The fast expansion of IoT devices in smart healthcare, industrial automation, and urban infrastructure has increased real-time data generation to unprecedented levels [1]. Scalable, low-latency, and secure architectures are needed to manage such large and heterogeneous data. Traditional cloud-centric IoT solutions are good for storage and computing, but centralised authentication and static encryption cause network delays, energy inefficiencies, and data leaks [2]. Due to cyber threats' sophistication and IoT devices' resource restrictions, adaptive and intelligent solutions that can dynamically alter security methods in real time are needed [3].

 Previously, medications, medical reports, and administrative information were stored on paper.  This data storage method has many issues. It only supports manual upgrades and no data sharing [4].  These reports were so numerous that to needed a specialised repository.  Locks, ID cards, and sign-in/sign-out processes restricted report access.  Digitalisation has changed healthcare availability and quality in recent decades.  Electronic health systems are now widely used due to communication technology advances.  Paper was once the main way to store patient data such prescriptions, test results, administrative and financial records, etc. This method had limited utility back then [5].  Because paper records were non-sharable and isolated, healthcare practitioners couldn't collaborate or provide continuity of care.  [6].  Manually updating these records was time-consuming and error-prone.  The massive number of records accumulated over time required separate facilities or warehouses to archive them.  Managing vast physical archives made it harder to deliver important healthcare services because finding records can take time.  Basic security features like locks, ID cards, and sign-in/out processes protected these records.  These precautions were convenient, but they didn't deter intruders or mitigate natural disasters like floods and fires.  Digitisation has changed healthcare data management in recent decades [7].  This shift has considerably enhanced healthcare uniformity and accessibility by removing paper-based record-keeping inefficiencies.  ICT developments have enabled widespread adoption of e-health systems, transforming healthcare delivery.  Electronic health, often known as eHealth or e-healthcare, uses information besides communication technologies to expedite, secure, and personalise healthcare.  E-health systems rely on the Electronic Health Record (EHR) to store medical evidence [8]. EHRs combine data from multiple sources. These include lab results, x-rays, prescriptions, and clinician notes.  This consolidation allows clinical experts globally to access medical data in real time, ensuring all vital information is available.  EHRs streamline patient record transmission between healthcare providers, improving communication, teamwork, and decision-making [9].

 This paper offers an AIFBF that incorporates distributed intelligence and decentralised trust into IoT–cloud systems to address these limitations. The system uses a fog computing layer to implement adaptive hybrid encryption utilising MHC, which balances computational load and security with ChaCha20 and Ascon lightweight algorithms. DRL controllers determine encryption techniques based on data sensitivity and threat levels in real time. Blockchain-based smart contracts provide a Federated Authentication Protocol (FAP) that eliminates centralised trusted authorities and improves multi-domain access management. A LIDM employing Bi-GRU with Attention detects network anomalies to improve data integrity [10].

 Intelligent fog-based processing improves IoT data transfer security, privacy, latency, and energy usage. Simulations show that the AIFBF surpasses multifactor authentication–based cloud–IoT models in computational efficiency, encryption performance, and system scalability.

Related works

Survey and designs for Fog–Blockchain IoT security presented by Alzoubi YI et al. Several surveys and applied studies demonstrate that integrating blockchain with fog/edge computing improves IoT decentralised trust, tamper-evidence, and access control while reducing latency compared to cloud-only solutions These works show that distributed ledger techniques can protect fog nodes and coordinate cross-domain IoT access, but they either (a) focus on storage/immutability and neglect adaptive data-plane security (encryption tradeoffs) or (b) evaluate conceptually without AI-driven runtime adaptation.

  Premakumari SB et al. provide reinforcement-learning (RL)/adaptive encryption for restricted networks [12].   Recent RL-based techniques dynamically select encryption strength or modes based on network state and estimated danger levels, saving energy and latency. These studies confirm the MDP/RL formulation for encryption adaptation, but they are often limited to small WSN testbeds or single encryption families (e.g., toggling symmetric key lengths) rather than switching between complementary lightweight primitives (AE vs stream cypher) in a fog–cloud pipeline

 Radhakrishnan I et al. compare lightweight cryptography (Ascon, ChaCha20, SPECK, AES-128) [13].  Compared to recent lightweight primitives (ASCON, now ISO standardised for LWC, ChaCha20 family, SPECK, AES-128 variations), newer LWC candidates (Ascon family) frequently offer better performance/security on restricted systems. Most comparative studies evaluate single primitives without considering hybrid techniques (splitting sensitive payloads or using per-packet algorithms) or how algorithm choice affects fog-based preprocessing and IDS feedback.

 Bhasker B et al. [14] proposed decentralised authentication and blockchain smart-contract access control.  Recent suggestions decentralise IoT/healthcare authentication and access control using blockchain smart contracts and federated architectures or learning. While these methods decrease single-point-of-failure risk from a centralised TA and enable cross-domain policy enforcement, they generally overlook fog layer latency/consensus costs and do not integrate authentication outcomes with adaptive encryption decisions in real time.

 Xiang Y et al. provide deep-learning IoT intrusion detection using GRU/Bi-GRU and hybrid models [15].  There is accumulating evidence that RNN variants (GRU, Bi-GRU) and hybrid CNN–RNN ensembles detect IoT intrusion datasets with high detection rates. Attention methods improve temporal focus on abnormal patterns. Fewer IDS designs use lightweight Bi-GRU+ because many run centrally or in the cloud, increasing reaction time. For real-time network policing and adaptive encryption controller feedback, focus on fog.

 Caiza G et al. evaluate fog/edge performance (latency, energy, simulation) [16].  Studies utilising fog/edge simulators (iFogSim, EdgeCloudSim) show that fog-based computing offloads enhance latency and energy compared to cloud-only solutions, but they also show tradeoffs: fog nodes must balance scheduling and security due to resource constraints. Most performance studies analyse static security settings, not the system-level latency and energy impact of dynamic encryption switching + blockchain authentication overhead.

 Algorithm Design and Pseudocode

Algorithm 1 DRL Controller (Training)

Training vs Inference: heavy training occurs in cloud; fog nodes host compressed inference models. Retrain periodically using cloud-collected labels and metrics.

Model compression: use pruning + 8-bit quantization; consider knowledge distillation for tiny fog representations.

Blockchain: use permissioned ledger (Hyperledger Fabric, Quorum) to keep consensus latency low; store only hashes and access policies on-chain.

 Fallback policy: define safe default (e.g., Ascon) when DRL is unavailable or uncertain.

Evaluation metrics: encryption time, decryption time, latency, energy, security strength, IDS accuracy (TPR/FPR), blockchain tx latency.

 Security and Performance Advantages

AHEM ensures that each data packet is protected according to its sensitivity and threat environment. A DRL controller dynamically selects ChaCha20, Ascon, or dual-layer encryption to safeguard high-risk data without overusing cryptographic processes. Blockchain smart contracts use the Federated Authentication Protocol (FAP) to provide decentralised trust, tamper-resistant identity records, and transparent access control. With its Bi-GRU besides Attention design, the LIDM detects fog layer anomalies in real time, allowing quick responses to threats including spoofing, denial-of-service, and unauthorised access. IDS feedback plus blockchain tracking offer audit-ready, non-repudiable, traceable environment.

 The fog computing layer processes encryption, authentication, and intrusion detection locally instead of sending raw data to the cloud, plummeting connection latency. adaptive mechanisms optimise computation overhead besides security strength, decreasing encryption load on resource-limited IoT devices. Energy-efficient lightweight cryptography makes the framework ideal for battery-powered IoT nodes. Public blockchains take longer to reach consensus, but permissioned blockchains allow quick authentication cycles. For continual system optimisation, the cloud layer provides large-scale analytics and model retraining without burdening fog nodes. The AIFBF design improves latency, throughput, energy economy, and system security, making it perfect for real-time and large-scale IoT applications including healthcare monitoring, industrial automation, and smart city deployments.

Experimental results

The AI-driven Fog–Blockchain Framework (AIFBF) was tested in NS-3, EdgeCloudSim, and a private Hyperledger Fabric blockchain testbed.  NS-3 might show the network topology with 150 to 600 IoT nodes communicating via MQTT and CoAP protocols at regular intervals and in reaction to events.  Each IoT device had its own sensitivity and transmission speed to simulate smart healthcare and industrial contexts.  EdgeCloudSim deployed fog nodes using virtualised Raspberry Pi 4–equivalent hardware (4 GB RAM, quad-core ARM CPU). This allowed fog-level processing, energy utilisation, and latency accuracy.  To trained the Deep Reinforcement Learning (DRL) controller and Bi-GRU with Attention intrusion detection module (LIDM) offline on a cloud GPU workstation (NVIDIA RTX 3090, 64 GB RAM) with real and false IoT datasets. They are compressed (8-bit quantised) and placed on the fog layer.  This blockchain layer employed RAFT consensus on a three-peer Hyperledger Fabric network. Smart contracts retained identity verification logs using FAP. IoT devices, fog nodes, and blockchain peers communicated over TLS.  Each of the 50 studies had a distinctive burden, such as burst traffic, movement patterns, and enemy attacks.

Table 1. Comparison of Latency, Throughput, and Energy Consumption

Table 1 compares end-to-end latency, throughput, and energy consumption of three popular IoT security designs. The Traditional Cloud IoT architecture with AES encryption has the highest latency at 218 ms since all data are sent straight to the cloud for processing, causing network delays. Despite its low throughput (3.8 Mbps) due to centralised traffic processing, IoT devices consume the most energy (12.4 mJ per packet) due to long-range connections with cloud servers. As some processes are dispersed over private and public clouds, the Hybrid Cloud + Multifactor Authentication (MFA) system, the baseline from the base paper, performs moderately better with 164 ms latency and 5.1 Mbps throughput.

 Devices connect less with the cloud, reducing energy consumption (9.8 mJ). Due to lower computational cost and more effective local processing, the Lightweight IoT method with static lightweight cryptography (LWC) enhances system responsiveness to 139 ms latency and 5.7 Mbps throughput. Lightweight encryption reduces device power consumption to 8.4 mJ. The table shows that moving processing closer to the network edge and using lightweight cryptographic techniques improves system performance and energy efficiency.

Table 2. Encryption and Authentication Performance

Table 2 analyses IoT security mechanisms' encryption and authentication performance by encryption time, decryption time, authentication delay, and security strength. Due to its larger block-cipher operations, Traditional AES-128 takes 6.9 ms to encrypt and 6.7 ms to decrypt. It uses centralised authentication servers, which slows its authentication response time to 79 ms. Due to its optimised round structure and lower computational cost, the original paper's RC6–AES hybrid technique encrypts (5.2 ms) and decrypts (5.3 ms) faster. Although it decreases authentication delay to 67 ms, centralised verification restricts further improvement. Lightweight Cryptography (LWC) employing Ascon only reduces encryption and decryption times to 3.8 and 3.9 ms, respectively. AIFBF, which combines ChaCha20 and Ascon with a DRL controller for adaptive encryption, performs best. Intelligently picking lightweight algorithms depending on data sensitivity and real-time conditions gives this system the fastest encryption (3.1 ms) and decryption (3.2 ms). The blockchain-based Federated Authentication Protocol (FAP) eliminates centralised delays, speeding authentication to 48 ms. Dual-layer encryption, adaptive algorithm switching, and tamper-proof blockchain authentication boost security to 94%.

Table 3. Intrusion Detection Performance (LIDM vs Existing IDS)

Because it uses predefined attack signatures and struggles to identify new or evolving threats, the Signature-Based IDS has the lowest detection accuracy at 81.5% in Table 3. Its false positive rate is the greatest (8.4%), showing frequent misclassification of regular traffic as malicious, but its detection time (14 ms) is fast due to basic lookup procedures. Learning from traffic patterns improves the Classical Machine Learning IDS's accuracy (89.2%), but its inability to simulate complicated temporal behaviours leads to a moderate false positive rate (6.7%) and somewhat longer processing time (19 ms). Recurrent design captures long-term network traffic dependencies, giving the LSTM-based IDS 94.5% detection accuracy.

LSTM models are longer to compute, resulting in a 22-ms detection time and a 4.9% false positive rate. The Proposed LIDM (Bi-GRU + Attention) has the highest accuracy at 98.3% because to the Bi-GRU's capacity to learn forward and backward temporal patterns and an attention mechanism for emphasising essential traffic aspects. The lowest false positive rate (3.1%) indicates very reliable classification. LIDM has a competitive detection time (17 ms) due to its lightweight fog deployment architecture while using more complex techniques.

By merging adaptive hybrid encryption, decentralised authentication, and fog-level intelligence, the AI-driven Fog–Blockchain Framework (AIFBF) overcomes the main drawbacks of cloud-centric IoT security systems A dynamic, context-aware security mechanism for highly heterogeneous IoT environments is provided by ChaCha20–Ascon–based hybrid lightweight cryptography, a Deep Reinforcement Learning (DRL) controller, and a Bi-GRU with Attention–enabled Lightweight Intrusion Detection Module (LIDM). A Federated Authentication Protocol (FAP) implemented via blockchain smart contracts removes single-point authentication failure and ensures transparent and tamper-resistant identity management across different IoT domains. NS-3, EdgeCloudSim, and a Hyperledger Fabric testbed show that AIFBF improves latency, energy efficiency, encryption speed, authentication delay, and intrusion detection accuracy. The results show that the suggested organization improves security resilience and operational performance, making it scalable and future-ready for real-time IoT applications infrastructure. AIFBF provides a strong, intelligent, and decentralised security mechanism for next-generation IoT ecosystems.

1.     Aljrees T, Kumar A, Singh KU, Singh T. Enhancing IoT security through a green and sustainable federated learning platform: leveraging efficient encryption and the quondam signature algorithm. Sensors. 2023 Sep 26;23(19):8090.

2.     Goyal NK. Security and Privacy in IoT, Fog, and Blockchain Networks. InEnergy-Efficient Deep Learning Approaches in IoT, Fog, and Green Blockchain Revolution 2025 (pp. 371-398). IGI Global Scientific Publishing.

3.     Ogunsanya VA. Securing IoT, Fog, and Blockchain: A Privacy-Centric Approach. InEnergy-Efficient Deep Learning Approaches in IoT, Fog, and Green Blockchain Revolution 2025 (pp. 283-306). IGI Global Scientific Publishing.

4.     Kaleem S, Sohail A, Babar M, Ahmad A, Tariq MU. A hybrid model for energy-efficient Green Internet of Things enabled intelligent transportation systems using federated learning. Internet of Things. 2024 Apr 1;25:101038.

5.     Khan NS, Mir RN, Chishti MA. BEFF-SIGS: blockchain-enhanced fog framework-securing IoT data integrity and green sustainability through scalable authentication-authorization. International Journal of Computers and Applications. 2025 Mar 4;47(3):293-311.

6.     Khashan OA, Khafajah NM. Efficient hybrid centralized and blockchain-based authentication architecture for heterogeneous IoT systems. Journal of King Saud University-Computer and Information Sciences. 2023 Feb 1;35(2):726-39.

7.     Pavithra HC, Rajeshwari J. A Comprehensive IoT Security Framework Empowered by Machine Learning. In2024 3rd Edition of IEEE Delhi Section Flagship Conference (DELCON) 2024 Nov 21 (pp. 1-8). IEEE.

8.     Czarnul P, Antal M, Baniata H, Griebler D, Kertesz A, Kessler CW, Kouloumpris A, Kovačić S, Markus A, Michael MK, Nikolaou P. Optimization of resource-aware parallel and distributed computing: a review. Journal of Supercomputing. 2025 May 9;81(7).

9.     Beebe NH. A complete bibliography of publications in computer networks (Amsterdam, Netherlands: 2020–2029). A neutrosophic approach to edge-based anomaly detection in smart farming systems. 2022 Jun 13.

10.   Ramanujam V, Murugesan JS, Shanmugaraj M, Rajasekar P, Rajarajan SL. Hybrid encryption technique for efficient energy conservation of IoT devices. InAIP Conference Proceedings 2025 Apr 25 (Vol. 3258, No. 1, p. 020016). AIP Publishing LLC.

11.   Alzoubi YI, Gill A, Mishra A. A systematic review of the purposes of Blockchain and fog computing integration: classification and open issues. Journal of Cloud Computing. 2022 Nov 19;11(1):80.

12.   Premakumari SB, Sundaram G, Rivera M, Wheeler P, Guzmán RE. Reinforcement Q-Learning-Based Adaptive Encryption Model for Cyberthreat Mitigation in Wireless Sensor Networks. Sensors. 2025 Mar 26;25(7):2056.

13.   Radhakrishnan I, Jadon S, Honnavalli PB. Efficiency and security evaluation of lightweight cryptographic algorithms for resource-constrained IoT devices. Sensors. 2024 Jun 20;24(12):4008.

14.   Bhasker B, Rao PM, Saraswathi P, Patro SG, Bhutto JK, Islam S, Kareemullah M, Emma AF. Blockchain framework with IoT device using federated learning for sustainable healthcare systems. Scientific Reports. 2025 Jul 23;15(1):26736.

15.   Xiang Y, Li D, Meng X, Dong C, Qin G. ResNeSt-biGRU: An Intrusion Detection Model Based on Internet of Things. Computers, Materials & Continua. 2024 Apr 1;79(1).

16.   Caiza G, Saeteros M, Oñate W, Garcia MV. Fog computing at industrial level, architecture, latency, energy, and security: A review. Heliyon. 2020 Apr 1;6(4).