IIoT platform
architecture.

IIoT platform architecture describes how industrial IoT systems are structured: the layers, components, and protocols that connect physical devices to cloud applications. A typical architecture includes device and sensor layers, edge gateways, message brokers, an IoT platform for device management and dashboards, an identity and authorization layer, and optional edge compute and cryptography layers.

IoT (Internet of Things) is the broad category of connected devices: consumer electronics, smart home devices, wearables. IIoT (Industrial Internet of Things) specifically refers to connected devices in industrial contexts such as manufacturing, energy, utilities, transportation, and infrastructure. IIoT systems typically have higher reliability requirements, longer device lifetimes, and stricter security and compliance needs.

MQTT was designed for constrained devices over unreliable networks. Its publish-subscribe model decouples producers from consumers. Quality of Service levels (0/1/2) provide flexible delivery guarantees. It runs over TCP with minimal overhead, making it suitable for everything from microcontrollers to cloud-scale brokers. MQTT 5.0 adds features like shared subscriptions, topic aliases, and enhanced authentication that enterprise deployments need.

An IoT gateway is a device that aggregates data from local sensors and field devices and forwards it to a cloud platform. Gateways are necessary when field devices speak non-IP protocols (Modbus, Wireless M-Bus, Bluetooth), when local processing or offline buffering is required, or when you want to reduce cloud bandwidth by aggregating and filtering data at the edge. For devices with native IP and MQTT support, a gateway is optional.

Edge computing moves processing from the cloud to the device or gateway. In IIoT this reduces latency for time-critical control loops, lowers cloud bandwidth costs, and enables operation during cloud connectivity loss. Edge compute layers typically run lightweight runtimes such as containers, WebAssembly, or native binaries on gateway hardware. WebAssembly is increasingly used because it provides sandboxed isolation, sub-10ms startup, and portability from cloud servers down to microcontrollers.

A message broker is the central routing component for device telemetry. Devices publish messages to topics; platform services subscribe to those topics. The broker decouples producers from consumers, handles delivery guarantees (QoS), and can buffer messages during downstream failures. In enterprise IIoT, brokers also provide durable queues with consumer groups so multiple downstream services can consume the same data stream independently.

Each device needs a unique cryptographic identity, typically a certificate or API key associated with a device record in the platform. That identity controls which topics the device can publish and subscribe to. Runtime policy evaluation, rather than token-embedded permissions, ensures that when a device is decommissioned or its credentials are revoked, access is blocked immediately without waiting for tokens to expire.

Industrial devices deployed today often remain in the field for 10 to 20 years. Quantum computers capable of breaking ECC and RSA are projected to become practical within that window. NIST finalised post-quantum cryptography standards in 2024. EU and US regulators project mandatory PQC adoption in critical infrastructure by 2030. Devices that ship now with only classical cryptography will be vulnerable before end-of-life.