Post-Quantum and Federated IoT Security: Challenges, Architecture, and Hardware-Executed Evaluation

Abstract

The convergence of quantum computing and the scale of Internet of Things (IoT) deployments creates a compounded security problem: classical public-key cryptography securing today’s IoT traffic is vulnerable to harvest-now, decrypt-later attacks, while the constrained hardware typical of IoT devices limits the security mechanisms can be deployed. Prior work has largely evaluated post-quantum cryptography (PQC), federated learning (FL)-based anomaly detection, and quantum-resilient storage separately or in partial combinations, leaving open whether these mechanisms remain practical when composed on constrained hardware under a shared operational budget. This paper answers that question with a three-layer architecture — a hybrid PQC pipeline (Kyber-based key encapsulation, ML-DSA signatures, AES-GCM encryption, and PQC-TLS transport), a federated anomaly-detection layer, and a quantum-resilient storage and audit layer (DeSSE and MuReQua) — executed end-to-end on a Raspberry Pi 5 edge node under AWS IoT Greengrass Core, with nine concurrent virtual IoT nodes processing real attack traffic from the N-BaIoT and TON_IoT datasets. Benchmarking across 27 cryptographic algorithm combinations (810 pipeline executions) shows that all 27 configurations completed in under 2.1 ms, with the deployed Kyber768/ML-DSA-65/AES-256-GCM tier adding 4,521 bytes of per-message overhead, which remained compatible with the evaluated 20 ms inter-row transmission budget. Live federated deployment across the nine virtual IoT nodes on N-BaIoT achieves F1-scores above 0.998 on eight of nine devices, processing at approximately 900 rows/second with zero signature verification failures; a centralized baseline evaluation further confirms 99.46% attack recall on unseen TON_IoT threats withheld from training. The quantum-resilient storage layer maintains 100% chain integrity and complete signature coverage across 4,471 audit records, with independent tamper simulations reliably detected. PQC-TLS introduces a one-time handshake overhead of 13.7 ms (288.5% relative increase) over classical TLS, which remains small relative to the multi-minute FL round intervals measured in the evaluated deployment. Together, these results demonstrate that quantum-resilient cryptography, federated intelligence, and auditable storage can be jointly executed on constrained IoT edge hardware as a single experimentally demonstrated pipeline within the operational conditions evaluated in this study.