Enhanced lightweight and secure certificateless authentication scheme (ELWSCAS) for Internet of Things environment

Internet of Things 24 (2023) 100923 Available online 9 September 2023 2542-6605/© 2023 The Author(s). Published by Elsevier B.V. This is an open access article under the CC BY license (http://creativecommons.org/licenses/by/4.0/). Research article Enhanced lightweight and secure certificateless authentication scheme (ELWSCAS) for Internet of Things environment Usman Ali a , b , * , Mohd Yamani Idna Bin Idris a , c , * , Jaroslav Frnda d , e , Mohamad Nizam Bin Ayub a , Muhammad Asghar Khan f , Nauman Khan a , g , h , Rehannara Beegum T a , Ahmed A. Jasim i , Insaf Ullah f , Mohammad Babar j a Department of Computer System and Technology, Faculty of Computer Science and Information Technology, Universiti Malaya, Kuala Lumpur 50603, Malaysia b Department of Computer and Software Technology, University of Swat, Charbagh Swat, 19120, Khyber Pakhtunkhwa, Pakistan c Center for Research in Mobile Cloud Computing, University of Malaya, Kuala Lumpur 50603, Malaysia d Department of Quantitative Methods and Economic Informatics, Faculty of Operation and Economics of Transport and Communications, University of Zilina, 01026, Zilina, Slovakia e Department of Telecommunications, Faculty of Electrical Engineering and Computer Science, VSB Technical University of Ostrava, 70800, Ostrava, Czech Republic f Faculty of Engineering Sciences and Technology, Hamdard University, Islamabad Campus, Pakistan g College of Computer and Information Sciences, Prince Sultan University, Riyadh 11586, Saudi Arabia h Department of Computer Science & Information Technology, University of Malakand, Chakdara Dir Lower, 18800, Khyber Pakhtunkhwa, Pakistan i College of Engineering, University of Baghdad, Baghdad, Iraq j Department of Computer Science, Abbottabad University of Science and technology, Havalian, Khyber Pakhtunkhwa, Pakistan ARTICLE INFO Keywords: Authentication AEAD Constrained devices Elliptic curve cryptography Internet of things (IoT) Security ABSTRACT The Internet of Things (IoT) is a fast-growing technology that enable existing systems to communicate with one another by using new devices such as sensors and other smart devices. The IoT devices such as wireless sensors and other smart devices are often very cheap, very small, and have limited power sources, memories, and processing capabilities. These devices are used in numerous critical applications, in which confidential information is sent across wireless channels among other devices participating in the system. This communication is vulnerable to multiple cyber-attacks due to the insecure wireless channel between them and without strong security mechanism, the important credential can be stolen by network attackers. One of the most important aspects of securing IoT communication is the authentication mechanism, used to validate the identity of authorized devices and users in IoT networks and to ensure data confidentiality, integrity, and authenticity for secure communication. Several authentication schemes for IoT environment have been proposed in the literature, none of these approaches entirely fulfil the necessary security and lightweight feature requirements. Some schemes fulfill the required security features but are unable to provide lightweight features. Similarly, other schemes provide lightweight features, but their security features are unsatisfactory. Therefore, it is necessary to design an effective security mechanism to ensure secure communication in IoT environments. In this paper, we propose Authenticated Encryption with Associated Data (AEAD) and Elliptic Curve Cryptography (ECC) based Enhanced Lightweight and Secure Certificateless Authentication Scheme (ELWSCAS) for IoT environment to fulfill the required security and lightweight * Corresponding authors. E-mail addresses: [email protected] (U. Ali), [email protected] (M.Y.I.B. Idris). Contents lists available at ScienceDirect Internet of Things journal homepage: www.sciencedirect.com/journal/internet-of-things https://doi.org/10.1016/j.iot.2023.100923 Internet of Things 24 (2023) 100923 2 performance features. The security of the proposed solution is evaluated using formal and informal security analysis. For formal security analysis we used RoR model and AVISPA tool. We have implemented the proposed solution in network simulator (NS3.35) by using Python and C++ to measure the network parameters such as throughput and packet delivery ratio (PDR). The computational and communication cost of the proposed scheme shows that in comparison to the existing state-of-the-art, our approach is considerably less costly and is a viable option for constrained IoT environment. 1. Introduction The IoT is a fast-growing technology that enable existing systems to communicate with one another by using new devices such as sensors and other smart devices [1–4]. The IoT devices such as wireless sensors and other smart devices are often very cheap, very small, and have limited power sources, memories, and processing capabilities. These devices are used in numerous critical applications, in which confidential information is sent across wireless channels among other devices participating in the system. This communication is vulnerable to multiple cyber-attacks due to the insecure wireless channel between them and without strong security mechanism, the important credential can be stolen by network attackers [5]. One of the most important aspects of securing IoT communication is the authentication mechanism, used to validate the identity of authorized devices and users in IoT networks and to ensure data confidentiality, integrity, and authenticity for secure communication. In authentication, any two legitimate entities reach a consensus on a common secret key and implicitly trust the authenticity of each other. The information to be sent by an entity is encrypted using the agreed secret key, and the recipient entity then decrypts the data using the same agreed secret key. Authentication techniques based on computationally expensive cryptographic algorithms are difficult to implement in resource constrained devices because they lack the needed processing power, memory, and storage. Since resource-constrained devices are unable to carry out standard cryptographic techniques, ensuring security and privacy in the IoT becomes a serious challenge. On the other hand, a cryptographic solution that enables the authentication of unencrypted data is necessary for many applications. Even if the information received is not confidential, message authentication mechanisms must nevertheless be used to guarantee data integrity and authenticity. Since the acceptance of wrong data (produced either for malicious purposes or by natural causes) could result in misguided actions and serious consequences. A security is considered best when the confidential data is secured (confidentiality) and remained unchanged (integrity). Encryption provides just confidentiality and no integrity or authenticity. Ciphertext is pliable to undetectable modifications as changes can be made to it, leading to undesirable results at the receiving end. One substantial reason for this is that encryption alone cannot guarantee secure communication: without having the secret key, attackers are incapable of retrieving the plaintext from ciphertext. However, attackers can still change some bits of ciphertext. Applications based on constrained IoT devices such as wireless sensors, have been rapidly growing. Authentication protocol based on lightweight cryptographic methods are highly required for such resource-constrain devices. The conventional cryptographic techniques have high computational and communication cost and high storage requirements. Further, authentication schemes based on conventional cryptographic methods such as AES and SHA-256 are not recommended for IoT environment due to limited computational and memory capabilities [6,7]. Although AES and SHA work well within computer systems, they are not well suited for use in the IoT since they need an exorbitant amount of computational power, physical space, and battery capacity [8]. In the IoT, devices that are limited in their resources are not intended to carry out costly cryptographic calculations. Constrained IoT devices are not capable of carrying out excessive computations associated with conventional cryptographic algorithms. As such, lightweight authentication protocols that need less memory and computational resources are preferred for constrained devices. To guarantee security in environments where power and area are at a premium, the focus has changed from conventional encryption algorithms like AES to explicitly lightweight algorithms. Most of the recent lightweight algorithms are based on AEAD cryptosystem, which can provide both confidentiality through encryption as well as integrity (the guarantee that the data has not been modified) and authenticity (the guarantee that the data originated from a particular entity) to protect data from modification [9]. Furthermore, security is not compromised in lightweight cryptographic algorithms, and key lengths must still be at least 128 bits, matching AES-128. Lightweight cryptographic algorithms are intended to function within the resource constrained environment found in sensors and embedded devices having less RAM and fewer registers than general-purpose counterparts. Although several authentication and key agreement (AKA) techniques IoT environment have been presented in the literature, none of these approaches entirely fulfil the necessary security and lightweight feature requirements. Some schemes fulfill the required security features but are unable to provide lightweight features. Similarly, other schemes provide lightweight features, but their security features are unsatisfactory. Thus, for the authentication scheme to be deployed effectively into the IoT networks, it must satisfy both security and lightweight performance features. The techniques proposed in [10–18] are among the most recent and efficient schemes considered in this research. However, they provide no integrity checks on whether messages are modified in transit which allows an attacker to compromise the integrity of the transmitted messages. More importantly, the computational and communication costs of all the schemes in [10–18] need to be reduced for optimal lightweight features. To address the issues of current authentication schemes for IoT environment, we propose AEAD and ECC based Enhanced Lightweight and Secure Certificateless Authentication Scheme (ELWSCAS). In the proposed solution, we have used certificateless authentication (CA) which is based on the concept of Certificateless Public Key Cryptography (CPKC) [19–21] that allow secure communication without the need for a digital certificate. The advantage of using the CA is that it eliminates the need for a trusted third party to issue and manage digital certificates, which can be a cumbersome and expensive process. We have also used Ascon cipher suit [22] for AEAD and elliptic curve Curve-25,519 U. Ali et al. Internet of Things 24 (2023) 100923 3 [23] for key agreement in the proposed solution. 1.1. Motivation and contribution The lightweight authentication mechanism for resource constrained IoT devices is still an open research area attracting the interest of many researchers. The current authentication schemes are either based on heavyweight cryptographic methods or compromise essential security requirements for IoT networks. To meet the security needs of constrained IoT environment, identifying appropriate cryptographic methods plays a critical role in designing authentication protocols because conventional standardized public-key and symmetric cryptographic primitives are not feasible for such environment due to their high computational complexity. Moreover, limited resources of IoT devices demand lightweight authentication protocols. We list the following as our main contributions. •We designed an ELWSCAS based on AEAD and ECC. •We demonstrated that our proposed method incorporates all the necessary security measures, such as confidentiality, authentication, integrity and forward security. •We demonstrated that our proposed method ensures security against various attacks such as man-in-the-middle (MitM), reply, impersonation, denial of service (DoS) and key compromise (KC) attacks. •We used various rigorous security analysis approaches such as formal and informal security analysis in order to ensure that our suggested system is secure. For formal security analysis we used Real-Or-Random (ROR) model and Automated Validation of Internet Security Protocols and Applications (AVISPA) tool. •The results of the proposed ELWSCAS validate its effectiveness in terms of the computational cost and communication cost. •Finally, the PDR and Throughput in the NS3 simulation show the viability and practicality of the proposed solution. 1.2. Structure of the paper The remainder of the paper is structured as follows. The related work is summarized in Section 2. The preliminaries are discussed in Section 3. The proposed authentication scheme is described in Section 4. Security analysis is presented in Section 5. The comparative analysis is shown in Section 6, and finally the conclusion and future work is presented in Section 7. 2. Related work IoT devices that have limited resources, such as wireless sensor nodes, and embedded systems, are widely employed in a variety of important applications. Due to the widespread usage of such devices in the contemporary computer world, ensuring data security is becoming one of the most critical needs. This is because the insecure wireless communication between these devices leaves it open to the possibility of severe assaults. Authentication protocols are one of the most essential elements of IoT network security because they provide identities to the legitimate users and devices that participate in the network. Li et al. [18] suggested an ECC-based authentication approach for secure communication in IoT, which preserves privacy with the goal of ensuring that sensitive sensor data can only be accessible to authorized users. However, their technique is susceptible to Dos and MitM attacks and it does not guarantee un-traceability or the anonymity of sensor node identities. Furthermore, their scheme is also computationally expensive as it involves the computation of scalar multiplications, biometrics, and modulus operations. An enhanced key agreement technique was presented by Braeken et al. [17] to counter attacks such as MitM attacks, replay attacks, and impersonation using the DY threat model. However, their scheme is not successful in maintaining forward secrecy (FS). Gope et al. [24] suggested a lightweight two-factor authentication technique with PUF serving as one of the authentication factors. However, updating the CRPs in their scheme requires the execution of an extra phase, which raises the overall communication overhead of the authentication process. Tedeschi et al. [15] suggested a lightweight certificateless key agreement scheme suitable for constrained IoT devices. However, their scheme failed to detect an attacker impersonating a benign device. Garg et al. [16] developed an efficient lightweight AKA scheme that uses PUF to ensure physical security to IoT nodes. However, Bagheri et al. [11] discovered that any two communicating nodes in Garg et al scheme can be tracked by a passive attacker, which compromises the privacy of their location. On the other hand, an active attacker can compromise the integrity of the transmitted messages without being noticed by the system. In addition, Garg et al. scheme does not provide any kind of privacy protection for the keys, which makes it possible for an adversary to extract any shared session key from any pair of nodes. Li et al. [12] developed a certificateless public key cryptography (CL-PKC) based end-to-end mutual authentication and key agreement technique for the IoT environment by employing ECC and PUF. However, their technique does not provide user anonymity and un-traceability and resistance to MitM and privileged insider assaults. Further, the protocol needs sixteen rounds of elliptic curve scalar multiplication (ECSM), which greatly increases the processing cost of the protocol. Moreover, employing PUF necessitates extra hardware overhead. A three-factor authentication technique was developed by Wu et al. [13] for the purpose of establishing secret session keys for WSNs. The authors stated that their approach provided un-traceability, sensor anonymity, secret session key for all participates, mutual authentication and provide protection against known attacks. However, their scheme cannot guarantee perfect forward security. Lara et al. [25] suggested a lightweight authentication system for resource-constrained IoT devices by employing simply hash functions and XOR operations. Their approach offers a minimal execution time and communication cost, with just four messages sent between the participating entities during authentication process. However, according to [26], their protocol does not explain how the gateway maintains synchronization with the sensor node or how it can withstand synchronization assaults. This is a problem since synchronization is essential to the functioning of the system. Although the Lara et al. technique is lightweight, it does not U. Ali et al. Internet of Things 24 (2023) 100923 4 support the anonymity and un-traceability features, as stated in [27]. In addition, their system does not allow the dynamic addition of IoT smart devices after initial deployment. Gaba et al. [28] suggested a lightweight key agreement technique for the IoT environment in order to establish a secure session across an unsecure communication channel and prevent unauthorized nodes from accessing data and taking control of industrial equipment while physically away. However, their scheme is vulnerable to Cloning attack and Side-Channel attacks. Gupta et al. [29] suggested identity-based lightweight two-party authenticated key exchange strategy for the IoT Environment. The goal of the scheme was to make it possible for users and devices to connect safely and share sensitive information. However, there are some security issues by using long-term private keys in their scheme which is not secure in terms of identity authentication [30]. Liu et al. [14] suggested a lightweight three-factor based user authentication technique for the IoT environment. The protocol provides physical security through PUF by storing a single CRP for each sensor and requiring no extra step to update the CRPs. The protocol provides lightweight performance by using cryptographic operations such as XOR and hash function. A lightweight privacy-preserving technique was presented by Velliangiri et al. [31] for the Industry 4.0 by using ECC and other lightweight operations, including XOR and hash function, to guarantee the safety of data flow in vehicular-network. However, the protocol is based on certificates, and a public key-based certificate approach is not suitable for IoT devices with limited resources. This is due to the fact that using a public key-based certificate system causes more communicational and computational overheads when issuing, revoking, signing, and verifying certificates. Ding et al [32] suggested ECC-Signcryption based lightweight authentication technique for resource-constrained IoT devices to decrease client device computational and communicational cost while meeting security requirements. However, according to [33] Ding et al.’s described their whole protocol in terms of performance evaluations related to computational overhead and storage requirement without considering the vulnerabilities and attack scenarios in their proposed scheme. Fan et al [34] presented a symmetric authenticated key agreement approach to ensure perfect FS, message integrity, and key agreement in the IOT environment. The protocol only employs hash-function and XOR operation to achieve lightweight authentication. However, [35] claims that their approach is insufficient to protect attackers with malevolent intent. Wang et al. [36] suggested a PUF-based authentication technique to strengthen the protection of edge IoT nodes from desynchronization attacks. The protocol is lightweight by employing simple cryptographic operations, like XORs and hash functions. However, their approach was not successful in providing anonymity as well as protection against attacks such as the MitM assault, the sensor and gateway impersonation attack, and the replay attack. Rafique et al [37] developed a certificateless multi-factor AKA scheme for IoT environment, claiming the protocol is efficient and secure. The protocol employs symmetric cryptography, hash function and bitwise XOR operation to allow a valid user to remotely access the sensing devices. Zheng et al. [10] presented PUF-based authentication and key agreement technique for peer-to-peer IoT applications. Their method enables two resource-constrained IoT devices to authenticate one another and to establish the session key without having to rely on the public-key algorithm and without the need for the local storage of challenge and response pairs (CRPs) or any other type of private secret. However, because of the accessibility of IoT devices, the need to safeguard and maintain a database of challenge-response pairs for all providers in the local memory of verifiers is not only difficult to satisfy with constrained IoT devices, but it is also vulnerable to hardware attacks [38]. Tanveer et al [39] developed an efficient authentication scheme for IoT environment by using hash function lightweight AEAD primitive, named AEGIS. AEAD primitives use fewer computational resources, making them suitable for devices with limited resources. 3. Preliminaries In this section, the preliminary terms that will help in the development of the proposed technique are discussed. These include a brief description of the CPKC, Ascon cipher suit, X25519, and network model. 3.1. CPKC Al-Riyami et al. [19] introduced a new cryptographic approach called CPKC to address the weakness of Identity-Based Cryptography (IBC) schemes. The private keys for all participating entities in an IBC-based scheme is totally controlled by a TA known as the KGC. As a result, an attacker in possession of confidential information stolen from the KGC might completely mimic any of the participating entities without even being identified. This issue is called Key Escrow problem. CPKC schemes solves this problem, by splitting the private key into two parts, one generated by the KGC and the other part is generated by the corresponding participating entity i.e., a participant’s full private key is composed of two parts: one is a partial private key produced by the KGC, and the other is a secret value produced by the participating node itself [20]. The use of a CPKC technique has several advantages as it gets rid of both certificate chains and the process of verifying certificates [40]. The CPKC schemes have the ability to eliminate the transmission of a public key certificate that is tied to the entity’s public key, which results in a decrease in communication overhead. Further, the CPKC schemes does not need any pre-shared secrets to be stored in any communicating entity. Furthermore, if an adversary acquires the partial private key of an entity accessible on KGC, the adversary cannot gain the complete private key of an entity since the second part of the full private key is the secret value generated by the entity. Therefore, an adversary will be unable to access the content of communication between valid entities. Thus, CPKC techniques provide security even if an entity’s information stored on the KGC is exposed to an adversary. A CPKC has seven phases, as described below. (1) Initialization phase: In this phase the trusted authority (TA) initializes elliptic curve parameters, base point and other system parameters and produces its master public key and a master private key. U. Ali et al. Internet of Things 24 (2023) 100923 5 (2) First part of private and public keys: In this phase the participant selects a random value and set it as its first part of its private key. The participant produces the first part of its public key by multiplying its private key with the group generator G of Curve25,519. (3) Second part of Private and public Key: The process and is initiated when an entity/participant perform a request on a secure channel for dedicated cryptographic materials from TA. The TA generates the second part of public and private keys for the corresponding entity/participant by using its master public key, master private key, identity string of the participant and first part of public key of participant. (4) Full Private Key: The full private key of the participant has two parts, the first part is the private key generated by the participant itself, and the second part of public key generated by the TA on behalf of participant. (5) Full Public Key: The full public key of the participant has two parts, the first part is the public key generated by the participant itself by multiplying its first part of private key with the group generator G of Curve-25,519, and the second part of public key generated by the TA on behalf of participant. (6) Encryption: Whenever an entity requires to send a new encrypted message, it executes the process of encryption by taking the plain text and secret key as input and produce the cipher text. (7) Decryption: This process is carried out by an entity that receives the cipher text and aims to retrieve the plain text by using the secret key. Alternatively, this step will conclude with an inaccuracy if the secret key is invalid. 3.2. Ascon cipher suit Ascon is the cipher suite, which provides authenticated encryption with associated data (AEAD) and hashing functionality [22]. Fig. 1. shows Ascon authenticated encryption and verified decryption algorithm. AEAD [9] is a cryptographic technique that simultaneously guarantees confidentiality, integrity, and authenticity on the data. The purpose of associated data is to bind a ciphertext to the plaintext in order to identify and reject any effort to "cut-and-paste" a valid ciphertext into a new context. The associated data does not have to be stored or sent together with the ciphertext and can be any context-dependent non-secret value that both honest parties can accurately deduce. For authenticated encryption, four inputs are required: the secret key K with 160 bits, a nonce N with 128 bits, the plaintext P, and associated data A. The N and A are passed in the clear. There are two outputs from authenticated encryption: the ciphertext C having same length as the P, and an authentication tag T. The authenticated decryption procedure requires five inputs: K, N, C, A, and T. Both N and A are passed in the clear. There is just one output from authenticated decryption, which is the P having same length as the C. If the input parameters are not authentic, it will return the "FAIL" error code. 3.3. X25519 based on Curve-25,519 Curve-25,519 is one of the most widely used elliptic curve with equation y 2 =x 3 +486662x 2 +x, where 25,519 indicates the prime field of the elliptic curve which is 2 2 ⁵⁵-19 [23]. The Diffie-Hellman key exchange (DHKE) protocol can also be constructed on the Curve-25,519, known as X25519. The X25519 differs from the elliptic curve DHKE protocol in that it depends only on the x coordinate of the point of the curve. The reason for this is that the x coordinate of the point can uniquely represent the elements of the curve. The x-coordinate of different types of elliptic curves can be used for DHKE protocol, but the Curve-25,519 is less computationally intensive with the Montgomery Ladder algorithm and is simpler to implement in constant time. When two IoT devices A and B are communicating over a public network, they can create a unique session for secure communication by using X25519. With this they select the x co-ordinate of the commonly shared base point G and both devices A and B then generate random values to determine their public keys as follows. Device A generates its private key (a) and compute its public key Apub: Apub =aG(mod p). Device B generates its private key (b) and compute its public key Bpub: Bpub =bG(mod p). Both devices A and B exchange their public keys with each other to compute the shared session key (SSK) to establish a new session. Device A compute the SSK by multiplying its private key with the received device B public key as shown in the equation: Assk =aBpub(modp) = abG(modp). Device B compute the SSK by multiplying its private key with the received device A public key, they should then end up with the same value as shown in the equation: Bssk =bApub(modp) = abG(modp) = Assk 3.4. Network model We considered multiple IoT nodes, and a single server called as trusted authority (TA) for our proposed scheme as shown in Fig. 2. Fig. 1. Ascon authenticated encryption and verified decryption algorithm [22]. U. Ali et al. Internet of Things 24 (2023) 100923 6 The IoT nodes communicate with the TA through a secure channel while the IoT nodes communicate with each other through insecure public channels. The computational capabilities available on the IoT nodes are limited, while the TA is a reliable server with an adequate amount of resources. We also assumed that all of the participating nodes have some cryptographic information already loaded into their memory, and that the nodes are required to provide both their public keys and identities with the TA as well as any other nodes with whom they want to communicate. 3.5. Threat model In this article, we considered the Dolev-Yao (DY) threat model [41], which is well recognized. This model allows for the presence of an attacker (referred to as Type 1 and Type 2) who has the ability to intrude the communication channel and intercept all messages exchanged between the entities involved. Furthermore, the Type 1 attacker refers to an external entity that has knowledge of all the public parameters exchanged between the trusted authority and the participating nodes. However, the Type 1 attacker lacks the ability to access the private data belonging to any of the entities involved in the system. The Type 2 attacker refers to an entity that has the partial private key; however, it lacks the ability to get the private key of any participant. This entity may be considered a trustworthy authority. 4. The proposed LWSCAS The proposed ELWSCAS is based on X25519 key exchange protocol and AEAD primitive called Ascon and consists of three phases: the system initialization phase, registration phase and the authentication phase. The symbols used in the proposed scheme are listed in Table 1. Fig. 2. Network model of the proposed scheme. Table 1 Notations used in the proposed ELWSCAS. Notation Description F q Finite prime field of size q =2 255 – 19 E Curve-25,519 with equation: y 2 =x 3 +486662x 2 +x G Group generator of E of order n Enc(), Dec(), Hash Ascon cipher suit Subscripts (i, j and s) Used for i th -node, j th -node and trusted authority (ID i , ID j , ID s ) Identities of corresponding nodes (V i , V j , V s ) Private keys of corresponding nodes (U i , U j , U s ) Public keys of corresponding nodes (X i , X j ) Partial private keys of corresponding nodes (Y i , Y j ) Partial public keys of corresponding nodes (T i , T j ), (N i, N j ) Time stamps and nonces of corresponding nodes (PT i , PT j ), (CT i , CT j ), Plaintext and cipher text of corresponding nodes TG i , TG j Authentication tags of corresponding nodes AD Associated data (SK i , SK j ), (SLK i , SLK j ) Session keys of corresponding nodes U. Ali et al. Internet of Things 24 (2023) 100923 7 Fig. 3. Registration Phase of ELWCAS. U. Ali et al. Internet of Things 24 (2023) 100923 8 Fig. 4. Authentication Phase of ELWSCAS. U. Ali et al. Internet of Things 24 (2023) 100923 9 4.1. Initialization phase In this phase, the IoT device that required to be part of the system interacts with the trusted authority (TA) via a secure channel to receive dedicated cryptography elements necessary for establishing the secret session key. In this phase the TA establishes the following cryptographic elements. i. The Elliptic curve E (Curve-25,519 with equation y 2 =x 3 +486662x 2 +x) with finite prime field F q and group generator G. ii. Ascon cipher suit containing authenticated encryption Enc(), verified decryption Dec() and hash function H. iii. The TA compute its private key Vs∈RZ∗ q and public key Us=Vs.G. iv. The TA establishes the list of all cryptographic parameters {F q , q, x, y, G, U s , H, Enc(), Dec()}, ready to be shared with the IoT devices participating in the system. 4.2. Registration phase In this phase, the IoT devices register themselves and obtain dedicated cryptographic information from the TA by using a secure communication channel as shown in Fig. 3. The following steps are carried out in this phase. Step 1: The IoT device (say i th -node) that is required to be part of the system, is equipped with the parameters {F q , q, x, y, G, U s , H, Enc(), Dec()}. The node produces its identity ID i and private key asVi∈RZ∗ q. The node then computes the first part of its public key as Ui =Vi.Gand transmits the message Mi= {IDi‖Ui}to the TA using a secure channel. Step 2: When the TA receives Mi, it executes the following operations on behalf of i th -node to compute the corresponding partial private and public keys. i. The TA generate a random value ri∈RZ∗ q and calculatePi=ri.G. ii. The TA calculate hi=H(IDi⊕Ui⊕Pi)and partial private key Xi= ((ri+hi.Vs)modq)for the i th -node. iii. The TA calculate partial public key Yi=Xi.Gfor the i th -node. iv. Finally, the TA transmit the message Mt= {Xi,Yi,Pi,IDs}to the i th -node over a secure channel. Step 3: After receiving Mt from TA, the i th -node first verify the authenticity of the partial private and public keys in M2 by using the equation Xi.G=Pt+H(IDi⊕Ui⊕Pi).Us=Yi. If this equation is satisfied, the keys produced by the TA could be regarded legitimate and accurate and the corresponding node can set its full private key and public key to (Vi,Xi)and (Ui,Yi)respectively. 4.3. Authentication and key agreement (AKA) phase The AKA phase consists of four different messages, two messages per each node, that will be exchanged with each other to complete the process as shown in Fig 4. The first two messages, one per each ith-node and jth-node, are used to exchange information such as identity, public key, time stamp, and fresh nonce with each other. The public keys received are then used to produce a shared secret, based on t protocol. The last two messages, one per each ith-node and jth-node, allow them to verify the authenticity of each other. After the authentication is successful from both side, both will generate a unique session key, namely session link key (SLK) which will be used for secure communication between them through wireless channels. The following steps are carried out to complete AKA phase. Step 1: The i th -node produces a fresh nonce Ni∈ {1,2,3,...q−1}, a timestamp Ti and a message M1= {IDi,Ui,Yi,Ni,Ti}and send it to the j th -node. Step 2: After receiving M1 the j th -node first verify the time stamp Ti validity, i.e., Ti >current time. If it is successful then the j th - node select a fresh nonce Nj∈ {1,2,3, ...q−1}and produce a new timestamp Tj, then generate a new message M2 = {IDj,Uj,Yj,Nj,Tj}, and send it to the i th -node. Step 3: After receiving M2, the i th -node first verify the time stamp Tj validity, i.e., Tj >current time. If it is successful, then the i th - node perform the following computations to generate the secret session key. i. Generate a timestamp Ti and a private random number Ri∈ {1,2,3,...q−1}. ii. Compute the first part of secret key Ki1=ViUj and second part of secret keyKi2=Xi.Yj. iii. Compute the secret session key SKi=Hash(Ki1⊕Ki2⊕Ni⊕Nj). iv. Generate a new nonce N=Ni⊕Nj, associated data AD =Hash(Xi.Yj.Us)and plaintext PTi= (IDi⊕IDj⊕Ri). v. Compute the ciphertext and authentication tag {CTi,TGi} = Enc(SKi,N,AD,PTi). vi. The i th -node finally sends message M3= {Ti,CTi,TGi}to the j th -node. Step 4: After receiving M3, the j th -node first verify the time stamp Ti validity, and if it is invalidity and perform the following computations. i. Produce a timestamp Tj and a private random number Rj∈ {1,2,3,...q−1}. ii. Compute the first part of secret key Kj1=VjUi and second part of secret keyKj2=XjYi. U. Ali et al. Internet of Things 24 (2023) 100923 16 represent the computational cost of ECSM and hash function respectively. The overall computational cost of the proposed scheme is 10T H +4T E/D +4T ECSM . The computational cost of our scheme is compared with the related schemes [10–18] as shown in Table 3 and Fig 6. The results show that ELWSCAS has a lower computational cost than the existing schemes. 6.2. Communication cost In the proposed ELWSCAS, we have used Ascon AEAD which provides authenticated encryption, verified decryption and hashing functionality. The hash function generates 256-bits output and authenticated encryption generates 128-bits ciphertext and 128-bits authentication tag . In the proposed ELWSCAS, an IoT node transmit two messages {ID i , U i , Y i , N i , T i } and {T i , CT i , TG i } and receive two messages {ID j , U j , Y j , N j , T j } and {T j , CT j , TG j }. The communication cost to send the two messages are 16+256+256+32+32 =592 and 32+128+128=288 bits. The total cost of sending the two messages is 592+288=880 bits . Whereas the communication cost to receive the two messages are 16+256+256+32+32 =592 and 32+128+128=288 bits. The total cost of receiving the two messages is 592+288=880 bits. In the update phase each node is sending 256 bits hashed value and 32 bits node-identity to the server. The total communication cost for each two nodes in the update phase is 256+32 =288 bits. Thus, the overall communication cost is 880+880+288=2048 bits. The results show that, in comparison to other existing schemes [10–18], the ELWSCAS has the lowest communication cost as shown in Table 3 and Fig 7. 6.3. Implementation and experimental analysis We performed the simulation of the proposed ELWSCAS by using the well accepted network simulator 3 (NS3) version 3.35 [44], on Ubuntu 20.04 LTS platform with gcc 7. The simulation aims to evaluate the impact of the proposed scheme in terms of various network parameters, such as Throughput (in bytes per second) and PDR (packets per second). The simulation parameters of our proposed scheme are listed in Table 4. In the simulation one gateway node and many sensor nodes are distributed in a fixed position in an area of 100 square meters. The sensors are organized as a matrix with a distance of 20 m for every two sensors in the same row and column. We ran five simulations scenarios with sensor nodes 20, 30, 40, 50, and 60, respectively. All the sensor nodes communicate over 2.4 GHz IEEE 802.11 wi-fi standard. Any details that are not explicitly stated are presumed to have the default values supplied by the NS3 (3.35) simulator. 1) Throughput: The Throughput is significant network performance parameter which is described as the number of bits transmitted per unit time, typically bits per second. Throughput can be calculated by using the equation TH = (R× |P|)/T, where R, |P| and T represents the number of received packets, the size of the packet, and the total time (in seconds) respectively. Fig. 8. shows the variation of network Throughput in different scenarios. We observed that the network Throughput decreases with an increase in the number of sensor nodes. This is because the probability of packet errors increases as the number of nodes increases, leading network performance to drop. 2) PDR: The PDR indicates the ratio of total received packets to total sent packets. Fig. 9. depicts the variation in PDR in various scenarios. We can observe that as the number of sensor nodes rises, the ratio drops. This is because when more sensor nodes are involved in the system, the farther distance will occur, and the PDR will decrease. Fig. 9. PDR of different scenarios. U. Ali et al. Internet of Things 24 (2023) 100923 17 7. Conclusion and future work Providing security has been always on priority in all areas of computing and communication. Despite the increasing demand for IoT devices and services as well as the advancements in the underlying technology, IoT devices and networks are susceptible to a broad variety of security threats. One of the most important factors in securing an IoT environment is the underlying authentication mechanism. Nevertheless, constrained IoT environment needs fast and secure authentication. In this research, we developed ECC and AEAD based ELWSCAS for IoT environment. We used AEAD technique to make the propose ELWSCAS more lightweight by achieving confidentiality, authenticity, and integrity all together in a one-pass and are simpler to employ correctly than separate constructions. To protect the transmitted message from modification additional data is also required along with the message that can be used to authenticate the message. This can be done normally in the form of a message authentication code (MAC) which are often generated using keyed hash functions. In AEAD cryptosystem, a MAC also called authentication tag is computed over the transmitted message and sent together with the message. The recipient of the message can validate the message together with the tag. If the tag or message has been altered in any manner, the recipient will reject it as invalid. This will secure the transmitted message against tampering attack. The authentication of the ciphertext rather than the plaintext is typically preferable because it allows the receiver to verify the authentication tag without having to decrypt the entire message, allowing faulty communications to be discarded early. Indeed, validating data authenticity enables faulty data to be quickly discarded, reducing unnecessary communications. We conducted the formal security analysis by using RoR model and AVISPA tool, to evaluate the security of the proposed scheme. We also performed informal security analysis to verify the security of the proposed scheme. The security analysis of the proposed scheme shows that the proposed schemes offers non-repudiation, integrity, mutual authentication, confidentiality, and FS and is also resistant to a various security attacks such as KC attack, DoS attack, MitM attack, impersonation attack, eavesdropping attack and replay attack. The computational and communication cost of the proposed scheme shows that in comparison to the existing state-of-the-art, our approach is considerably less costly and is a viable option for constrained IoT environment. Finally, the PDR and Throughput in the NS3 simulation demonstrate the viability and practicality of the proposed scheme. In the future, we plan to implement and analyze the proposed solution in a real-world IoT environment. This would further enhance the proposed approach and motivate us to analyze its efficiency and security more accurately. Funding The research was cofunded by the European Union within the REFRESH project-Research Excellence for Region Sustainability and High-tech Industries ID No. CZ.10.03.01/00/22_003/0000048 of the European Just Transition Fund and by the Ministry of Education, Youth and Sports of the Czech Republic (MEYS CZ) through the e-INFRA CZ project (ID: 90254) and also by the MEYS CZ within the project SGS ID No. SP 7/2023 conducted by VSB-Technical University of Ostrava. This work was also supported in part by the Malaysian Ministry of Higher Education under Fundamental Research Grant Scheme (FRGS/1/2021/ICT11/UM/02/1) (FP005-2021). Declaration of Competing Interest The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper. Data availability No data was used for the research described in the article. References [1] A.K. Singh, B. Patro, Security of low computing power devices: A survey of requirements, challenges & possible solutions, Cybern. Inf. Technol. 19 (1) (2019) 133–164. [2] U. Ali, et al., RFID authentication scheme based on hyperelliptic curve signcryption, IEEE Access 9 (2021) 49942–49959. [3] U. Ali, et al., Hyper elliptic curve based certificateless signcryption scheme for secure IIoT communications, CMC-Comput. Mater. Continua 71 (2) (2022) 2515–2532. [4] R. Ma, et al., Identification and addressing of internet of things based on distributed ID, Int. J. Embedded Syst. 12 (2) (2020) 195–205. [5] S. Rajesh, et al., A secure and efficient lightweight symmetric encryption scheme for transfer of text files between embedded IoT devices, Symmetry 11 (2) (2019) 293. [6] T. Song, et al., A privacy preserving communication protocol for IoT applications in smart homes, IEEE Internet Things J. 4 (6) (2017) 1844–1852. [7] Banerjee, S. and A. Patil. ECC based encryption algorithm for lightweight cryptography. in International conference on intelligent systems design and applications. 2018. Springer. [8] W.J. Buchanan, S. Li, R. Asif, Lightweight cryptography methods, J. Cyber Security Technol. 1 (3-4) (2017) 187–201. [9] M.S. Turan, et al., Status report on the second round of the NIST lightweight cryptography standardization process, Natl. Inst. Standards Technol. Internal Rep. 8369 (10.6028) (2021). [10] Y. Zheng, et al., PUF-based mutual authentication and key exchange protocol for peer-to-peer IoT applications, IEEE Trans. Dependable Secure Comput. (2022). [11] N. Bagheri, et al., Defending industry 4.0: an enhanced authentication scheme for IoT devices, IEEE Syst. J. (2021). [12] S. Li, et al., A provably secure and practical PUF-based end-to-end mutual authentication and key exchange protocol for IoT, IEEE Sensors J. 21 (4) (2020) 5487–5501. [13] F. Wu, et al., A novel three-factor authentication protocol for wireless sensor networks with IoT notion, IEEE Syst. J. 15 (1) (2020) 1120–1129. U. Ali et al. Internet of Things 24 (2023) 100923 18 [14] Z. Liu, C. Guo, B. Wang, A physically secure, lightweight three-factor and anonymous user authentication protocol for IoT, IEEE Access 8 (2020) 195914–195928. [15] P. Tedeschi, et al., LiKe: lightweight certificateless key agreement for secure IoT communications, IEEE Internet Things J. 7 (1) (2019) 621–638. [16] S. Garg, et al., Toward secure and provable authentication for Internet of Things: realizing industry 4.0, IEEE Internet Things J. 7 (5) (2019) 4598–4606. [17] A. Braeken, PUF based authentication protocol for IoT, Symmetry 10 (8) (2018) 352. [18] X. Li, et al., A robust ECC-based provable secure authentication protocol with privacy preserving for industrial internet of things, IEEE Trans. Ind. Inf. 14 (8) (2017) 3599–3609. [19] Al-Riyami, S.S. and K.G. Paterson. Certificateless public key cryptography. in International conference on the theory and application of cryptology and information security. 2003. Springer. [20] Baek, J., R. Safavi-Naini, and W. Susilo. Certificateless public key encryption without pairing. in International conference on information security. 2005. Springer. [21] R. Li, et al., Efficient certificateless public integrity auditing of cloud data with designated verifier for batch audit, J. King Saud Univ. 34 (10) (2022) 8079–8089. [22] Dobraunig, C., et al., Ascon, submission to the NIST lightweight cryptography standardization process. 2019. [23] Bernstein, D.J. Curve25519: new Diffie-Hellman speed records. in International Workshop on Public Key Cryptography. 2006. Springer. [24] P. Gope, B. Sikdar, Lightweight and privacy-preserving two-factor authentication scheme for IoT devices, IEEE Internet Things J. 6 (1) (2018) 580–589. [25] E. Lara, et al., Lightweight authentication protocol for M2M communications of resource-constrained devices in industrial Internet of Things, Sensors 20 (2) (2020) 501. [26] A. Braeken, Highly efficient symmetric key based authentication and key agreement protocol using Keccak, Sensors 20 (8) (2020) 2160. [27] A.K. Das, et al., AI-envisioned blockchain-enabled signature-based key management scheme for industrial cyber–physical systems, IEEE Internet Things J. 9 (9) (2021) 6374–6388. [28] G.S. Gaba, et al., Robust and lightweight key exchange (LKE) protocol for industry 4.0, IEEE Access 8 (2020) 132808–132824. [29] D.S. Gupta, et al., A provably secure and lightweight identity-based two-party authenticated key agreement protocol for IIoT environments, IEEE Syst. J. 15 (2) (2020) 1732–1741. [30] Y. Li, Q. Cheng, W. Shi, Security analysis of a lightweight identity-based two-party Authenticated key agreement protocol for IIoT environments, Security Commun. Networks 2021 (2021). [31] S. Velliangiri, et al., An efficient lightweight privacy-preserving mechanism for industry 4.0 based on elliptic curve cryptography, IEEE Trans. Ind. Inf. 18 (9) (2021) 6494–6502. [32] X. Ding, et al., A lightweight anonymous authentication protocol for resource-constrained devices in Internet of Things, IEEE Internet Things J. 9 (3) (2021) 1818–1829. [33] A. Abdaoui, et al., Fuzzy elliptic curve cryptography for authentication in Internet of Things, IEEE Internet Things J. 9 (12) (2021) 9987–9998. [34] Q. Fan, et al., SAKE*: a symmetric authenticated key exchange protocol with perfect forward secrecy for industrial Internet of Things, IEEE Trans. Ind. Inf. (2022). [35] R. Gupta, et al., Blockchain and onion routing-based secure message exchange system for edge-enabled IIoT, IEEE Trans. Ind. Inf. (2022). [36] H. Wang, et al., Lightweight and anonymous mutual authentication protocol for edge IoT nodes with physical unclonable function, Security Commun. Networks 2022 (2022). [37] F. Rafique, et al., An efficient and provably secure certificateless protocol for industrial Internet of Things, IEEE Trans. Ind. Inf. 18 (11) (2022) 8039–8046. [38] Sharma, R. and B. Vill´ anyi, Consistent Round Hash optimized SRP-6a-based end-to-end mutual authentication for secure data transfer in industry 4.0. Internet of Things and Cyber-Physical Systems, 2022. [39] M. Tanveer, et al., REAP-IIoT: resource-efficient authentication protocol for the industrial Internet of Things, IEEE Internet Things J. (2022). [40] A.W. Dent, A survey of certificateless encryption schemes and security models, Int. J. Inf. Secur. 7 (5) (2008) 349–377. [41] D. Dolev, A. Yao, On the security of public key protocols, IEEE Trans. Inf. Theory 29 (2) (1983) 198–208. [42] M. Abdalla, P.-A. Fouque, D. Pointcheval, Password-based authenticated key exchange in the three-party setting, in: International Workshop on Public Key Cryptography, Springer, 2005. [43] AVISPA, S., the Security Protocol ANimator for AVISPA. 2019. [44] Consortium, T.U.o.W.N.-. NS-3, a discrete-event network simulator for internet systems. 2022; Available from: https://www.nsnam.org/. U. Ali et al.