Classical certificate-based mutual authentication schemes impose prohibitive publickey infrastructure management overhead on resource-constrained IIoT sensors, while symmetric key approaches lack scalability in large-scale heterogeneous deployments. This paper proposes a lightweight elliptic curve cryptography (ECC) based mutual authentication protocol augmented with a zero-knowledge proof (ZKP) module that eliminates the transmission of sensitive credential material while preserving verifiability. The protocol employs a novel discrete-algebraic challenge-response mechanism over the NIST P-256 curve, reducing the number of point multiplication operations to a single scalar multiplication per authentication round through precomputation and caching of fixed-base multiples. The zero-knowledge proof is constructed using a three-round Sigma protocol over the elliptic curve group that proves knowledge of the private key without revealing it, providing formal simulation security under the discrete logarithm assumption. The proposed scheme is formally verified using the ProVerif automated security tool under a Dolev-Yao adversary model, confirming resistance against replay, man-in-the-middle, impersonation, and forward secrecy violations. Implementation on ARM Cortex-M4 embedded hardware demonstrates authentication latency of 4.8 ms and energy consumption of 12.1 μJ per authentication event, outperforming RSA-based authentication by 78% in latency and 79% in energy. The framework scales linearly to 1,000-node IIoT networks with authentication latency remaining below 8 ms, confirming its suitability for time-critical industrial control systems.