecture for IoT Security
Meha James, Thomas Newe, Donna O’Shea, George D. O’Mahony · 2025
The rapid growth of the Internet of Things (IoT) introduces significant security risks, including unauthorized access, data breaches, and supply chain attacks. Traditional models like Role-Based Access Control (RBAC) lack scalability and realtime enforcement for dynamic IoT environments. This paper presents the MQTT-ZT Secure Broker—an MQTT-based IoT communication framework built on Zero Trust Architecture (ZTA). It integrates Attribute-Based Access Control (ABAC) directly into the broker using a built-in Policy Enforcement Point (PEP) and Axiomatics’ ALFA policy engine for efficient, low-latency authorization. Experiments conducted in a cyber range show the broker maintains low processing times—20–79 ms for publishers and $\mathbf{2 4 - 6 3 ~ m s}$ for subscribers—even at $\mathbf{2 0 0}$ clients, outperforming traditional methods that often exceed 100 ms. These results highlight the architecture’s ability to scale while ensuring continuous verification and minimal latency. The MQTT-ZT Secure Broker offers a robust and scalable Zero Trust solution for securing IoT environments.