  Internet of Things (IoT) devices pose significant security challenges due to
their heterogeneity (i.e., hardware and software) and vulnerability to
extensive attack surfaces. Today's conventional perimeter-based systems use
credential-based authentication (e.g., username/password, certificates, etc.)
to decide whether an actor can access a network. However, the verification
process occurs only at the system's perimeter because most IoT devices lack
robust security measures due to their limited hardware and software
capabilities, making them highly vulnerable. Therefore, this paper proposes a
novel approach based on Zero Trust Architecture (ZTA) extended with blockchain
to further enhance security. The blockchain component serves as an immutable
database for storing users' requests and is used to verify trustworthiness by
analyzing and identifying potentially malicious user activities. We discuss the
framework, processes of the approach, and the experiments carried out on a
testbed to validate its feasibility and applicability in the smart city
context. Lastly, the evaluation focuses on non-functional properties such as
performance, scalability, and complexity.
