In our recent project we try to secure the pub-sub jeromq connections.
For this we want hosts to first authenticate new hosts with the network and every host who's not authenticated is blocked from subscribing. Another benefit would be fewer messages sent in the network.
So, is it possible to create a whitelist for publishing?
There is not a direct archetype for white-listing, yet the need to solve is obvious ( the more after reversal in PUB/SUB topic-list processing took place in versions 4.x+, that cause a potential risk of overloading the processor-side, which was not possible in 2.x + 3.x versions ).
Let's propose a multi-staged approach.
If we cannot block, let's first expose a reversed .bind()/.connect() on an XSUB/XPUB trivial archetype, for an initial contact detection, so as to detect a new member coming and trying to join the production-service and next just let's allow only those, who've got a POSACK, to enter into another gate ( whispered to those white-list permitted, not the others ), where another ZeroMQ infrastructure ( a signalling/messaging plane composed from trivial archetypes ) opens the doors, where those pre-selected can proceed. Again, reversed .bind() / .connect() operations prevent risks of massive attacks against publicly exposed access-points. Solutions exist even for those cases and scenarios, where non-public address translations are needed ( but these solutions go beyond the sole ZeroMQ tools under review here ).
Those others do not get details where to go in cases, they did not pass the authentication.
This way you get the white-listing policies ( may read more details about using a "knocking the door" in security mechanics ).