Zero Trust Framework for Resilient MQTT-based IoT Systems

Abstract

MQTT-based Internet of Things (IoT) infrastructures are increasingly adopted to support real-time telemetry services in which constrained devices periodically publish operational information toward edge or cloud services. In railway monitoring scenarios, this communication model is particularly attractive because trains can continuously report position, diagnostic status and service events through a lightweight publish/subscribe interaction. However, the same architectural properties that make MQTT suitable for constrained environments also expose the broker to malicious or unstable clients that may publish malformed payloads, abuse retained messages, generate high-rate traffic, exploit expensive Quality of Service levels, or attempt to access administrative topics. This paper proposes a Zero Trust MQTT security framework that combines token-based authentication, topic and payload validation, adaptive trust scoring, predictive trust forecasting and policy-based enforcement around an MQTTv5 broker, with the objective to separate the policy and governance logic from the message-flow enforcement layer. In this context, the proposal aims to position itself as a modeling and analysis artifact for resilient MQTT-based critical IoT systems, where Zero Trust decisions support service continuity under adversarial degradation. Experimental results show that the adaptive trust configuration is able to detect malicious entities while the mitigation, based on token revocation, significantly reduces malformed messages, retained-message abuse and throughput pressure under attack conditions.