Efficient and dynamic access control with end-to-end message security for MQTT

The Internet of Things (IoT) has become deeply integrated into daily life, with devices now monitoring our health, managing homes, and controlling critical infrastructure. Ensuring the security of these interconnected systems is therefore essential. Among IoT communication protocols, MQTT has emerged as the most widely adopted lightweight messaging standard, enabling efficient publish–subscribe interactions between devices. However, existing solutions for authorisation and message-level security in MQTT are unnecessarily computationally expensive, making them unsuitable for constrained devices. In this paper, we introduce a novel access control policy model and an accompanying enforcement and message-security scheme designed specifically for MQTT. We are not aware of an existing MQTT policy model that can automatically assign and maintain access-control labels as new topics appear in the dynamic topic hierarchy. Our enforcement scheme uses lightweight symmetric cryptography to provide end-to-end payload confidentiality (brokers and mediators cannot read plaintext), rather than hop-by-hop protection as in MQTT over TLS. Our performance evaluation shows that our scheme significantly reduces computational and memory overhead compared to TLS, making it far more suitable for constrained IoT devices. This makes it practical for deployments where clients cannot afford a full TLS stack but still require confidentiality and policy enforcement.