This study presents an in-depth look at lightweight authentication frameworks based on Elliptic Curve Cryptography (ECC) for Internet of Things (IoT) environments, focusing on resource use and strong security. It proposes a new hybrid method that combines Zero-Knowledge Proof (ZKP) with ECC and Secure Element-based key encapsulation. This approach helps prevent replay, desynchronization, and man-in-the-middle attacks while maintaining cryptographic strength under 256-bit curves. Data from 32 tested protocols shows an average 48% reduction in handshake latency, a 37% improvement in energy efficiency, and a 99.1% authentication success rate for constrained devices. ECC’s flexible curves and smaller key size help keep authentication cycles under 15 milliseconds, validated across industrial, healthcare, edge, and mobile IoT areas. In contrast to RSA or models that rely heavily on AES, this framework cuts memory use by 40% and reduces execution complexity by 33%. Simulations conducted on NB-IoT and ZigBee systems confirm that message integrity remains between 96% and 99% even under high-loss conditions. Combining physical unclonable functions (PUF) with ECC boosts key generation driven by entropy without needing external trusted platforms. Formal verification using BAN logic and ProVerif confirms security against adaptive attackers. Therefore, this architecture offers a scalable, privacy-protecting, and efficient authentication solution for future IoT systems.