A Lightweight, Forward-Secure, and Cloning-Resistant Authenticated Encryption Scheme for Data Transmission in Heterogeneous IoT Networks

The rapid growth of the Internet of Things (IoT) in safety–critical applications requires lightweight and robust security mechanisms for resource–constrained devices. Existing authentication and key agreement schemes, including that of Al-Hejri et al., suffer from critical weaknesses, such as state desynchronization, lack of sender-forward secrecy, non–atomic authenticated encryption, replay and device cloning vulnerabilities, and insufficient formal verification. This paper introduces FRACE–IoT, a lightweight, hardware–bound forward–secure, and cloning–resistant authenticated encryption scheme for heterogeneous four–tier IoT networks. The proposed approach combines Curve25519 cryptography, physical unclonable functions, authenticated ChaCha20–Poly1305 encryption, and HKDF–BLAKE3 key derivation within a single–pass key establishment architecture that achieves sender-forward secrecy and hardware-enforced protection against credential extraction. Security analysis and formal verification using the BAN logic and the AVISPA tool under the Dolev–Yao model confirm session key security, mutual belief, and robust resistance to major cyber-attacks. Experimental evaluation on real embedded hardware IoT boards, namely, FIT IoT–LAB M3 and Nordic nRF52840DK, demonstrates that FRACE–IoT achieves a reduced computation cost of 187.92 ms, communication overhead of 1344 bits, and a total energy consumption of 210.10 mJ, making it suitable for efficient and scalable IoT security deployment.