Lightweight and Decoupled Distributed Authentication for Multihop IoT Networks

The Internet of Things (IoT) demands lightweight and secure authentication schemes for resource-constrained multihop networks, where IoT nodes communicate with the gateway through multiple intermediary nodes. Present distributed schemes enable secure lightweight authentication for such networks, but overwhelm an IoT node with multiple authentication requests from its newly joined child nodes, leaving other nodes underutilized. This paper presents a decoupled distributed authentication scheme, where IoT nodes capable of authentication are selected by the gateway as an authentication server to authenticate newly joined nodes. The authentication server may be a parent or a non-parent node and thus separates the process of authentication and node joining, mitigating the skewed authentication load by newly joined child nodes to their parent node. After a successful authentication, the authentication server informs the gateway about the authenticated node and mediates the session key generation between the gateway and the node. It utilizes Physically Unclonable Function (PUF) responses to eliminate the need for long-term storage of the secret key (for the secure authentication execution) and prevents adversarial prediction by introducing session-based randomness. Lightweight hash-based accumulators and XOR operations are also introduced, producing reduced computational overhead on resource-constrained nodes. Security validation of the scheme is performed, both formally (using ProVerif) and informally. In addition, performance analysis is conducted through theoretical and simulation-based frameworks, focusing on energy consumption, CPU time, and communication overhead. Analysis demonstrates that the proposed scheme is secure while maintaining a lightweight structure over existing methods.