IoT architecture layers: three-, four- and five-layer models
In short: Layered models describe IoT as a stack. The three-layer model has perception, network and application layers. Four- and five-layer models split out middleware or processing and add a business layer. The exact model matters less than using it consistently to place components and threats.
Why use a layered model
Like the OSI model for networks, layered IoT models give you a shared vocabulary. They help you describe where a component sits, which team owns it and which threats apply. There is no single official model; textbooks and papers use three, four or five layers. Learn the common versions and how they map onto each other.
The three-layer model
- Perception layer (also called the device or sensing layer): sensors, actuators, RFID tags and the MCUs that read them.
- Network layer: everything that carries data, such as Wi-Fi, cellular, LoRaWAN, gateways and the internet.
- Application layer: the services people use, such as a smart-home app or a fleet-tracking dashboard.
It is simple and good for a first explanation, but it hides a lot. Data storage, device management and analytics all get squeezed into "network" or "application".
Four and five layers
The four-layer model usually inserts a support or middleware layer between network and application. This is where data is stored, processed and managed, often on a cloud IoT platform. Some versions instead split perception and gateways into separate layers.
The five-layer model renames network as transport, keeps a processing layer for storage and analytics, and adds a business layer that covers business models, governance and user privacy.
| Three-layer | Four-layer | Five-layer |
|---|---|---|
| Application | Application | Business and Application |
| (inside network/app) | Support / middleware | Processing |
| Network | Network | Transport |
| Perception | Perception | Perception |
Using layers for security analysis
A layered model makes a handy checklist. For each layer, list the assets, the threats and the controls:
| Layer | Example threats | Example controls |
|---|---|---|
| Perception | Physical tampering, sensor spoofing, firmware extraction | Secure boot, tamper-evident housing, disabled debug ports |
| Network / transport | Eavesdropping, jamming, rogue gateways | TLS or DTLS, mutual authentication, segmentation |
| Processing | Data breach, injection into rules | Encryption at rest, input validation, least privilege |
| Application | Account takeover, broken access control | MFA, secure API design, logging |
| Business | Privacy violations, compliance failure | Data protection impact assessment, policies |
Tip: in assignments, state which model you are using and cite where you got it from. Examiners mainly want to see that you apply it consistently, not that you chose the "right" one.
Practice
Name the three layers of the basic IoT model, bottom to top.
What does the five-layer model add compared with the three-layer model?
At which layer would you place a threat of someone reading firmware through a debug port?
Key takeaways
- Layered models give a shared vocabulary for IoT systems.
- Three layers: perception, network, application.
- Four- and five-layer models add middleware or processing and a business layer.
- No model is official; state yours and use it consistently.
- Use layers as a checklist for threats and controls.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.