Federated learning-based lightweight digital certificate authentication and anomaly detection framework for IoT environments

The exponential growth of Internet of Things (IoT) deployments has strained conventional security architectures, exposing two interlinked weaknesses: certificate handling designed for servers overwhelms microcontroller-class hardware, and isolated anomaly detection leaks privacy once behavioural data leaves the device. This paper addresses both within one architecture, combining elliptic curve Qu–Vanstone (ECQV) implicit certificates with privacy-preserving collaborative anomaly detection across device, edge and cloud tiers. The certificate occupies 88 bytes, a 92.7% reduction relative to a typical X.509 credential, and a complete authentication exchange, comprising public-key reconstruction, a verifier challenge, proof of private-key possession over the bound transcript and session-key confirmation, completes in 12.3 ms on an ESP32, roughly five times faster than an RSA-2048 baseline measured on the same board. On the detection side, similarity-based aggregation weighting accommodates the non-IID character of distributed traffic, while per-example gradient clipping with Gaussian noise provides differential privacy whose budget we account for with a Renyi accountant and report in full. Evaluation on the N-BaIoT dataset, roughly 7 million records from nine commercial devices under Mirai and BASHLITE traffic, yields 95.2% detection accuracy, 1.6 percentage points below the centralized upper bound. Throughput stays within 15% of its peak as the network grows from 100 to 1000 devices, the larger configurations being reached by adding edge aggregators rather than by loading a single one. Ablation studies show that adaptive weighting recovers 4.7 percentage points under strong label skew and that coupling authentication with detection halves the false negative rate against stolen credentials; comparison with Krum, trimmed-mean and FLTrust shows, conversely, that the proposed soft weighting is not a substitute for a Byzantine-robust rule once more than 15% of clients misbehave. The trust root remains the cloud certificate authority; what the design decentralizes is the verification path, not the root itself.