## 4 Security Analysis
Forward Secrecy: The new session key \(K_{s_{i}}\) is determined through \(k_{s_{i}}=h(r_{i}\|T_{i}\|k_{s_{i-1}})\), with \(K_{s_{i-1}}\) representing the session key shared exclusively between \(C_{i}\) and \(IIoT_{j}\). Soundness ensures that \(K_{s}\) undergoes updates at least once at the conclusion of each session, and the one-way secure hash function signifies that the previous \(K_{s_{i-1}}\) cannot be recomputed even if the current \(K_{s_{i}}\) is revealed. Consequently, an adversary cannot retrieve the previous session key using the exposed \(K_{s_{i}}\). The LI2A scheme upholds forward secrecy. 6. Resistance Against Various Attacks: We assess herein the resilience of our proposed LI2A scheme against impersonation attacks, man-in-the-middle attacks, replay attacks, eavesdropping attacks, modification attacks, and known session key attacks. The specific details are outlined below: 1. [label=()] 2. [label=()] 3. Impersonation Attack: Let us assume that adversary \(\mathbb{A}\) intends to impersonate \(C_{i}/IIoT_{j}\) and establish successful communication with the other entity. Consider \(C_{i}\) as an example; \(\mathbb{A}\) must acquire \(C_{i}\)'s current authentication session key. One possible method involves \(\mathbb{A}\) stealing \(K_{s}\) from \(C_{i}\). However, this confidential information is securely stored in \(C_{i}\)'s tamper-proof memory, making it inaccessible to \(\mathbb{A}\). Consequently, \(\mathbb{A}\) cannot obtain the key and generate a valid authentication message to communicate with \(IIoT_{j}\). Alternatively, \(\mathbb{A}\) might attempt to acquire \(K_{s}\) from previous messages. Due to the irreversibility of the one-way hash function, \(\mathbb{A}\) is unable to calculate \(K_{s}\). This analysis similarly applies to impersonating \(IIoT_{j}\). Thus, the proposed LI2A scheme demonstrates resilience against impersonation attacks. This security property also applies to internal nodes, where \(K_{s}\) is unique for each node. 4. Man-in-the-Middle Attack: An adversary, \(\mathbb{A}\), has the capability to acquire exchanged messages (\(m_{3},m_{4}\)) from senders and fabricate a valid set (\(\overline{m_{3}},\overline{m_{4}}\)) to send to receivers. Thanks to the LI2A scheme's resistance to impersonation attacks and its support for mutual authentication, \(\mathbb{A}\) is unable to generate valid messages that would pass through the validation process. As a result, the proposed LI2A scheme effectively guards against man-in-the-middle attacks. Replay Attack: The timestamp is integrated into the exchanged messages, and the recipient can verify their accuracy to ensure that the timestamp remains unaltered. This verification mechanism assures that malicious actor \(\mathbb{A}\) does not transmit the same message repeatedly where the I2A protocol stores the last \(T_{i-1}\) and drops any messages that have \(T_{i}\leq T_{i-1}\). random values as \(n\times m\), each is randomly sampled from the set \(\{0,1\}^{q}\). Consequently, the likelihood of having two equal random numbers is \(([nm(nm-1)]/2^{q})\); therefore,  
\[Pr[G0]\leq Pr[G1]+(nm(nm-1)/2^{q})) \tag{2}\]  
Game 2: The challenger (C) tries to guess the maliciously accepted instance. The game terminates if the challenger's guess is wrong. The maximum of instances is \(n\times m\); therefore,  
\[Pr[G2]\leq Pr[G1]\times 1/(n\times m) \tag{3}\]  
Game 3: In this game, we analyze the probability of the adversary forging messages successfully and replace the update of authentication session keys with the pseudorandom keyed hash function \(h(K,.)\). At the commencement of the \(l_{th}\) session, the authentication session keys have undergone updates \(l-1\) times. Considering a maximum of \(m\) sessions, the overall loss is capped at \((m-1)\mathbb{P}_{hash}^{suf-k}(C)\) during the replacement process. Therefore,  
\[Pr[G3]\leq Pr[G2]+(m-1)\mathbb{P}_{hash}^{suf-k}(C) \tag{4}\]  
Game 4: This game terminates if the maliciously accepted instance receives a valid message but has no matching session.