A Novel MQTT-ZT Secure Broker: Zero Trust Architecture for IoT Security

The rapid growth of the Internet of Things (IoT) introduces significant security risks, including unauthorized access, data breaches, and supply chain attacks. Traditional models like Role-Based Access Control (RBAC) lack scalability and realtime enforcement for dynamic IoT environments. This paper presents the MQTT-ZT Secure Broker—an MQTT-based IoT communication framework built on Zero Trust Architecture (ZTA). It integrates Attribute-Based Access Control (ABAC) directly into the broker using a built-in Policy Enforcement Point (PEP) and Axiomatics’ ALFA policy engine for efficient, low-latency authorization. Experiments conducted in a cyber range show the broker maintains low processing times—20–79 ms for publishers and $\mathbf{2 4 - 6 3 ~ m s}$ for subscribers—even at $\mathbf{2 0 0}$ clients, outperforming traditional methods that often exceed 100 ms. These results highlight the architecture’s ability to scale while ensuring continuous verification and minimal latency. The MQTT-ZT Secure Broker offers a robust and scalable Zero Trust solution for securing IoT environments.