IoT-Based Zero-Trust Security Architecture: A Comprehensive Analysis

Abstract

Traditional perimeter-based security models have become ineffective in the face of the explosive growth in the number of Internet of Things (IoT) endpoints deployed at critical infrastructures. To cope with this weakness, network engineering is moving toward Zero-Trust Architecture (ZTA) frameworks, based on the principle of "never trust, always verify". But enterprise zero-trust models deployed directly in deeply embedded, resource-constrained nodes create a critical operational conflict: the Energy-Security Paradox. The survey paper offers an in-depth and multidimensional analysis of scientific publications from 2024 to 2026 to chart the convergence of cutting-edge IoT Zero-Trust deployments under stringent hardware and computational constraints. Using a Systematic Literature Review (SLR) methodology, a technical taxonomy was developed to sort eligible studies into a structured classification of studies in the three operational layers: physical hardware layers, trust anchors, lightweight cryptography (LWC), and decentralized behavioural intelligence. Silicon-derived fingerprints are still environmentally sensitive, standalone LWC ciphers do not have extensive cross-layer protocol integration and decentralized threat detection models are still highly susceptible to adversarial manipulation and poisoning attacks. This survey paper outlines some of the most important open challenges relevant to the next decade of research, including Byzantine-resilient aggregation frameworks.