Design and Implementation of a Secure MQTT Architecture for IoT Systems Using TLS and Token-Based Authorization

Abstract

MQTT is widely adopted in IoT deployments but offers no built-in encryption or strong authentication. Existing solutions such as the IETF ACE-MQTT-TLS profile require dedicated authorization servers and dynamic token flows, raising deployment complexity for resource-constrained environments. This paper presents a practical secure MQTT architecture that combines Transport Layer Security (TLS) 1.3 with statically provisioned JSON Web Token (JWT) authorization, targeting ESP32-S3 and ESP32-C6 microcontrollers with hardware cryptographic acceleration. A Python-based broker management graphical user interface (GUI) automates Mosquitto configuration and JWT issuance, removing manual setup errors. Measured on real hardware, TLS 1.3 connection time is 315-380 ms and steady-state throughput decreases by only 9%, with an additional heap memory requirement of approximately 42 KB. The results confirm that multi-layered IoT security—encompassing mutual authentication, AES-GCM encrypted transport, and fine-grained access control—is feasible on commodity microcontrollers without specialized infrastructure.