IoT, one must presume, uses Internet Protocols. Consequently, at least in principle, any authentication and/or encryption would use standard IP techniques, such as IPsec or perhaps Transport Layer Security (TLS).
Once familiar with the concepts described in RFCs 4301-4306, especially the framework document, you might be able to make the case that these techniques are "too hard" for such simple devices, and that something else might be preferable.
So for example, this might also depend on where these IoT devices are located. If they are inside the home, only connected via the home network, how much authentication would you need? Also, if they are in the home and they are aggregated by some box, and the box connects to the home network, how much authentication do you need from each individual IoT sensor?
If you want the home sensors made available when you're outside the home, what types of solutions could you use? Would you expect the individual home sensors to authenticate themselves, or is there a more expeditious way of achieving some measure of security protection?
So there are many avenues to take, I think. But first, I would get familiar with the security protocols.