A Lightweight Authentication Mechanism for M2M Communications in Industrial IoT Environment

TLDR

In the emerging industrial Internet of Things, machine‑to‑machine communication is essential but existing protocols rely on asymmetric cryptography, imposing high computational costs that strain resource‑constrained devices and expose security vulnerabilities. The study aims to develop a lightweight security mechanism for M2M communications in IIoT to enable secure, efficient operation. The authors propose an authentication scheme that uses only hash and XOR operations to provide mutual authentication, session key agreement, identity confidentiality, and low computational, communication, and storage overhead. The scheme achieves low overhead while resisting replay, man‑in‑the‑middle, impersonation, and modification attacks, demonstrating its suitability for resource‑constrained IIoT devices.

Abstract

In the emerging industrial Internet of Things (IIoT) era, machine-to-machine (M2M) communication technology is considered as a key underlying technology for building IIoT environments, where devices (e.g., sensors, actuators, and gateways) are enabled to exchange information with each other in an autonomous way without human intervention. However, most of the existing M2M protocols that can be also used in the IIoT domain provide security mechanisms based on asymmetric cryptography resulting in high computational cost. As a consequence, the resource-constrained IoT devices are not able to support them appropriately and thus, many security issues arise for the IIoT environment. Therefore, lightweight security mechanisms are required for M2M communications in IIoT in order to reach its full potential. As a step toward this direction, in this paper, we propose a lightweight authentication mechanism, based only on hash and XOR operations, for M2M communications in IIoT environment. The proposed mechanism is characterized by low computational cost, communication, and storage overhead, while achieving mutual authentication, session key agreement, device's identity confidentiality, and resistance against the following attacks: replay attack, man-in-the-middle attack, impersonation attack, and modification attack.