# Secure and Efficient Authentication Scheme in IoT Environments
## 3 Proposed ECC-Based Lightweight Authentication Scheme
### Authentication Phase  
Initially, each registered participant client device is required to be authenticated with \(TS\) before starting communication. Therefore, the authentication of the registered devices with \(TS\) proceeds as follows (depicted in Figure 2):  
* Step 1. \(ED_{i}\to TS\): \(<CID_{i},X_{i},Y_{i}>\). The legitimately registered device \((ED_{i})\) randomly selects an ephemeral secret \(x_{i1}\in Z_{p}\) and computes challenges \(X_{i}=x_{i1}.G\) using an ECC point multiplication, hides \(x_{i1}\) inside \(Y_{i}=h(x_{i1}.CK^{\prime})\), and, finally, sends the challenge \(<CID\), \(X_{i},Y_{i}>\) to \(TS\) through a secure channel. The security of \(x_{i1}\) inside both \(X_{i}\) and \(Y_{i}\) is protected by the concept of ECDLP and CDHP.
* Step 2. \(TS\to ED_{i}\): \(<X_{i},Y_{i},\ T>\). After receiving the challenge, \(TS\) recomputes and extract parameters (\(T\), \(A\), \(E_{t}\), \(h(R||I_{i}||s)\), \(R\), \(CK\)) from known parameter \(<t^{\prime}\), \(e_{t}^{\prime}\), \(a^{\prime}\), \(CID_{i}\), \(s\), \(ID_{TS}\) > of the \(TS\) (i.e., it computes \(T=t^{\prime}\oplus CID_{i}\oplus sID_{TS}\), \(A=a^{\prime}\oplus CID_{i}\oplus s\oplus ID_{TS}\), \(E_{t}=e_{t}^{\prime}\oplus CID_{i}\oplus sID_{TS}\), \(h(R||I_{i}||s)\)= \(CID_{i}\oplus s\), \(R=T\oplus h(R||I_{i}||s)\), \(CK=h(R||S||E_{t}||CID_{i})\)), and then \(TS\) computes \(h(X_{i}.CK)\) (i.e., \(h=h(x_{i1}.G.\ CK)=h(x_{i1}.CK^{\prime})\)) and checks whether \(h(X_{i}\times CK)=7\)\(Y_{i}\) (i.e., it checks whether the left value is equal to the right value). If the deduction from both sides is unsuccessful, the session is terminated; otherwise, proceed to the further steps. Subsequently, \(TS\) randomly selects an ephemeral secret \(x_{j1}\in Z_{p}\) and then computes challenges  
Figure 2: Proposed ECC-based login scheme.  
\(X_{j}=x_{j1}.G\) by using an ECC point multiplication, hides \(x_{j1}\) inside \(Y_{j}=h\left(x_{j1}.A.G\right)\), and, finally, sends challenges \(<X_{j},Y_{j},\ T>to\ ED_{i}\) through an open channel. The security of \(x_{j1}\) inside both \(X_{j}\) and \(Y_{j}\) is protected by the concept of ECDLP and CDHP.
* Step 3. Computation of the session key \(S_{k}=x_{i1}.X_{j}=x_{i1}.x_{j1}.G=x_{j1}.X_{i}\): After receiving the challenges \(<X_{j},Y_{j},\ T>\) from \(TS\), \(ED_{i}\) recomputes \(A=T\oplus I_{i}\oplus\ CK^{\prime}\) and checks whether \(X_{j}.A\) (i.e., \(h\left(x_{j1}.A.G\right)\ ) )=?\(Y_{j}\). If the deduction from both sides is unsuccessful, the session is terminated; otherwise, proceed to the further steps. Subsequently, the user \(ED_{i}\) computes the last challenge \(C=h(Y_{i}||A)\) and sends challenges \(<C>\) to \(TS\) through an open channel. After receiving the challenges, \(TS\) recomputes and checks whether \(h(Y_{i}||A\ )=?C\). If the deduction from both sides is unsuccessful, the session is terminated; otherwise, proceed to the further steps. Finally, after successful deduction, the \(TS\) computes the session key \(\left(S_{k}=x_{j1}.X_{j}.P_{kc}\right)\) and \(ED_{i}\) computes the session key \(\left(S_{k}=x_{i1}.X_{j}.\ P_{kc}\right)\).