A scalable and secure federated learning authentication scheme for IoT

Why your connected gadgets need smarter security

From fitness trackers and smart thermostats to factory sensors and connected cars, the Internet of Things (IoT) is quietly spreading into every corner of daily life. Yet many of these tiny devices run on limited power and simple chips, making it hard to protect them with the heavy-duty security used on laptops and phones. This paper introduces a new way to let these devices prove who they are and talk securely, without draining their batteries or depending on a single central authority that could become a bottleneck or a target.

The problem with today’s lock-and-key for devices

Current IoT security often relies on passwords or digital certificates issued by central organizations, much like website certificates used in web browsers. For small, battery-powered sensors that frequently join, move within, or leave a network, these methods are slow, communication-heavy, and difficult to manage at large scale. Attackers have already exploited weakly protected gadgets to build powerful botnets and spread ransomware. At the same time, constantly sending data to a central server for analysis raises privacy concerns and wastes energy and bandwidth. The challenge is to give billions of diverse devices a way to authenticate each other that is strong, flexible, and light enough to run on tiny hardware.

A new blend of local learning and cryptography

The authors propose ScLBS, an authentication scheme built specifically for distributed IoT networks. Its core idea is to combine two worlds: advanced cryptography and federated learning, a type of machine learning where devices share only model updates instead of raw data. Each sensor keeps track of how trustworthy its neighbors seem, based on behavior such as staying in the same location and exchanging valid messages. From time to time, these local trust updates are sent to more capable reporting nodes, which aggregate them and send improved trust models back. Crucially, no secret keys or sensitive measurements are revealed in this process. In parallel, the system uses a self-certified public key method, which lets devices derive usable public keys without relying on outside certificate authorities or exposing private information.

Using place and behavior as extra proof

ScLBS does not depend on passwords alone. A device’s physical location and its past actions become central parts of its identity. When a new sensor joins, it registers with a nearby reporting node, which checks the claimed location with already trusted neighbors and verifies that the device is within an expected communication range. The scheme employs a zero-knowledge style exchange, meaning a device can prove it holds the right secret without ever sending that secret across the air. If the device passes these checks, it receives a self-certified public key and participates in ongoing trust updates. Devices whose behavior becomes suspicious over time are automatically downgraded by the federated trust model and can eventually be treated as compromised and removed.

Sharing secrets in groups without chaos

Once a device is accepted, it needs to exchange encrypted data with others, often as part of a group such as all sensors in a building or section of a factory. A naive way to manage group keys—shared secrets that protect messages—would require many updates every time a device joins or leaves, which quickly becomes expensive. ScLBS organizes devices in a balanced tree structure that allows key updates to ripple through the group efficiently, affecting only the relevant branches instead of the entire network. The underlying math is based on an energy-saving form of elliptic curve cryptography, well suited for low-power chips. This design keeps group communication confidential even if some nodes are captured, and it preserves forward and backward secrecy: learning a current key does not reveal past keys, and departed devices cannot read future messages.

Proving security and measuring real-world costs

To check that ScLBS is not only clever on paper but also robust in adversarial settings, the authors model the protocol in a formal tool called ProVerif, using a threat model where an attacker can listen to, alter, and replay any message on the network. The analysis confirms that private keys and session keys remain secret and that only legitimately authenticated devices can complete a session. Simulations using the NS-3 network simulator then compare ScLBS with several existing IoT authentication and routing schemes. Across a range of network sizes, the new approach cuts message overhead, shortens authentication delays, improves bandwidth usage, and lowers energy consumption, all while keeping the extra workload of federated learning small and infrequent.

What this means for the future of connected things

In plain terms, ScLBS offers a way for swarms of small devices to recognize trusted neighbors and establish secure channels more quickly and efficiently than many current methods. By treating location and behavior as part of a device’s identity, and by letting devices learn together without sharing raw data, the system raises the bar for attackers who try to impersonate devices, replay old messages, or exploit stolen hardware. At the same time, its tree-based key management and lightweight cryptography help conserve precious energy and bandwidth, making it more realistic to secure large, long-lived IoT deployments such as smart cities, industrial sites, and health monitoring networks.

Citation: Chithaluru, P., Jyothi, B.V., Alharithi, F.S. et al. A scalable and secure federated learning authentication scheme for IoT. Sci Rep 16, 7888 (2026). https://doi.org/10.1038/s41598-026-37541-8

Keywords: Internet of Things security, federated learning, device authentication, elliptic curve cryptography, group key management