Latency-Security Co-Design Framework for Edge IoT Gateways

The fast growth in the number of Internet of Things (IoT) deployments in smart cities, industrial automation, healthcare, and intelligent transportation systems has fundamentally redefined the distribution of security risk between centralized cloud-based deployments and edge IoT deployments [1]. These gateways are now multi-purpose security implementation locations, and they are in charge of authenticating devices, setting up cryptographic keys, maintaining sessions, and real-time inference of the intrusion for thousands of heterogeneous IoT nodes [2]. In contrast to cloud systems, edge gateways have finite computing resources, shared execution streams, and hard real-time response criteria, which leads the security processes to operate on shared processing and memory resources and time constraints [3]. This convergence as more devices is packed together and the intensity of the traffic flows enables edge gateways to become performance bottlenecks in which security enforcement and latency cannot be considered as independent design issues but instead inherently intertwined [4]. Latency is no longer a performance figure in the environment but a basic security property. Authentication delays are susceptible to flood and resource exhaustion assaults and inference backlogs when performing intrusion detection generate short-lived blind windows that maleficence may depend on to execute covert intrusion [5]. The concurrent security activities introduce queuing delay to the security processing of an IoT device and the overall security response time is the sum of the effects of authentication processing, intrusion detection inference and queuing delay caused by concurrent security processing of the device. Once this cumulative latency reaches application-specific tolerances, the gateway goes into a vulnerable state where the authentication requests are held up and intrusion detection verdicts are delayed, allowing the gateway to make timing-based inference, selective denial of service, and IDS evasion attacks [6]. In spite of this inherent interconnection, current studies consider authentication schemes and intrusion detection system (IDS) as separate security levels. Cryptographic authentication schemes are usually tested in idealistic assumptions of zero concurrent IDS load, whereas IDS models do not take into consideration cryptographic handshake overhead or authentication bursts and report detection precision and inference delays [7]. This individual testing is essentially unstable in actual edge implementations, in which authentication and IDS detection run in parallel on common hardware sources [8]. This scattered design paradigm hides the realization of timing side-channels, the underestimation of the latency of end-to-end security, and the inability to model cascading security failures that may occur as a result of synchronized access requests or adversarial traffic bursts. This tends to cause severe performance degradation and security leakage of the systems, which seemed safe in isolation, to be deployed at scale [9].

This paper explicitly covers the lack of latency security co-design in edge IoT IDS by considering authentication and intrusion detection as a time-constrained security pipeline. We present a co-located model that explicitly represents and manages the interaction between cryptographic authentication latency and IDS inference latency at the edge gateway going beyond the previous hybrid IDS-first solutions [10]. The core of the suggested solution is an AI-controlled login filtering mechanism, which conducts a lightweight behavioral checking procedure before more expensive cryptographic operations, hence preventing the early repression of malicious or abnormal authentication requests [11]. Simultaneously, we develop a scheduling scheme of latency sensitive authentication-IDS operations that dynamically assign resources at the edge to maintain the overall security response time within a given limit as traffic loads vary, in line with the real-time requirements of linked-time constraints as observed in recent low-latency IDS research [12].

The extensive experimental analysis proves that the suggested latency-security co-design can provide consistent intrusion detection rates, over 95 percent, with the cryptographic security and no apparent timing side-channel leakage, outperforming even the previous hybrid and edge-based IDS models [13]. In addition, the scalability of the framework is tested at scales greater than 10,000 parallel IoT nodes which confirms that the framework can support limited latency and security assurances even when deployed at high density, a constraint that has been explicitly mentioned in previous surveys of the IoT IDS and federated systems [14]. Figure 1 illustrates an edge IoT security architecture in which AI-gated authentication, joint scheduling, and intrusion detection are integrated at the edge gateway to enforce bounded latency and resist flooding, congestion, and timing inference attacks.

Figure 1. System and threat model of the proposed edge IoT framework

This part shows a latency security co-design of edge-assisted IoTs, in which the authentication and intrusion detection processes are coordinated with each other with strict real-time constraints. The proposed framework has latency limits as a strict security requirement unlike traditional security architectures, which consider latency as a second-order performance measure. The framework incorporates the use of AI-controlled pre-authentication filtering, ECC-authentication, latency-sensitive combined authentication-IDS scheduling, and IDS-controlled secure session setup. The system is described in four coherent algorithms, each of which indicates a phase of security in an overall execution pipeline and makes the system no less understandable and deployable.

5.1 AI-gated authentication filtering

In an attempt to prevent authentication flooding attacks and minimize unwarranted cryptographic load, the framework adds an AI-controlled authentication gateway that stands in front of cryptographic authentication. Lightweight machine learning classifier that makes use of behavioral and traffic level features is used to test incoming access requests.

The AI-gated authentication is realized with a lightweight supervised binary classifier at the edge gateway. In this paper, we use a Random Forest classifier given its low inference time, noise-tolerant nature and ability to handle diverse IoT traffic features. The classifier uses a lightweight feature vector for each request, which includes:

• Device ID features are device ID class, registration status
• Network traffic features are packet rate, bursts, request interval
• Protocol information is port, protocol, message length
• Behavioral features are failed attempts, anomaly score, session frequency and
• Load information features are queue length, gateway load, recent authentication load.

Let $x_i \in \mathbb{R}^d$ denote the feature vector associated with the -th authentication request. The AI gate computes the decision function as in Eq. (18):

$g\left(x_i\right)= \begin{cases}1, & \text { if } f\left(x_i\right) \geq \theta \\ 0, & f\left(x_i\right)<\theta\end{cases}$                     (18)

where,

• $x_i$: The feature vector of request i
• $f\left(x_i\right)$: The classifier confidence score
• $\theta$: The decision threshold
• $g\left(x_i\right)$: The gate output

The AI gate rebuffs requests, and they are discarded prior to going through the cryptographic pipeline thus lowering the effective rate of authentication arrival from $\lambda_a$ to $\lambda_a^{\prime}=\rho \lambda_a$, with $0<\rho<1$.

The classifier is trained offline using labeled benign and malicious access traces collected from IoT traffic datasets and simulated gateway logs. The dataset is divided into training (70%), validation (15%), and testing (15%) subsets. Standard preprocessing includes missing-value handling, feature normalization, and categorical encoding. Hyperparameters are selected using five-fold cross-validation.

During online operation, each access request is initial evaluated by the AI gate. Low-risk requests are fast-tracked to lightweight authentication, whereas suspicious requests undergo stricter verification and prioritized IDS inspection. The compact feature set and lightweight classifier architecture result in low memory overhead and millisecond-level inference, making the module suitable for resource-constrained edge gateways.

5.2 Elliptic curve cryptography-based authentication with AI gating

Requests approved by the AI gate undergo ECC-based authentication, which provides strong security guarantees with reduced computational overhead, making it suitable for resource-constrained edge environments.

This stage ensures that cryptographic trust is established prior to deeper traffic inspection.

5.3 Joint authentication intrusion detection systems inference with latency-sensitive scheduling

Authentication processing and inference of IDS have few computational resources at the edge gateway. In order to provide a deterministic real time performance, the two tasks are scheduled together, sharing the same latency budget τ, which is restricted in the give condition as Eq. (19):

$T_{\text {auth }}+T_{\text {ids }}+T_{\text {queue }} \leq \tau$                      (19)

An assignment of execution weights $p$ and $p_i$ to authentication and IDS tasks respectively, which is determined by a priority-aware scheduling policy, is as follows the Eq. (20):

$p_a+p_i=1$                    (20)

The framework does not have redundant monitoring logic by integrating IDS inference and enforcing redundant latency within the scheduler, and detection blind windows are prevented.

5.4 Intrusion detection systems-guided secure session establishment

Secure session establishment is conditioned on both authentication success and IDS validation, ensuring that cryptographic keys are issued to benign devices. Let $y_i \in\{0,1\}$ denote the IDS outcome, where $y_i=1$ indicates benign traffic. Session establishment proceeds in Eq. (21): if and only if

$g\left(x_i\right)=1 \wedge y_i=1$                   (21)

5.5 Security and latency implications

Combining AI-gated authentication with latency-sensitive joint scheduling and the establishment of secure sessions based on IDS, the presented framework will enhance the security resilience and determine the real-time performance at the same time. Malicious access attempts are blocked at an early-stage before cryptographic processing and much exposure to authentication flooding and resource exhaustion attacks are mitigated. The joint scheduling mechanism ensures limited end-to-end security latency in the presence of dynamic and adversarial load conditions, in addition to maintaining adequate bandwidth in the execution of intrusion detection to eliminate detection blind windows. Moreover, through a coordinated manner where authentication and IDS functions are undertaken within a single control loop, the framework removes the timing side channels that are usually a result of uncontrolled task contention. Taken together, these design decisions represent latency as a controllable security primitive, as opposed to a secondary performance metric, and the framework is suited perfectly to real-time IoT edge deployments. Figure 2 illustrates the AI-driven latency security co-design architecture, the AI-controlled authentication is latency-aware joint scheduling, and hybrid IDS inference collaboratively decide on safe establishment of a session with a tight latency limit.

5.6 Complexity and overhead for edge deployment

The proposed framework is designed to run on resource-constrained edge gateways, so it is important that the memory and runtime cost of the framework be manageable. The total run-time overhead is spread across the lightweight AI-based request filtering, ECC authentication, adaptive scheduling and hybrid IDS inference modules. Since these components are either sequential or conditional, the average computational cost is less than if all of the security stages were executed for every request.

(1) AI-gated filtering cost

The AI-gated pre-authentication module employs a short feature vector, and a light-weight classifier. The inference cost (per request) scales almost linearly to the number of features extracted. The module limits the cryptographic and IDS costs during flooding attacks, as suspicious requests can be filtered out.

(2) ECC authentication cost

ECC-based authentication is more expensive than rule matching, but is only invoked for requests passed by the AI gate. This greatly reduces the overall cryptographic cost under DDoS attacks without compromising security.

(3) Scheduling overhead

The latency-aware scheduler updates a task's priority based on the queue length, task backlog and estimated latency. This entails simple arithmetic comparisons, which are negligible compared to authentication and IDS run time.

(4) Hybrid IDS runtime

The hybrid CNN-LSTM-Attention IDS is the most expensive. But the IDS inference is run at the edge on finite length windows and reduced model sizes. In practice, the scheduler allocates enough time to ensure that the IDS response time is under the response budget.

(5) Deployment feasibility

This system only keeps small model parameters, short-lived queues and session data. There does not need to be a huge historical data base for online operation. Thus, the proposed system is applicable to today's edge gateways with limited CPU and memory capacities.

(6) Practical interpretation

The extra control is minimal in comparison with security gains. Suppression of malicious requests at an early stage wastage of processing is reduced and adaptive scheduling better uses shared resources. This allows the framework to be feasible for time critical IoT applications. Table 3 represent the computational overhead, resource usage and feasibility of framework.

Figure 2. AI-driven latency-security co-design framework structure

This section experimentally evaluates the proposed latency–security co-design framework under realistic and adversarial IoT workloads. The experiments are explicitly designed to validate the analytical guarantees with particular emphasis on bounded end-to-end security latency, resilience to authentication flooding, robustness of intrusion detection under congestion, and scalability to large-scale IoT deployments.

7.1 Experimental setup and baseline configuration

The experimental evaluation is conducted using a hybrid testbed consisting of a Python-based edge gateway prototype and NS-3 for large-scale network emulation. IoT devices generate authentication requests and traffic flows following both benign and adversarial patterns. Authentication flooding attacks are modeled as high-rate burst arrivals, while intrusion attempts are injected using mixed benign–malicious traffic traces.

The edge gateway implements AI-gated authentication, ECC-based access control, latency-aware joint scheduling, and a hybrid CNN-LSTM-Attention IDS. Unless otherwise specified, the maximum allowable end-to-end security latency is fixed at the value in Eq. (22):

$\tau=50 \mathrm{~ms}$                   (22)

which reflects the real-time requirements of latency-sensitive IoT applications.

To provide an objective and easily reproducible assessment, the proposed latency-aware security co-design framework is compared with representative baselines that are run under the same hardware, traffic and attack conditions. The IoT request traces, gateway resources, IDS backbone model, cryptographic module and performance metrics are identical among all methods. A different task and security orchestration approach is used.

The IDS-only baseline does not use AI-gated authentication and latency-aware joint scheduling, it merely passes requests to the intrusion detection engine. The same CNN-LSTM-Attention IDS model as the proposed framework is used to ensure model fairness. Users are monitored upon arrival, and the gateway's resources are mainly used for intrusion detection. No adaptive pre-filtering is applied, malicious authentication detection, it consumes more communication and queue resources. This baseline is the traditional detection-oriented baseline where the focus is on threat detection but not on collaborative authentication management.

This baseline priorities authentication, where each request is first authenticated using ECC and then is sent to the IDS for inspection. The authentication and IDS operations are performed in sequence and the adaptive scheduler is not invoked in case of high loads. The same ECC parameters and authentication algorithm as the proposed framework are maintained for a fair comparison. This represents the conventional access-control-first architecture in gateways where authentication is done before IDS. Due to the pipeline, waiting times and responsiveness of IDS may be affected under a bursty workload.

With static shared scheduling, authentication and IDS tasks share access to gateway resources with a static priority scheduling policy. The two modules are always enabled but the gateway does not dynamically adjust priorities as a function of queue growth, adversarial traffic load or latency violations. The authentication engine and IDS model are the same as that in the proposed framework but dynamic orchestration is turned off. This benchmark is designed to determine the value of scheduling based on workload and adaptive latency control.

Our design is a lightweight pipeline of AI-gated request filtering, ECC-based authentication, dynamic latency-aware joint scheduling and hybrid CNN-LSTM-Attention IDS inference at the edge. Malicious requests can be blocked prior to costly encryption, and authentication and IDS results can be prioritised to meet end-to-end deadline constraints. Establishing secure connections is only allowed once authentication and benign IDS predictions are successful.

The baseline methods are implemented as reference controlled configurations based on typical IoT gateway architectures found in previous research on authentication, IoT edge security and IDS. Instead of implementing a single external method, each baseline represents a typical operational strategy that's commonly applied in practice, thus allowing a clear and fair comparison with the proposed co-design framework. Table 4 shows the comparison between the baseline methods used in the experiments and proposed framework. The table shows differences in the authentication scheme, IDS deployment, scheduling mechanism and source.

7.2 End-to-end security latency and scalability

The primary performance metric is the end-to-end security latency, defined as

$T_{\mathrm{sec}}=T_{\mathrm{auth}}+T_{\mathrm{ids}}+T_{\mathrm{queue}}$                       (23)

Figure 3 illustrates the end-to-end security latency as a function of the number of connected IoT devices, while the corresponding numerical values are summarized in Table 5. The proposed framework consistently maintains in Eq. (24):

$T_{\sec } \leq \tau$                        (24)

Figure 3. End-to-end security latency vs. number of IoT devices

Table 5. End-to-end security latency measurements under variable IoT devices count

Even as the number of devices scales up to 10,000. In contrast, baseline schemes exhibit rapidly increasing latency due to uncontrolled queue growth. These results empirically validate the unified latency–security invariant and demonstrate scalability under increasing deployment density.

7.3 Resilience under adversarial and congested conditions

7.3.1 Resilience to authentication flooding

To evaluate robustness against authentication flooding attacks, the authentication arrival rate $\lambda_a$ is increased beyond the nominal service capacity of the edge gateway. With AI-gated authentication, the effective arrival rate is reduced is expressed in the Eq. (25):

$\lambda_a^{\prime}=\rho \lambda_a, 0<\rho<1$                 (25)

where,

• $\rho$: The acceptance ratio of legitimate requests
• $\lambda_a$: Authentication arrival rate
• $\lambda_a^{\prime}$: The effective arrival rate

Figure 4 shows authentication latency under adversarial flooding, with numerical results reported in Table 6. Authentication latency remains bounded as long as in the given condition Eq. (26):

$\lambda_a^{\prime}+\lambda_{\mathrm{ids}}<\mu$                     (26)

where, $\lambda_{\mathrm{ids}}$ denotes the IDS task arrival rate and $\mu$ is the gateway service rate. Furthermore, Figure 5 and Table 7 demonstrate that the authentication success rate for legitimate devices remains above 97% even under sustained flooding. These results confirm that AI-gated filtering suppresses malicious load without penalizing legitimate access, providing experimental validation.

Figure 4. Authentication latency under flooding attacks

Table 6. Authentication latency under flooding AI-gated authentication prevents flooding collapse

Figure 5. Authentication success rate vs. malicious request ratio

Table 7. Authentication success rate legitimate devices remain authenticated

7.3.2 Intrusion detection systems robustness under congestion

The impact of authentication load on IDS performance is examined by measuring IDS inference latency and detection accuracy under increasing authentication demand. Joint authentication–IDS scheduling ensures that IDS tasks are allocated a minimum execution share, preventing starvation.

Figure 6. Intrusion detection systems (IDS) inference latency under concurrent authentication load

Figure 6 reports IDS inference latency as authentication load increases, with detailed statistics provided in Table 8. IDS latency remains bounded even during peak authentication demand. Correspondingly, Figure 7 and Table 9 show that IDS detection accuracy remains above 95% under congestion. These observations confirm that congestion-induced IDS evasion windows do not arise, thereby empirically validated.

Table 8. Intrusion detection systems (IDS) inference latency vs. authentication

Figure 7. Intrusion detection systems (IDS) detection accuracy under congestion

Table 9. Intrusion detection systems (IDS) detection accuracy in various gateway loads under congestion

7.3.3 Timing side-channel suppression

To evaluate resistance to timing side-channel attacks, the distribution of end-to-end security latency is analyzed under adversarial traffic patterns. Figure 8 presents the cumulative distribution function (CDF) of $T_{\mathrm{sec}}$, with statistical summaries reported in Table 10.

Figure 8. Latency distribution (cumulative distribution function) of security response time

Table 10. Latency distribution statistics

The absence of long-tail behavior indicates tightly bounded latency and statistically indistinguishable security responses. Formally, the observed latency variance satisfies the condition as in Eq. (27):

$\operatorname{Var}\left(T_{\mathrm{sec}}\right) \leq \sigma_{\max }$                    (27)

for a small constant $\sigma_{\max }$. These results experimentally validate the timing side-channel mitigation in latency distribution and timing side-channel analysis.

7.4 Large-scale deployment feasibility and latency-security validation

To assess scalability under realistic network conditions, the proposed framework is deployed in an NS-3 environment with up to 10,000 simulated IoT nodes. Figure 9 illustrates latency and IDS performance at scale, while Table 11 summarizes the corresponding metrics.

The results show that bounded latency and stable detection accuracy are preserved even at large scale, confirming that in the Eq. (28):

$\operatorname{Pr}\left(T_{\sec } \leq \tau\right) \approx 1$                 (28)

under dense IoT deployments. This demonstrates the practical feasibility of the proposed framework.

Figure 9. Scalability analysis up to 10,000 Nodes (NS-3)

Table 11. Scalability up to 10,000 Nodes 10,000-node scalability validated

Finally, the satisfaction ratio of the unified latency–security invariant is evaluated across all experimental scenarios. Figure 10 and Table 12 show that in the given Eq. (29):

$\operatorname{Pr}\left(T_{\text {auth }}+T_{\text {ids }}+T_{\text {queue }} \leq \tau\right)=1$                 (29)

Figure 10. End-to-end security guarantee satisfaction ratio

Table 12. Latency guarantee satisfaction ratio

This result confirms that latency is consistently enforced as a best security constraint, directly supporting the analytical claims made.

7.5 Component-wise contribution analysis

To gain further insight into the results presented above, we also conduct a component-wise analysis by selectively turning off various components of the proposed framework while maintaining the same dataset, gateway resources, traffic traces and performance metrics. This analysis helps to understand the role of each component in establishing bounded latency, authentication resilience and in maintaining the intrusion detection performance.

Four configurations are considered:

• The proposed framework,
• The system without AI-gated authentication filtering
• A variant without dynamic scheduling, and
• A "cut-down" version without either. Running these variants with the same attacks allows us to better understand the effects of each design element.

After removing AI-gated filtering, all requests including suspicious and malicious traffic join the ECC authentication queue. This results in the waste of cryptographic computation resources, queue length growth and increased waiting times for legitimate devices during flooding attacks. While the correctness of the ECC authentication is not affected, the system responsiveness is compromised because the gateway is faced with more requests. These findings suggest the AI gate is the key factor in attacks suppression, queue length stabilization and guaranteed authentication delay under adversarial traffic scenarios.

Replacing dynamic scheduling with static execution with equal priorities for authentication and IDS tasks, causes these to compete for gateway resources without coordination. In access surges, too many resources are temporarily dedicated to access processing, leading to longer IDS inference task queue time. As a result, detection delays are prolonged and there is potential for slower detection of fast-moving attacks. Although the average performance is still satisfactory under light traffic, the congestion scenario shows that the adaptive scheduling outperforms the static scheduling. Hence, the scheduling module is the key component in providing deterministic latency and uninterrupted IDS service, even under varying traffic loads.

The greatest performance gain is made by a combination of AI gating and scheduling. The initial screening of requests reduces waste of encryption/decryption before the request is entered into the queue, while dynamic scheduling adjusts the scheduling policy to the run-time load of the gateway. The combination of the two avoids queue overflow, provides robust authentication service and avoids IDS starvation. Overall, the entire system has improved latency over other solutions, especially in DoS and massive device contention.

The hybrid IDS model largely impacts detection accuracy, rather than queue size. The CNN layer extracts local spatial features, the LSTM layer learns the temporal characteristics of attacks and the attention layer focuses on the most relevant features during the testing phase. This explains why the detection accuracy exceeds 95%, even for increasing workloads. The scheduler, meanwhile, guarantees the enhanced model can still meet the real-time requirements.

Our experimental results demonstrate that the reported gains are not due to any individual module. Rather, improvements are due to synergies between lightweight pre-authentication filtering, scheduling, and high-quality hybrid IDS. The AI gating mainly alleviates malicious traffic, scheduling ensures bounded latency in contention, and the hybrid IDS ensures good detection accuracy. Thus, their co-operation is crucial for resilient, scalable, and deterministic security of IoT with edge support. Table 13 shows how different configurations of the framework affect the latency, IDS accuracy and resilience against flooding. It illustrates the role of each module of the proposed framework.

Table 13. Component contribution and configuration performance comparison

The experimental findings indicate that the offered latency security co-design framework can consistently maintain a limited end-to-end security latency, is resistant to authentication flooding, and avoids IDS evasion in congested environments, as well as can effectively scale to being used in large IoT systems. In all the considered situations, the framework upholds the latency security invariant, where the response time to security is deterministic even during adversarial loads. The proposed methodology provides a reduction of 3548 percentage points in worst-case end-to-end latency over baseline alternatives, such as the use of IDS-only and authentication-primary strategies, mainly because of early AI-controlled request suppression and latency-constrained joint scheduling. It has been shown that authentication strength is much stronger with genuine device success rate of over 97 percent when there are flooding attacks. In the same manner, the performance of intrusion detection accuracy is beyond 95 percent in congestion, but baseline systems have significant degradation caused by uncontrolled task contention and IDS starvation. The framework ensures latency bounding to remove timing side-channel leakage and maintain cryptographic forward secrecy. Large-scale NS-3 simulations also support the scalability of up to 10,000 IoT nodes in practice, and beyond what competitive architectures could support. Altogether, the joint experimental and comparative findings confirm the fact that the treatment of latency as the primary-class security primitive is the key to resilient, scalable, and deterministic security of edge-assisted IoT IDS (Table 14).

To test its stability under the worst-case scenarios, we also conduct a stress-test experiment under multiple adversarial flooding, high traffic load at the gateway and high device density. This is to verify if it maintains low latency and detection performance under a number of adverse conditions. Here, we simulate authentication bursts while increasing IDS traffic complexity and number of devices up to the maximum scale. There is a significantly smaller increase in the size of the queue for the proposed framework compared to other schemes, thanks to AI-gated filtering and scheduling. These findings show that this worst-case latency is below the allocated response time budget for the tested scenarios, and that the authentication success rate for legitimate devices and IDS remain constant. In contrast, the baseline schemes have increased delay and delay responsiveness. These results demonstrate that the proposed approach is effective under normal and worst-case adversarial scenarios. Table 15 shows the results of the proposed method and baselines in normal, flooding, congestion and stress scenarios. It demonstrates the proposed method has low latency and high IDS accuracy.

Table 14. Summary and ComparatiDve evaluation of the proposed framework