Recently, NIST has standardized various security algorithms to provide confidentiality, integrity, and authenticity in resource-limited IoT devices. These algorithms are based on lightweight cryptography, which requires fewer resources to maintain security in IoT environments with constrained resources. By employing these algorithms, lightweight security mechanisms can be designed to meet security requirements efficiently. Authentication techniques are fundamental for secure communication in resource-limited IoT environments. However, most existing authentication protocols rely on conventional asymmetric and symmetric cryptographic primitives, which demand high computational resources from IoT devices, leading to communication delays in latency-sensitive applications. This paper proposes an authentication protocol called RePUF-IoT, utilizing the TinyJAMBU authenticated encryption scheme and reconfigurable PUF and hashing functions for secure access to medical data stored on a healthcare server. One-time PUF enables RePUF-IoT to achieve robust resilience against machine learning and modeling attacks. RePUF-IoT establishes a secure communication channel between entities in the healthcare system. Its resilience against various security attacks is validated through both formal and informal security analyses. Additionally, performance evaluations show that RePUF-IoT enhances security while reducing communication overhead by 32%–64 and time required for execution by 88%–94%.

With the widespread utilization of Internet-enabled smart devices (SDs), the Industrial Internet of Things (IIoT) has become prevalent in recent years. SDs exchange information through the open Internet, which creates security and privacy concerns for the exchanged information. To address these concerns, various solutions exist in the literature which, because of high computational and communication overheads, are not appropriate for the resource-constricted IIoT environment. This article proposes a resource-efficient authentication protocol for the IIoT, called REAP-IIoT, which employs a lightweight cryptography (LWC)-based authenticated encryption with associative data (AEAD) primitive AEGIS along with hash function. LWC-based AEAD primitives are suitable for resource constraint SDs because they require fewer computational resources. Moreover, REAP-IIoT renders the privacy-preserving user authentication functionality and establishes a session key (SK) between SDs deployed in the IIoT environment and users. Both user and SD utilize the established SK for encrypted communication. The security of SK, established during the authentication and key exchange (AKE) process of REAP-IIoT, is validated through the broadly accepted random or real model. Besides, Scyther-based security verification is conducted to illustrate that REAP-IIoT is secure and can protect the man-in-the-middle and replay attacks. Additionally, the informal security analysis is carried out to show that REAP-IIoT is protected against various covert security risks. A thorough comparison reveals that REAP-IIoT renders enhanced security characteristics apart from its low communication, storage, and computational overheads than the relevant AKE protocols.