SAFHE-Edge: A Raspberry-Pi-Validated Adaptive Homomorphic-Encryption Security Controller for IoT-Edge Intrusion Detection

Abstract

Homomorphic encryption (HE) protects network-flow features during outsourced intrusion-detection inference but can miss edge deadlines. SAFHE-Edge routes each flow to sparse CKKS, full CKKS, a depth-2 protection proxy, or quarantine. A training-derived calibration split selects the sparse-routing threshold under one-sided 95% confidence constraints on teacher agreement and false-benign disagreement. A transparent policy combines calibrated attack probability, queue wait, a flow deadline, and frozen Raspberry Pi p95 service profiles. An energy-free MDP and literature-adapted Double-Q serve as baselines. On held-out distributions, sparse CKKS covered 11.79% of Edge-IIoTset and 45.95% of CICIoT2023 flows with about 99.66% teacher agreement and no observed incremental false-benign decision. Randomized same-session Raspberry Pi 4 measurements of 2,000 samples per dataset reduced mean latency versus full CKKS by 2.82% (95% CI, 2.48–3.19%) and 22.01% (21.00–23.09%). A live-queue hardware-in-the-loop study executed 120 runs (60 matched policy pairs) and 24,000 requests. Across traffic regimes, the final controller increased protection-compliant timely service by 40.57 and 26.65 percentage points, increased attack-secure handling by 27.58 and 24.00 points, and reduced admitted p95 response time by 647.57 and 815.22 ms. All nonzero regime-level primary effects remained significant after Holm correction. A 25-configuration robustness study showed that conservative perturbations preserved protection compliance, whereas permissive thresholds increased under-protected admissions. Electrical energy was neither measured nor estimated; no result uses assumed power.