### Related Works  
Despite the increasing number of IoT applications, including smart homes, smart cities, smart cars, and medical and healthcare equipment, very few solutions for the continuous authentication of IoT devices have been proposed in recent years [3; 4; 5; 6; 7; 8; 9; 10; 11; 12; 13]. Some of them are based on device fingerprints and require additional hardware [7], whereas others rely on time-bound key generation techniques [11]. Recent proposals include lightweight protocols allowing continuous d2d authentication for resource-constrained devices [10; 12; 13] and an efficient protocol for continuous entity authentication, requiring a single-message, which is based on Elliptic Curve Cryptography [3]. Moreover, some recent results leverage blockchain technologies to authenticate IoT devices [14; 15; 16]. A survey of methods designed to achieve continuous authentication in the IoT scenario can be found in [17]. Continuous message authentication is a research topic which is strictly related to continuous entity authentication. Indeed, entity authentication is a specific type of message authentication that only allows the authentication of entities and not arbitrary messages. Data authentication and integrity can be achieved via digital signature schemes. However, digital signatures are usually impractical to use with highly resource-constrained devices. Indeed, despite the large number of constructions which have been proposed so far, they do not provide efficient computations at both the signer's and verifier's side, or small sized private keys and signatures at the same time. The problem of reducing the complexity of the operations at the signer's side has been considered by [PERSON] et al. [18], who proposed the online/offline paradigm. Such a paradigm relies on a trusted party to pre-compute intermediate tokens via expensive operations in an offline stage; such tokens are saved by the signer, which later uses them to sign messages. The drawback of such a solution is that it requires large storage overhead for the signer. The problem of achieving space efficiency at the signer's side has been later considered by [PERSON] et al. [19], who proposed an improved online/offline signature scheme. However, their proposal still requires a storage which is linear in the number of signatures that the signer can generate, making the scheme unsuitable for storage-limited signer devices. Other solutions in the online/offline paradigm have been proposed in [20; 21]. Unfortunately, none of the above solutions is suitable in a scenario where the signer is a device having both limited computing power and low storage capability, such as an IoT device. In order to achieve fast signing and verifying, [PERSON] [22] proposed a one-time signature scheme using one-way functions; however, the drawback of his scheme is the requirement for the public key, which has a large size. Message encoding techniques to reduce the public key size for one-time signature schemes have later been proposed by [PERSON] et al [23], but the resulting scheme results in signatures of large sizes. Moreover, the schemes in [22; 23] can be used to sign only one message and require expensive key generation for each message to be signed. [PERSON] et al. [2] proposed a lightweight signature framework, called _LiS_, which is suitable for continuous message authentication in IoT applications. Such a framework includes two signature schemes, called _LiS1_ and _LiS2_. Digital signatures are often used along the Trusted Platform Module (TPM) to achieve device authentication in IoT settings [24]. In this approach, the TPM is associated with a public-private key pair, with the private key securely stored in the TPM. The TPM can then compute digital signatures, which can be used to authenticate the identity of the device.