A lightweight fusion framework for IoT security : Integrating ECC-based authentication, dynamic session tokenization, and rolling hash integrity
Gauri V. Ghulegauri.ghule@vit.eduDepartment of Electronics and Telecommunication EngineeringVishwakarma Institute of TechnologyPune, Maharashtra, 411048, IndiaView full profile → , Pallavi D. Deshpandepallavi.deshpande@vit.eduDepartment of Electronics and Telecommunication EngineeringVishwakarma Institute of TechnologyPune, Maharashtra, 411048, IndiaView full profile → , Sandeep V. Gaikwadsvgaikwad@pict.eduDepartment of Electronics and Telecommunication EngineeringSCTR’s Pune Institute of Computer TechnologyPune, Maharashtra, 411043, IndiaView full profile → , Ketki Kshirsagarketki.kshirsagar@vit.eduDepartment of Electronics and Telecommunication EngineeringVishwakarma Institute of TechnologyPune, Maharashtra, 411048, IndiaView full profile → , Manasi Ghamandemanasi.ghamande@vit.eduDepartment of Engineering Science and HumanityVishwakarma Institute of TechnologyPune, Maharashtra, 411048, IndiaView full profile → , *Rahul S. PolCorresponding authorrahul.pol@vit.eduDepartment of Electronics and Telecommunication EngineeringVishwakarma Institute of TechnologyPune, Maharashtra, 411048, IndiaView full profile →
* Corresponding author · click or hover a name for details
- Received:
- 01 Sep 2025
- Published Online:
- 30 Sep 2026
- Article type:
- Research Article
- Language:
- EN
- Article no.:
- JDMSC-2780
- Pages:
- 3523–3532
Abstract
This study presents an in-depth look at lightweight authentication frameworks based on Elliptic Curve Cryptography (ECC) for Internet of Things (IoT) environments, focusing on resource use and strong security. It proposes a new hybrid method that combines Zero-Knowledge Proof (ZKP) with ECC and Secure Element-based key encapsulation. This approach helps prevent replay, desynchronization, and man-in-the-middle attacks while maintaining cryptographic strength under 256-bit curves. Data from 32 tested protocols shows an average 48% reduction in handshake latency, a 37% improvement in energy efficiency, and a 99.1% authentication success rate for constrained devices. ECC’s flexible curves and smaller key size help keep authentication cycles under 15 milliseconds, validated across industrial, healthcare, edge, and mobile IoT areas. In contrast to RSA or models that rely heavily on AES, this framework cuts memory use by 40% and reduces execution complexity by 33%. Simulations conducted on NB-IoT and ZigBee systems confirm that message integrity remains between 96% and 99% even under high-loss conditions. Combining physical unclonable functions (PUF) with ECC boosts key generation driven by entropy without needing external trusted platforms. Formal verification using BAN logic and ProVerif confirms security against adaptive attackers. Therefore, this architecture offers a scalable, privacy-protecting, and efficient authentication solution for future IoT systems.
Keywords
Subject Classifications
References
[1] M. B. Yassein, S. Aljawarneh, and E. Almaghayreh, “An efficient lightweight encryption algorithm for securing smart home devices,” J. Ambient Intell. Humaniz. Comput., vol. 12, pp. 1519–1532 (2021).
[2] A. K. Das, M. Wazid, N. Kumar, and A. V. Vasilakos, “Secure and energy-efficient biometric-based user authentication scheme for cloud-based IoT environments,” IEEE Trans. Sustain. Comput., vol. 4, no. 1, pp. 25–38 (Jan.–Mar. 2019).
[3] N. Saxena, A. Roy, and J. Shin, “Dynamic token-based authentication scheme for cloud IoT applications,” IEEE Internet Things J., vol. 6, no. 5, pp. 8441–8451 (Oct. 2019).
[4] S. Tewari and B. B. Gupta, “ECCbAP: A secure ECC-based authentication protocol for IoT edge devices,” J. Netw. Comput. Appl., vol. 148, Art. no. 102734 (Jan. 2020).
[5] A. O. Mulani and P. B. Mane, “Watermarking and cryptography based image authentication on reconfigurable platform,” Bull. Elect. Eng. Informatics, vol. 6, no. 2, pp. 181–187 (2017).
[6] H. S. Deshpande, K. J. Karande, and A. O. Mulani, “Efficient implementation of AES algorithm on FPGA,” in Proc. 2014 Int. Conf. Commun. Signal Process. (ICCSP), Melmaruvathur, India, pp. 1895–1899 (2014), doi: 10.1109/ICCSP.2014.6950174.
[7] C. Patel, A. K. Bashir, A. A. AlZubi, and R. H. Jhaveri, “EBAKE-SE: A novel ECC based authenticated key exchange between industrial IoT devices using secure element,” Comput. Electr. Eng., vol. 104, Art. no. 108367 (Dec. 2022).
[8] S.-R. Oh and Y.-G. Kim, “AFaaS: Authorization framework as a service for Internet of Things based on interoperable OAuth,” Int. J. Distrib. Sensor Netw., vol. 16, no. 3, Art. no. 1550147720906388 (2020).
[9] A. Botta, W. de Donato, V. Persico, and A. Pescapè, “Integration of cloud computing and Internet of Things: A survey,” Future Gener. Comput. Syst., vol. 56, pp. 684–700 (Mar. 2016).
[10] H. Shafagh, L. Burkhalter, A. Hithnawi, and S. Duquennoy, “Towards encrypted query processing for the Internet of Things,” in Proc. 15th ACM Conf. Embedded Netw. Sensor Syst. (SenSys), Delft, Netherlands, pp. 1–14 (2017).
[11] M. R. Palattella, N. Accettura, X. Vilajosana, T. Watteyne, L. A. Grieco, G. Boggia, and M. Dohler, “Internet of Things in the 5G era: Enablers, architecture, and business models,” IEEE J. Sel. Areas Commun., vol. 34, no. 3, pp. 510–527 (Mar. 2016).
[12] S. Rose, O. Borchert, S. Mitchell, and S. Connelly, “Zero trust architecture,” National Institute of Standards and Technology, Gaithersburg, MD, USA, NIST SP 800-207 (Aug. 2020).
[13] S. Salunkhe, A. O. Mulani, D. Shahane, M. Rana, S. M. Shukla, and M. M. Jadhav, “Secure image transmission using chaotic encryption and DWT watermarking on reconfigurable platform,” J. Discrete Math. Sci. Cryptogr., vol. 29, no. 1, pp. 349–361 (2026).
[14] K. R. Chaudhari, A. O. Mulani, M. P. Gajare, V. Jadhav, P. Yawle, and A. V. Bang, “Bit error rate analysis of various error correction codes with concatenated RS-convolutional codes,” J. Discrete Math. Sci. Cryptogr., vol. 29, no. 1, pp. 199–214 (2026).
