IoT devices are resource constrained and autonomous and operate in a non-lossy network.

The Curve25519 is a Montgomery curve with equation y∧2=x∧3+[∧2+xmod(p) [25] over Fp (prime field). The mod(p) is specified by 3 < p ≤ 2²⁵⁵−19, with initial basepoint of x=9. The curve also utilizes flattened x-axis points to let the use of Montgomery ladder on X and Z coordinates. It is 255-bit curve with preceding standard curves of NIST P-256 and NIST-K233 of 128-bit, that calculates up to 256-bit security with fastest and safest ECC curves, presented by [26]. It is intended for ECDH based key agreement protocols to devise strong encrypted keys. In addition, it exhibits robust security [27] and consumes comparatively less memory in terms of key size. Fig. 1 illustrates end-to-end encryption between two IoT devices (M₁ and M₂) that share a message. The M₁ encrypts the message through Curve25519 based encryption before the ECDH key exchange process by devising a secret key S_k. Additionally, Fig. 2 shows elliptic curve-based encryption performance on similar IoT devices through calculating ECC processes costs such as point addition (PA), point doubling (PD), Scaler multiplication and key generation processes. The proposed encryption process uses the least encryption time due to pre-calculated curve point strategy through computational offloading as keys are generated before and only referenced from memory during encryption process.

Through Pb_k⊕N_k (point addition operation of Pb_k and N_k) that results in a large prime positive integer which is considered as a generator curve number G_LRPN for that message. After successful ECDH based key exchange, the secret key from G_LRPN is considered as the new generator curve point G_cp for that session whereas, G_cp will be renewed for next message.

Secret key (SK) has a crucial role in the hash function that can be generated from two parts: 1)

SK can be generated from ECDH key exchanging process.

Table 2 shows secret key (SK) generated by ECDH key exchange procedures where the resulting keys are considered as generator values (G). The proposed technique’s execution cost is calculated using scalar multiplication and encryption process. In Table 2, encryption time (E.T) increases with large mod(p) values. Scalar multiplication calculates large curve points in ECC efficiently by converting the G value into bits. When the bit is 1, P.A is executed and P.D is executed if the bit is 0.

Because elliptic curve key generation requires a lot of work, it determines the cost of computing performance. Curve operations with a maximum size of 255 bits are performed on huge random prime numbers. Fixed-point multiplication, scaler multiplication, point addition, point doubling, multiplicative inverse, and verification are the several operations that make up curves. The two primary curve operations are point-addition and point-doubling, with other operations being their subsets. Fig. 1 compares the costs of our method with methods based on curve operations in Table 2 that used CPUs with higher processing power. The authors in [33], aimed to protect IoT systems from various security threats such as unauthorized access, data breaches, and impersonation attacks by enabling secure verification of identities between IoT devices and servers. The proposed solution employs efficient cryptographic techniques tailored for the resource constraints of IoT devices, ensuring both robust security and minimal computational overhead with an emphasis on side-channel attack defense. In [28], authors investigated the application of the X25519 elliptic curve Diffie-Hellman key exchange on ARM Cortex-M4 processors. The difficulty of securing cryptographic operations on devices with limited resources, such as the ARM Cortex-M4, which is frequently utilized in embedded systems and IoT applications, is discussed in the paper. In [29], a study aimed at enhancing the application of the Curve25519 elliptic curve on ARM microcontrollers was presented which are popular in embedded systems because of their efficiency and low power consumption. The authors suggest methods for improving cryptographic operations’ performance on these devices with limited resources, guaranteeing the effective execution of safe key exchange protocols. Authors in [30] explored pre-computation strategies, which can greatly improve the performance of cryptographic operations by lowering the computational load during execution. They also discussed methods for optimizing the computation of the Montgomery ladder, a technique widely used in elliptic curve cryptography for performing scalar multiplication securely and efficiently. Fig. 1 represents encryption time through a secret key based on the research presented in this section.

This technique is used to pre-calculate curve points for 46 ASCII characters consisting of characters a to z, 0 to 9, and 10 special characters. Other characters are excluded to pre-calculate minimize pre-calculation memory usage. This strategy requires approximately 20% storage in the program memory of IoT devices (for Arduino Mega 2560). Table 3 shows ASCII characters’ dedicated G values and their respective curve points.

These dedicated values are used for encryption by the hash function. Every ASCII character in Table 3 represents a long random prime integer as generator value (G). These generator values are then applied on ECC to find the respective curve points. These curve points are calculated before runtime to reduce runtime computation.

Lightweight hash function (lHf) in the proposed scheme is Curve25519 based lightweight encryption technique. A reference list contains limited 46 ASCII characters, where each character has specific ECC generator value (G). These values contain a unique x and y coordinates’ curve points. lHf encrypts a message (string) based on the set of characters (∑_46∧(i=1)|Chi) individually, such that string s={(Ch_1,Ch_2,…,Ch_n)}s where each character Chi retains a particular large random prime number (LRPN) as a generator value (G) on an elliptic curve. This (G) value is further applied on curve operations (point addition, point doubling) that resulted into a unique x, y curve points (Gcp(x,y)) for that particular ASCII character such that Chi={(Gcp_LRPNi)|∀Gcp_LRPNi ∃ (xi,yi)}. The Gcp_((LRPNi)) is precalculated, with a specific x,y coordinate points on the curve as the pre-calculation strategy saves runtime processing of curve operations such as scalar multiplication, point addition, point multiplication, modulus, and fixed-point arithmetic. lHf first finds corresponding curve points (xi,yi) of every ASCII character Chi in a string s and then scatter the points in two steps. The scattering process further mutates the x,y values to decrease chances of discovering the exact points against statistical attacks. The steps are as following:

Step 1: 1)

α=x_1⊕y_1, where x_1,y_1 are corresponding curve points of first character Ch_1 in string.

Step 2: γ_xi={(γ_x1+x_i)|(γ_x1=α+x_1)∧i>1} γ_yi={(γ_y1+y_i)|(γ_y1=α+y_1)∧i>1} (1)δ_xi={(γ)_xi−δ_(x1))|δ_(x1)=[[(γ]]_x1−β)∧i>1} (2)δ_yi=[[{(γ]]_i−δ_(y1))|δ_(y1)=[[(γ]]_y1−β)∧i>1}

δ_xi and δ_yi are mutated xi,yi curve points for Chi, respectively.

String s containing ASCII characters Chi such that ={([[Ch]]_1,[[Ch]]_2,…,[[Ch]]_n)⊣|∀ Chi ∃ (xi,yi)}, is encrypted into Hf(s) such that Hf(s)={(δ_1,δ_2,…,δ_n)⊣|∀ δ_i ∃ (δ_xi,δ_yi)}, based on Eqs. (1) & (2). The size of δ_xi,δ_yi depends on the size of mod(p) and S_k (secret key).

Fig. 3 illustrates the process of mutating curve points of five ASCII characters. Mutation process is performed as explained in Step 1 and Step 2.

Mutual authentication process is an authentication frame (auth-frame) based authentication key agreeing (AKA) mechanism. Curve25519 is selected for overall elliptic curve encryption because of the speedy calculations during scaler multiplication that best suits the resource constrained devices (as discussed in Section 3.2). All devices in the network contain a unique uniform network identification number (N_k—Network Key) and a public key Pb_k. Similarly, all devices generate new private keys (dP_r1 for sender, dP_r2 for receiver) upon newly generated session key. To ensure good security, we suggest renewing session keys after every successful message acknowledgement from sender (s_1_ack) as shown in msg#6 in Fig. 4. However, to accommodate performance efficiency, the suggested session key renewal time is set to 300 s in this proposed work.

Fig. 4 represents data flow of proposed NHLE-AKA based mutual authentication between M_1 & M_2 whereas Table 4 represents notations used in Fig. 1 with size in bits. The mutual authentication process executes irrespective of network related parameters. The proposed scheme is deployable in all sorts of M2M communication networks.

The following steps can elaborate the auth-frame based mutual authentication between sender M_1 and a receiver M_2 as: 1)

All communicating devices contain pre-shared keys i.e., Pb_k,N_k and a dynamic private key dP_rx. Dynamic private keys are considered as generator points (G) that contain specific x,y coordinate points on a curve such that f_sm(G)={(Gx,Gy)⊣|G∈P} where P=(Pb_k,N_k,dP_r1 for M_1 & dP_r2 for M_2)

S_k resets whereas M_1,2 will renew their respective dynamic private keys dP_rx.

The attacker is in possession of M_1 such that the knowledge of N_k and Pb_k is known. The attacker then replaces it with a fake device fM_1 that calculates dP_r1 through a random number generator and finds curve points G_cps, then sends M_1Sk_1 over to M_2. The M_2 sends back M_2Sk_2 and calculates G_cpr. The Impersonator still need to know |aF| to confirm authentication. |aF| is impossible for the impersonator to know as it’s embedded in the firmware.

The attacker is in possession of M_2 and replaces it with a fake device fM_2 knowing all parameters as discussed above. Similarly, fM_2 calculates dP_r2 and receives M_1Sk_1 from M_1. The M_2 then sends back M_2Sk_2 and calculates G_cpr. fM_2 then receives |aF| from M_1 and now M_1 will have wait to receive |ack| from fM_2. Without |ack|, the authentication process will not proceed. Because of the unavailability of |ack|, M_1 will not confirm authentication and the actual data will not be transmitted to fM_2 hence the session key S_k will expire. Thus, it proves that the proposed scheme is robust against impersonation attacks.

Attacker is consistently monitoring messages between M_1 and M_2 over the transmission channel. MiTM can over time understand and mimic the transmitted data. Similarly in data spoofing, it is possible to analyze M_1Sk_1 and M_2Sk_2 over long period of monitoring and can then predict the keys and eventually discover |aF| and |ack|. However, the proposed scheme is equipped with end-to-end encryption thus it encrypts the authentication frames (|aF| and |ack|). The elliptic curve based end-to-end encryption makes it extremely difficult for MiTM to analyze the transmitted data. Furthermore, a 1-bit mutation in the encrypted data block will produce points at infinity. Thus, M_2 will not be to calculate points at infinity and the whole data block will result in null values in case of a single bit mutation.

The attacker tries to extract data from certain devices by successfully possessing an IoT device. Since the communication pattern of all devices (as shown in Fig. 1) is extremely precise, thus knowing only the pattern, will not allow the impersonator to extract the data or status of other devices despite providing full authorization over M_1 or M_2. The scheme is designed such that M_1 will only know M_2 during single session. Once the session expires, M_1 and M2 will have to mutually re-authenticate each other. Moreover, it is also not possible for the network administrator to decrypt certain transmission data blocks without knowing dynamic private keys dP_r1,2 as dP_rx updates with every session Thus, there exists strong anonymity and privacy for all the devices in the network.

To apply DOS/Replay attacks, the attacker must first connect the mutated device to the network. Attacker should also know set of parameters {Pb_k,N_k,mod(p),Gcp_LRPN} to calculate the exact G_cpx for each dedicated session which is difficult and computationally exhaustive operation. Consequently, either M_1 or M_2 will calculate curve points at infinity thus ECDH process will not proceed. Similar is the case of replay attack, as the message pattern changes in each step as shown in Fig. 4. While the attacker sends identical message patterns consecutively, the corresponding device will calculate curve points at infinity thus the message will be rejected, and session will expire.

The attacker attaches (links) a fake device to extract data and analyze message access code (MAC) pattern. As mentioned previously; to carry out such operation, the attacker must know the exact set of parameters {Pb_k,N_k,mod(p),Gcp_LRPN} to be identified as valid device in the network as M_1 or M_2. Secondly, the received messages at malicious device will have to be decrypted based on session key Sk which is updated on every dedicated timeframe. Additionally, it is computationally extensive to decrypted ECC based encrypted data block where each data block is encrypted with different session key (Sk). Similarly, the attacker will not be able to investigate source code when detached (Unlinked) the device because it is hardcoded into permanent memory (Firmware) as it is extremely difficult to extract and decode data from firmware of a device.

A comparative study of achieving various important security features discovered for M2M communication in a network, is shown in Table 5. The study reflects that existing AKA protocols for M2M communication lack in providing robust security and forfeit link-unlink ability during distinguishable sessions. It can also be observed from Table 5 that the proposed scheme contains ECC’s Curve25519 based end-to-end encryption that improves communication security. Furthermore, the scheme effectively prevents the known attacks in M2M communication networks.

The proposed scheme is implemented on AVR Atmega2560, a resource-constrained IoT device. The device contains 8-bit @ 16-Mhz CPU capability with 4 Kbytes internal memory. In addition, the device’s power ratings are 5 V input with 20 mA current supply. AKA and end-to-end encryption techniques are implemented directly on the specified hardware. However, the networking performance is recorded in Contiki Cooja simulator by using an identical hardware known as SkyMote. In total, 9 different tests were conducted in dynamic topologies for 60 s where every node sends and receives approx. 60 packets.

The implementation of the proposed scheme on the specified hardware required arithmetic operations on large prime-signed integers, which AVR ATmega coding platforms do not support directly. Therefore, we adopted the GMP library that possesses an embedded support library (mini-GMP) for the AVR ATmega hardware family. The GMP library is freeware and applied mostly for multiple precision arithmetic on 32-to-64 bit signed integers and high precision floating points through fast and precision-capable algorithms. Its loops are partly coded in assembly language to deliver fast results. Additionally, the library works with GNU-gcc and C++ and C language platforms. We utilized version 6.2.0 equipped with a mini support library consuming minimum code size with limited functionality which is specially designed for resource constraint devices.

Choosing the right curve and mod(p) in elliptic curve cryptography defines the encryption robustness and performance efficiency. The proposed work targets affordable curve performance during ECDH-based AKA protocols that rely on the efficiency of curve operations such as scalar multiplication. In addition, the curve must exhibit completeness, indistinguishability, and resilience against statistical attacks, twisted ladder and side channel attacks. That is why we adopted the Montgomery curve (as discussed in Section 3) based elliptic curve cryptographic technique as it plays a vital role in ensuring optimized performance and complete curve security for encryption. Moreover, we adopted the proven safe mod(p) values to test the proposed mothed from [34], where many curves are statistically tested against certain mod(p) values and the results are also made public for research purposes.

Contiki is a Linux-based OS specially designed for resource-constraint IoT devices in WSN. It includes a Cooja simulator which simulates nodes (IoT devices), providing platforms for networked, WSN, and 6LoWPAN types of networks. The platform offers monitoring of several node parameters such as transmission power, low power mode, packet delivery ratio, and routing protocols used in TCP/UDP-IP and sensory data for all nodes. It also provides overall network statistics and code-based node analyses which may contain a mixture of nodes. We used Contiki 2.7v which supports MSP430 and Atmel AVR microcontrollers. Fig. 5 offers an illustration of simulation in Contiki Cooja of the proposed scheme where network topology, historical and average power consumption and sensor map simulated data charts are illustrated.

Automated validation of Internet security protocols and applications (AVISPA) is a popular tool [31] for formal security verification of cryptographic protocol in a Linux operating system. It uses the high-level protocol specification language (HLPSL) to model and simulate the presented mutual authentication protocol to verify the security properties. CompTIA advanced security (CAS+) description of the proposed protocol is first converted into Alice (as M₁) and Bob (as M₂) notation which is then applied as input to security protocol animator (SPAN) that simulates the protocol and converts it into HLPSL script. The HLPSL script is then forwarded as input to an intermediate format [32] (IF) translator to analyze it through backend verification models. AVISPA uses the proposed backends, on-the-fly model-checker (OFMC), constraint-logic-based attack searcher (CL-AtSe), satisfiability-based model-checker (SATMC) and tree automata based on automatic approximations for the analysis of security protocols (TA4SP), to verify the goals. Moreover, the proposed backend models execute the protocol via numerous finite iterations until the protocol is deemed safe for the number of sessions or an attack is discovered. We applied three attack models, i.e., OFMC, CLA-AtSe and TASP on the presented security protocol shown in Figs. 11a–c, respectively. It can be observed from the figures that the presented scheme is found safe during all three attack simulations. Additionally, Figs. 12a–c shows the security validation of incoming events (variables before authentication process), in-transit events (variables during the process), and past events (variables after mutual authentication process) of the proposed model.

Since the scheme is specifically designed for resource constrained IoT devices that is why the scheme can only afford limited ASCII characters. The communication performance is not tested in large networks containing numerous nodes and networks where large amount of data is shared. However, the proposed scheme can withstand large networks with limited data blocks in a single session. The scheme provides a maximum of 192-bit curve security. The curve-point table values in Table 3 can be increased for stronger security provisions if required.

The proposed scheme allows many improvements for specific operations:

Introducing large mod(p) based pre-calculated curve points, as shown in Table 3 can result in stronger 256–512-bit curve security for more robust security.