Balancing Security and Performance in MQTT-Based IoT Systems: A Review of Adaptive Flow Control, Backpressure, and Wildcard-Intensive Access Control Mechanisms

The rapid proliferation of the Internet of Things (IoT) has positioned the Message Queuing Telemetry Transport (MQTT) protocol as an important communication standard for large-scale and resource-constrained systems. Despite its lightweight design and scalability advantages, contemporary MQTT deployments operate under increasingly complex conditions characterized by security enforcement, dynamic traffic patterns, and widespread use of wildcard subscriptions, creating interdependent challenges involving broker performance, congestion, routing complexity, and security. This review critically synthesizes research on the interactions among adaptive flow control, backpressure, authentication and authorization mechanisms, and wildcard-intensive access control in MQTT-based IoT systems. Particular attention is given to the computational and latency overhead associated with authentication, authorization, and encryption; the formation and propagation of backpressure when message-arrival rates exceed processing capacity; the capabilities and limitations of TCP-, broker-, and MQTT v5-level flow-control mechanisms, including Receive Maximum; and the effects of wildcard subscriptions on topic matching, message fan-out, authorization processing, and security exposure. The reviewed literature indicates that these mechanisms have predominantly been investigated individually or through pairwise relationships, while closed-loop approaches that jointly incorporate security-processing overhead, broker backpressure, and wildcard-induced routing and authorization complexity into runtime control decisions remain insufficiently developed. On this basis, the review defines a cross-layer control-integration gap and develops a focused research roadmap encompassing unified cross-layer state representation, security- and wildcard-aware adaptive flow control, predictive backpressure management, MQTT v5-aware control integration, scenario-specific benchmarking, and distributed broker deployment. The synthesis highlights the need for future MQTT architectures in which security state, wildcard-induced workload amplification, and congestion indicators are treated as coordinated inputs to adaptive traffic management while preserving access-control correctness, reliability, and scalability.