# Secure and Efficient Authentication Scheme in IoT Environments
## 1 Introduction  
Owing to the fast advancement of cutting-edge innovation in the realm of ubiquitous computing, Internet of Things (IoT) environments have caught significant attention in the field of information technology (IT) business and network communication. The principal motivation behind IoT environments is to obtain data from the environment, following which various other gadgets can share the data for processing. Consequently, IoT becomes a significant and widely utilized innovation with respect to the presently connected world, particularly in health services and critical infrastructure. Therefore, to deal with exponentially growing heterogeneous data and devices, IoT is connected to a standard cloud platform where critical information about individuals is stored. Therefore, the safety, privacy, and security of such data are of paramount information [1]. Hence, unauthorized clients must not be allowed to access data from private cloud servers. In the literature, it was observed that the security of cloud servers could be infringed through the exploitation of security loopholes such as fraudulence, spying, and falsification presented by either interminable attackers or malignant interior entities [2]. Moreover, many kinds of IoT devices (e.g., IP cameras, smart speakers) are vulnerable to malware (e.g., Mirai malware [3]) that might break up the internet infrastructure, including IoT ecosystems [4, 5, 6]. Therefore, to ensure that only authenticated parties can access the applications and stakeholders'assets (e.g., IoT devices), client verification is necessary to verify the electronic transaction by obtaining collective information about the client [7]. The seriousness of data security on the cloud was gauged by the European commission in 2010, as it recognized both security and protection as significant links in the chain of IoT ecosystems in order for IoT to achieve ubiquity. For providing end-to-end security, IoT use-case will have to incorporate strategies to provide end-device security, message authentication, authorization, integrity, confidentiality, denial, availability, and privacy protection [8]. The entire array of security strategies can be supported by designing an efficient authentication process. Because of this, the authentication process is the principal first layer of security against potential attackers. The authentication process aims to validate the identity of entities or devices that request access to the private cloud platform by performing identity verification; thus, a reliable verification protocol requires performing two functions, namely, mutual verification and session-key agreement [9]. The authentication protocols typically use encryption technology to achieve mutual verification and session-key agreement and counter security attacks. The selection of the appropriate encryption technique relies mainly on device and sensor configurations, determining power, and energy consumption. However, IoT devices and sensors have limited power and computing capabilities because of low memory, low power, low battery, and network confinement. Therefore, the encryption techniques in an appropriate authentication protocol have to be tailored for application to the scenario. Considering the need for IoT devices and sensors, the existing research attempts to design lightweight authentication protocols based on elliptic-curve cryptography (ECC) and profitable open-key cryptography. However, in our literature analysis, we found that the existing schemes provide a secure authentication scheme with high operational costs (i.e., computation, communication, and storage costs). That is, the schemes proposed by existing research unnecessarily consume too much electrical power, storage, and computation energy for computing challenge parameters, verification processes, and key distribution and management, despite IoT devices having a limited capacity. To overcome the problems mentioned previously, we present a novel, efficient, lightweight authentication protocol for IoT applications.