SGX-Based Efficient Three-Factor Authentication Scheme with Online Registration for Industrial Internet of Things

Abstract

The Industrial Internet of Things (IIoT) enhances industrial efficiency but also introduces substantial security challenges. Authentication is a key building block for securing IIoT networks. However, many recent IoT authentication schemes rely on offline registration and transmit temporary identity credentials in plaintext during registration, which exposes them to privileged-user attacks and limits their practicality in complex deployment scenarios. To address these issues, this paper presents an efficient three-factor authentication scheme with secure online registration for IIoT. The proposed scheme leverages Intel Software Guard Extensions (SGX) to protect the registration master key and support online registration. In addition, a dynamic credential update mechanism is introduced to mitigate privileged-user attacks. The security of the scheme is validated through ProVerif-based formal verification and informal security analysis, while its performance is evaluated through comparative analysis and NS-3 simulations. The results demonstrate that the proposed scheme provides enhanced security with low overhead, making it suitable for IIoT environments.

1. Introduction

With the rapid proliferation of the Internet of Things (IoT) and the continuous development of Internet technologies, the Industrial Internet of Things (IIoT) is being increasingly deployed in industrial domains such as smart transportation, power grids, and oil and mining [1,2,3]. IIoT integrates smart IoT sensing devices (ISDs) with real-time data collection and analysis, fundamentally transforming how remote devices communicate and interact with users. Therefore, IIoT is anticipated to transform conventional industrial production and operations by combining Internet connectivity, wireless sensor networks (WSNs), and intelligent ISDs [4]. However, although the convergence of the Internet and IoT improves production efficiency, it also breaks down the physical security boundaries of traditional industrial systems [5]. As a result, IIoT systems are directly exposed to malicious attacks from the Internet. In Iran, for example, the StuxNet worm maliciously targeted nuclear industry equipment and significantly slowed the country’s nuclear research process. In Ukraine, the power grid was attacked by the Blackenergy malware, causing power outages for 225,000 customers and severely disrupting local life. In addition, attackers exploited vulnerabilities in security cameras to access the supervisory control and data acquisition (SCADA) system of an oil pipeline near Refahiye, Turkey, triggering an explosion and causing significant physical and economic losses [6,7]. Therefore, malicious attacks against IIoT have become a persistent and extremely destructive security threat.

As a core security mechanism in IIoT, authentication is a prerequisite for secure system access. However, the open nature of IIoT communication channels, combined with the limited computational and energy resources of ISDs, means that safeguarding the confidentiality and integrity of transmitted data has become a central topic of ongoing research. Prior work suggests that a robust IIoT authentication scheme should meet the following fundamental security and functional requirements: [8,9,10]: lightweight operation, mutual authentication, message integrity, efficiency, anonymity, untraceability, scalability, and forward security. In practice, IIoT deployments often operate in harsh industrial environments, such as those characterized by severe corrosion, high temperature, and high pressure. Nevertheless, most existing IoT authentication schemes assume a strictly offline registration phase [11,12,13] and transmit temporary identity credentials and random numbers in plaintext over the registration channel. Consequently, none of these schemes can simultaneously meet the availability and security requirements of IIoT. Moreover, these authentication schemes primarily focus on external attacks, whereas numerous studies have shown that threats from malicious insiders are often more severe than those posed by external adversaries [14]. Accordingly, it is essential to design a suitable identity authentication protocol with online registration for IIoT environments.

In typical Industrial Internet of Things deployments, gateway nodes (GWNs) must maintain relationship tables that map users to sensing devices in order to enable interactive communication. However, as attack techniques evolve, an internal malicious adversary may obtain the relationship tables and secret keys stored in the GWN [15]. Once the adversary compromises the relationship table, they can easily launch guessing attacks and impersonation attacks. Hence, incorporating a hardware-backed trusted execution environment (TEE) is necessary. At present, commonly deployed TEEs include Intel Software Guard Extensions (SGX), ARM TrustZone, and the Trusted Platform Module (TPM). However, a TPM-based trusted architecture struggles to guarantee trusted execution of a program during runtime. ARM TrustZone typically requires manufacturer-authorized signature verification before code can execute within the secure world, which increases development complexity. By comparison, Intel SGX offers flexible and widely adopted hardware-backed security mechanisms and is therefore well suited as a trusted execution environment for IIoT applications [16]. At the same time, because SGX enclaves are constrained by limited Enclave Page Cache (EPC)-protected memory, only one long-term master key is stored inside the enclave and accessed only through a narrowly defined SGX ECALL-based enclave interface. This design mainly reduces trusted-state management overhead and EPC memory pressure, rather than the standalone complexity of cryptographic operations.

Therefore, to balance the availability and security requirements imposed by the IIoT environment and internal threats, this work offers the following primary contributions.

• We design an efficient three-factor authentication scheme with online registration for IIoT environments. The scheme leverages the security features of Intel SGX to protect the master key and to realize secure online registration. Moreover, the registration parameters are cleared immediately after use at the end of the registration phase, so they are not retained for later reuse, thereby reducing information leakage.
• We design a faster dynamic authentication credential update mechanism that allows each communicating party to independently refresh its temporary identity credentials. Combined with SGX, this mechanism enables dynamic anonymous authentication and effectively resists privileged user attacks.
• We evaluate the security of the proposed scheme using ProVerif-based verification and informal security analysis. Finally, we demonstrate practicality and efficiency via NS-3 simulations and comparative performance evaluation.

2. Related Work

In 2015, Tsai and Lo [17] introduced a secure authentication protocol built upon elliptic-curve cryptography (ECC) together with bilinear pairing operations, thereby preserving the confidentiality of sensitive and private information. However, the use of bilinear pairings introduces high computational overhead, thereby limiting the practicality of their protocol. In 2016, Amin et al. [18] also introduced an efficient authentication scheme for WSNs, featuring identity updating and smartcard revocation. Nevertheless, Jiang et al. [19] pointed out that the scheme remains vulnerable to guessing attacks as well as tracking-based adversarial analysis. To address these vulnerabilities, Jiang et al. developed a protocol grounded in the Rabin cryptosystem and verified its security with ProVerif, achieving resistance against known attacks while remaining computationally efficient for WSNs. In 2018, Wang et al. [20] developed a privacy-preserving signcryption primitive that integrates pseudonyms and attribute-based access control to protect cloud-assisted mobile healthcare systems. Furthermore, Gope et al. [21] designed an authentication method applicable to industrial WSN scenarios that restricts data access to authorized devices in Internet-connected and unattended environments. In the same year, Lee et al. [22] presented a round-efficient protocol using extended chaotic maps, eliminating the need for a centralized trusted authentication server.

Turkanović et al. [23] applied the IoT paradigm to WSNs and developed an authentication mechanism. Unfortunately, Tai et al. [24] reported that the scheme fails to withstand tracking attacks and guessing attacks. Subsequently, Esfahani et al. [25] developed an efficient method tailored to IIoT machine-to-machine communications, reducing the computational load on resource-constrained devices. Moreover, Xue et al. [26] introduced a hash-based authentication approach, and Chuang et al. [27] designed a similar scheme. Nonetheless, Xue et al.’s method lacks forward secrecy and cannot resist privileged user attacks. Chang et al. [28] further proposed a quantum authorization management protocol operating without a central authority. Then, Jia et al. [29] introduced an anonymous authentication method for mobile edge computing, enabling mutual authentication while preserving user anonymity. In dynamic neighboring network settings, Sutrala et al. [30] introduced an Internet of Vehicle (IoV) authentication protocol with privacy protection, whereas Tan et al. [31] presented a blockchain-enabled scheme that supports anonymous authentication and group key establishment in vehicular ad hoc networks. Shifting the focus back to IIoT-specific architectures, Karati et al. [32] introduced a lightweight protocol tailored to the industrial Internet of Things, but Zhang et al. [33] demonstrated that it cannot resist privileged user attacks. Finally, Chen et al. [34] designed a secure protocol suitable for resource-limited IIoT environments based on ECC.

With the increasing sophistication of attack methods and software complexity, Zhang et al. [35] introduced a generic security framework for mobile protocols leveraging ARM TrustZone. In 2016, Balisane et al. [36] presented an authentication scheme that leverages Intel SGX. In 2017, Jiang et al. [37] designed a certificate authority (CA) authentication protocol based on ARM TrustZone, where the CA performs authentication inside the TEE when establishing a session with a trusted application to prevent malicious access to sensitive data. In 2022, Liu et al. [15] presented an SGX-assisted identity authentication scheme for WSNs in which master keys are protected within the enclave, and dynamic credential update mechanisms are incorporated to strengthen security. However, Ahmed et al. [38] revisited Liu et al.’s [15] scheme and showed that it remains vulnerable to desynchronization attacks. Nevertheless, their schemes rely on an additional confirmation round during credential updates and does not provide secure online registration. In 2023, Mao et al. [39] designed a cross-domain IoT device authentication scheme that integrates blockchain and TEEs. Their approach is specifically designed for authentication in multi-domain trust environments. By incorporating blockchain-based trust management, it lowers the burden of cross-domain key administration and reduces reliance on a traditional centralized trusted third party. In 2025, Hou et al. [40] designed a secure protocol for the IoV based on TEE and blockchain. Their study concentrates on vehicular network scenarios, in which privacy protection, robustness against attacks on public communication channels, and stringent real-time communication demands must all be addressed simultaneously.

While several TEE-assisted authentication schemes have been proposed for IoT and related environments [15,39,40], our scheme differs from these works in terms of both system assumptions and overall design goals. In particular, Mao et al. [39] concentrate on enabling interoperability across multiple trust domains, whereas Hou et al. [40] address privacy-preserving authentication for IoV environments. In contrast, our scheme is designed for a practical three-factor authentication scenario within a single administrative domain in the IIoT, a common industrial deployment model under unified management. The novelty of our work lies in jointly supporting secure online registration, master-key protection, lightweight credential refresh, insider-threat mitigation, and practical device lifecycle management within this setting. Accordingly, we enable secure online registration over public channels by protecting the registration master key inside the enclave and discarding one-time registration parameters after completion. We further introduce a lightweight dynamic credential update mechanism to reduce the security impact of leaked gateway-side tables and mitigate privileged-user threats.

3. Network Model

This section outlines the authentication framework and threat model for the considered IIoT environment. It also explains the SGX memory encryption mechanism and discusses its applicability to our scheme.

3.1. Authentication Model

The IIoT network model considered in this study adopts a single administrative-domain architecture composed of three entities: the user, the gateway node (GWN), and the ISD. The user accesses ISDs remotely via the Internet, the sensing devices are responsible for collecting and providing data, and the GWN serves as the identity-authentication intermediary between the user and the sensing devices.

In contrast to cross-domain approaches [39], this study does not consider inter-domain roaming, credential migration across domains, or blockchain-enabled trust coordination among multiple administrative domains. Rather, it concentrates on achieving secure and efficient three-factor authentication within a single IIoT deployment domain. In addition, the ISDs are constrained in terms of resources and remain particularly vulnerable to adversarial threats. Additionally, as noted in [41], the energy consumption of ISDs during communication is closely related to transmission distance. Therefore, we designate the GWN as the authentication intermediary to balance communication security against the energy constraints of ISDs. As illustrated in Figure 1, the authentication model uses the GWN to establish secure communication with sensing devices through the proposed authentication scheme.

3.2. Threat Model

This section adopts the Dolev–Yao (DY) model [42] to characterize adversarial capabilities in the considered IIoT environment. We assume that an attacker $\mathcal{A}$ has the following capabilities:

• Full control of public channels. $\mathcal{A}$ can eavesdrop on, intercept, modify, replay, and drop messages transmitted over public channels.
• Device compromise. $\mathcal{A}$ may obtain the contents of a stolen smartcard via side-channel extraction. Similarly, ISDs may be physically captured, allowing $\mathcal{A}$ to extract stored parameters.
• Insider adversary. $\mathcal{A}$ may also be an insider attempting to abuse granted privileges.
• SGX trust boundary. We assume that $\mathcal{A}$ can completely compromise the untrusted software environment on the gateway side, including the ability to inspect, alter, and replay any information stored in untrusted memory. According to the conventional SGX threat model, plaintext secrets held within enclave-protected memory cannot be directly accessed from outside the enclave boundary [15]. In our scheme, the authentication master key X, together with all intermediate values computed from X, is processed exclusively within enclave-resident execution. Although the untrusted host may observe the input parameters passed to enclave invocations and any non-sensitive outputs returned by the enclave, it cannot directly access the enclave’s internal state. Nevertheless, SGX isolation alone does not eliminate the risk of microarchitectural side-channel leakage, including attacks based on caches, page faults, and speculative execution.

3.3. Intel SGX

Intel SGX offers a trusted execution container, known as an enclave, which partitions a protected region within the application’s address space. This enclave is intended to protect the confidentiality and integrity of the code and data maintained within it [43]. As shown in Figure 2, SGX provides hardware-enforced isolation such that untrusted parts of the process, including privileged system-level software, cannot directly access enclave-resident code or data. The memory used by the enclave is located in the Processor Reserved Memory (PRM). When enclave pages are evicted from the Enclave Page Cache (EPC), the Memory Encryption Engine (MEE) safeguards them by encrypting the pages before they are written to main memory.

Moreover, within the application, the GWN can communicate with the enclave only via constrained ecall/ocall interfaces. When the GWN sends a request to the SGX environment, the untrusted host application delivers the necessary input parameters to the enclave through an ecall, after which the relevant security-sensitive operations are executed internally. In the proposed scheme, these operations primarily involve computations related to the master key X, including the generation of protected parameters during registration and the recomputation of protected values in the dynamic credential update phase. Once these computations are finished, only the protocol-required derived outputs are returned to the host side. Throughout this process, the master key X remains confined within the enclave and is never exposed to untrusted memory.

Furthermore, for transient parameters that are required only within a single registration or update session, the enclave keeps them solely in its internal workspace for the duration of the ongoing computation, and these temporary values are explicitly erased before the corresponding ecall returns. As a result, the original sensitive parameters involved in these operations are not preserved once the secure computation has finished. In this manner, SGX offers a trusted execution environment with hardware-level protection for the master key in the authentication scheme, while also limiting the direct exposure of security-critical data at the GWN.

4. Proposed Scheme

We present a SGX-based novel authentication scheme with online registration for IIoT. The scheme not only implements authentication, session key negotiation, and password update, but also implements user online registration, sensing device dynamic addition, and smartcard revocation. In addition, it is noteworthy that the clocks of the user, GWN, and ISD in the scheme are generally considered to be synchronized by default. At the GWN, all operations related to long-term master secrets are carried out within the SGX-assisted trusted execution environment. Neither the authentication master key X nor the registration-related secret $X_u$ is revealed to untrusted host memory. During the online registration and dynamic credential update procedures, the host transfers the necessary inputs to the enclave via an ecall, while only the computed outputs needed by the protocol are sent back. In addition, temporary variables are erased before the enclave invocation returns, and timestamp-based freshness verification is adopted to resist replay attacks on the public channel. The following subsections describe these phases using the notation summarized in

Table 1. Notations.

Notation	Definition
$SA$	system administrator.
$U_i$	i-$th$ legitimate user.
$SC$	smartcard.
$IS{D}_j$	j-$th$ legitimate sensing device.
$I{D}_i,I{D}_{SC},I{D}_{GWN},S{D}_j$	identity of $U_i$, $SC$, $GWN$ and $IS{D}_j$.
$BI{O}_i$	biometrics of $U_i$.
$P{W}_i$	password of $U_i$.
${\sigma }_i$	biometric-derived secret parameter.
$X_u$	master key for registration.
X	master key of $GWN$.
$SK$	session key.
$T_i,T{S}_i$	current system timestamps.
$R_u,R_g,R_j,K_u,K_s$	random numbers.
$SA$	system administrator.
$\mathcal{A}$	the adversary.
$h(·)$	one-way hash function.
$Gen\left(\right)/Rep\left(\right)$	biometric fuzzy extraction function.
‖	the bitwise concatenation operation.
⊕	the XOR operation.

.

4.1. Initialization Phase

Before deployment, $SA$ needs to initialize the smartcards, gateway nodes and ISDs in offline mode.

$I1$: The $SA$ generates two random values, $X_u,X$, which serve as the registration master key and the authentication master key, respectively. Moreover, $SA$ allocates $I{D}_{SC}$ to each $SC$ and computes $RC=h(X_u\Vert I{D}_{sc}\Vert I{D}_{GWN})$.

$I2$: $SC$ stores $X_u$ in memory, the $GWN$ stores $RC$ in the database and $\{X,X_u\}$ in SGX. Then, $SA$ computes $R{D}_j=S{D}_j\oplus I{D}_{GWN}$ for each ISD and stores $\left\{R{D}_j\right\}$ in the $GWN$.

4.2. User Online Registration Phase

Upon completion of this phase, $U_i$ finishes the online registration procedure through a public communication channel. Each smartcard that has not yet been registered is initialized with a one-time secret $X_u$, while the corresponding token, $RC=h(X_u\Vert I{D}_{sc}\Vert I{D}_{GWN})$, is stored at the GWN in an unused state. The GWN processes a registration request only when the timestamp passes validation and the associated $RC$ has not been consumed. Once registration succeeds, the token $RC$ is removed to ensure that it cannot be reused. The full procedure is illustrated in Figure 3a.

$UR1$: Firstly, $U_i$ inserts an unregistered $SC$ to obtain $I{D}_{sc}$. Then, $U_i$ enters $I{D}_i$, $P{W}_i$ and the biometrics inputs $BI{O}_i$, and then compute ${\sigma }_i$ and ${\tau }_i$. Then, the user obtains the target $GWN$ identification $I{D}_{GWN}$. Once the information has been entered, $SC$ retrieves $T_1$ and $R_u$. Next, $SC$ computes $RC=h(X_u\Vert I{D}_{sc}\Vert I{D}_{GWN})$ and $D{R}_u=R_u\oplus h(T_1\Vert I{D}_{GWN})$.

$UR2$: $SC$ transmits $\{RC,D{R}_u,T_1\}$ to target the $GWN$.

$UR3$: After receiving the registration request, the $GWN$ first verifies the freshness of $T_1$; if the timestamp fails validation, the request is discarded. If $T_1$ is valid, the $GWN$ then checks whether $RC$ is present in the database of unused registration tokens. If no matching record is found, the request is suspended. Otherwise, the $GWN$ determines $I{D}_{GWN}$ and computes $R_u=D{R}_u\oplus h(T_1\Vert I{D}_{GWN})$. Next, it obtains $T_2$, chooses a fresh random value $R_g$, derives $P{D}_u$, and forwards $R_u,R_g,T_2$ to the SGX enclave through an ecall. Within the enclave, the protected secrets are used to generate $T{R}_g=R_g\oplus X$ and $D{R}_g=R_g\oplus h(X_u\Vert R_u\Vert T_2)$. Only the outputs $T{R}_g,D{R}_g$ are returned to the host, after which the temporary variables are erased. Finally, the $GWN$ removes $RC$ so that it cannot be used again.

$UR4$: Once the one-time registration token is invalidated, the $GWN$ stores $P{D}_u,T{R}_g$ for use in subsequent authentication and sends $D{R}_g,T_2$ to $SC$.

$UR5$: $SC$ checks $T_2$. If the timestamp is validated, $SC$ computes $R_g=D{R}_g\oplus h(X_u\Vert R_u\Vert T_2)$, $P{R}_g=R_g\oplus h(I{D}_i\Vert I{D}_{sc}\Vert P{W}_i\Vert {\sigma }_i)$, $P{R}_u=R_u\oplus R_g$, and $V_1=h(I{D}_{sc}\Vert {\sigma }_i\Vert P{W}_i\Vert I{D}_i)$. Subsequently, $SC$ stores $V_1,P{R}_g,P{R}_u,{\tau }_i,h(·)$ and permanently erases the one-time registration secret $X_u$, thereby preventing any reuse of the initialization material.

4.3. Sensing Device Online Registration Phase

The online registration procedure for the ISD is illustrated in Figure 3b.

$SR1$: The ISDs get identity $S{D}_j$ and target $I{D}_{GWN}$. Then, ISDs retrieve the timestamp $T_3$ and compute $R{D}_j=S{D}_j\oplus I{D}_{GWN}$.

$SR2$: The ISD transmits $\{R{D}_j,T_3\}$ to target the $GWN$.

$SR3$: Upon receiving $\{R{D}_j,T_3\}$, the $GWN$ checks $T_3$. If it is freshness, the $GWN$ checks whether the $R{D}_j$ exists in the unregistered list. After confirmation, the $GWN$ computes $S{D}_j=R{D}_j\oplus I{D}_{GWN}$ and deletes $R{D}_j$, which was used in this registration. Then, the $GWN$ selects a random number $R_j$ and transmits $\{S{D}_j,R_j\}$ to SGX. Then, it returns $D{R}_j$. After receiving $D{R}_j$, the $GWN$ obtains $T{C}_j$, $P{D}_j=S{D}_j\oplus I{D}_{GWN}$ and $PT{C}_j$. Finally, the $GWN$ retrieves the current timestamp $T_4$ and stores $\{R{D}_j,D{R}_j\}$ in the database.

$SR4$: The $GWN$ transmits $\{PT{C}_j,T_4\}$ to the ISD.

$SR5$: Upon receiving $\{PT{C}_j,T_4\}$, the ISD checks $T_4$. After confirmation, the ISD stores $\left\{PT{C}_j\right\}$.

4.4. Login Phase

After completing registration, the legitimate user $U_i$ must login to verify their identity. We describe the login process in Figure 4.

$LP1$: $U_i$ inserts $SC$, inputs $I{D}_i$, $P{W}_i$ and biometrics $BI{O}_i$ to compute ${\sigma }_i=Rep(BI{O}_i,{\tau }_i)$, $V_1^{*}=h(I{D}_{sc}\Vert {\sigma }_i\Vert P{W}_i\Vert I{D}_i)$.

$LP2$: $SC$ checks $V_1^{*}=V_1?$ If it is equal, $U_i$ completes the login. Otherwise, the $SC$ refuses this request.

4.5. Authentication and Key Agreement Phase

In this phase, the three entities in the scheme perform mutual authentication. Upon successful authentication, $U_i$ and $IS{D}_j$ generate $SK$ to enable secure communication, as depicted in Figure 4.

Figure 4. The authentication phase.

Figure 4. The authentication phase.

$AKP1$: $SC$ computes $R_g$ and $R_u=P{R}_u\oplus R_g$. Next, $SC$ inputs the target $S{D}_j$ and retrieves the corresponding $I{D}_{GWN}$. Subsequently, $SC$ obtains $T{S}_1$ and a random value $K_u$. $SC$ computes $T{C}_i=h(R_u\Vert R_g\Vert T{S}_1)$, $P{D}_u=R_u\oplus h(R_g\Vert I{D}_{GWN})$, $D{K}_u=K_u\oplus h(T{C}_i\Vert I{D}_{GWN}\Vert T{S}_1)$, $DS{D}_j=S{D}_j\oplus h(T{C}_i\Vert K_u\Vert I{D}_{GWN})$ and $Q_1=HMa{c}_{K_u}(P{D}_u\Vert DS{D}_j\Vert T{C}_j\Vert D{K}_u\Vert T{S}_1)$.

$AKP2$: $SC$ sends $m_1=\{Q_1,P{D}_u,D{K}_u,DS{D}_j,T{S}_1\}$ to target the $GWN$.

$AKP3$: Upon receiving $m_1$, if $T{S}_1$ is freshness, the $GWN$ chooses $T{R}_g$ from $\{P{D}_u,T{R}_g\}$ according to $P{D}_u$, and sends $T{R}_g$ to the secure interface of SGX. Then, interface returns $R_g=X\oplus T{R}_g$. The $GWN$ computes $R_u=P{D}_u\oplus h(R_g\Vert I{D}_{GWN})$, $T{C}_i=h(R_u\Vert R_g\Vert T{S}_1)$, $K_u=D{K}_u\oplus h(T{C}_i\Vert I{D}_{GWN}\Vert T{S}_1)$ and $S{D}_j=DS{D}_j\oplus h(T{C}_i\Vert K_u\Vert I{D}_{GWN})$.

$AKP4$: Checks $Ve{r}_{K_u}(P{D}_u\Vert DS{D}_j\Vert T{C}_j\Vert D{K}_u\Vert T{S}_1,Q_1)=1?$ The $GWN$ computes $P{D}_j=S{D}_j\oplus I{D}_{GWN}$ and chooses $D{R}_j$ according to $P{D}_j$. Furthermore, the $GWN$ transmits $\{S{D}_j,D{R}_j\}$ to the interface of SGX and returns $R_j$. The $GWN$ generates $T{S}_2$ and computes $T{C}_j$, $D{K}_g=K_u\oplus h(T{C}_j\Vert T{S}_2\Vert S{D}_j)$, $PI{D}_{GWN}=I{D}_{GWN}\oplus R_j$, $DI{D}_{GWN}=I{D}_{GWN}\oplus T{C}_j\oplus K_u$ and $Q_2=HMa{c}_{K_u}(S{D}_j\Vert D{K}_g\Vert T{C}_j\Vert PI{D}_{GWN}\Vert T{S}_2)$.

$AKP5$: The $GWN$ sends $m_2=\{Q_2,PI{D}_{GWN},DI{D}_{GWN},D{K}_g,T{S}_2\}$ to the ISD.

$AKP6$: Upon receiving $m_2$, the ISD verifies the freshness of the timestamp $T{S}_2$. Then, the sensing device computes $T{C}_j=PT{C}_j\oplus PI{D}_{GWN}$, $K_u=D{K}_g\oplus h(T{C}_j\Vert T{S}_2\Vert S{D}_j)$, $I{D}_{GWN}=DI{D}_{GWN}\oplus T{C}_j\oplus K_u$ and $R_j=PI{D}_{GWN}\oplus I{D}_{GWN}$. Then, the sensing device checks $Ve{r}_{K_u}(S{D}_j\Vert D{K}_g\Vert T{C}_j\Vert PI{D}_{GWN}\Vert T{S}_2,Q_2)=1?$ If the verification is successful, the sensing device generates a random value $K_s$ along with the current timestamp $T{S}_3$. The sensing device computes $SK=h(K_u\Vert K_s)$, $D{K}_s=K_s\oplus h(T{C}_j\Vert S{D}_j\Vert T{S}_3)$ and $Q_3=HMa{c}_{K_s}(D{K}_s\Vert S{D}_j\Vert K_u\Vert T{C}_j\Vert T{S}_3)$.

$AKP7$: The ISD sends $m_3=\{Q_3,D{K}_s,T{S}_3\}$ to the $GWN$.

$AKP8$: Upon receiving $m_3$, the $GWN$ verifies $T{S}_3$. Next, the $GWN$ obtains $K_s=D{K}_s\oplus h(T{C}_j\Vert S{D}_j\Vert T{S}_3)$ and checks $Ve{r}_{K_s}(D{K}_s\Vert S{D}_j\Vert K_u\Vert T{C}_j\Vert T{S}_3,Q_3)=1?$ If it is valid, the $GWN$ retrieves $T{S}_4$ and computes $DD{K}_s=K_s\oplus h(T{C}_i\Vert I{D}_{GWN}\Vert S{D}_j\Vert T{S}_4)$, $Q_4=HMa{c}_{K_s}(DD{K}_s\Vert I{D}_{GWN}\Vert K_u\Vert T{C}_i\Vert T{S}_4)$.

$AKP9$: The $GWN$ then transmits $m_4$ to $U_i$.

$AKP10$: When $U_i$ receives $m_4$, $U_i$ checks $T{S}_4$. If the check passes, $U_i$ computes $K_s=DD{K}_s\oplus h(T{C}_i\Vert I{D}_{GWN}\Vert S{D}_j\Vert T{S}_4)$ and then verifies whether $Ve{r}_{K_s}(DD{K}_s\Vert I{D}_{GWN}\Vert K_u\Vert T{C}_i\Vert T{S}_4,Q_4)=1?$ If the verification is successful, $U_i$ derives the session key as $SK=h(K_u\Vert K_s)$.

4.6. Dynamic Credential Update Phase

Following each successful authentication and key agreement session, the credentials are updated in a dynamic manner. This process begins after the session key $SK$ has been generated and mutual authentication has been completed. Furthermore, the mechanism incurs only minimal local computational overhead, requiring just a single hash operation at the $IS{D}_j$ side and no extra communication cost, as shown in Figure 4.

$DAC1$: $SC$ computes $R_u^{new}=K_s\oplus T{S}_4$, $P{R}_u^{new}=R_u^{new}\oplus R_g$, and updates $P{R}_u$ with $P{R}_u^{new}$. Similarly, the $GWN$ computes $R_u^{new}=K_s\oplus T{S}_4$, $P{D}_u^{new}=R_u^{new}\oplus P{D}_u\oplus R_g$, and updates $P{D}_u$ with $P{D}_u^{new}$.

$DAC2$: The sensing device computes $R_j^{new}=K_u\oplus T{S}_3$, $T{C}_j^{new}=h(S{D}_j\Vert R_j^{new})$, $PT{C}_j^{new}=T{C}_j^{new}\oplus R_j^{new}\oplus I{D}_{GWN}$, and updates $PT{C}_j$ with $PT{C}_j^{new}$. Similarly, the $GWN$ computes $R_j^{new}=K_u\oplus T{S}_3$, $D{R}_j^{new}=R_j^{new}\oplus D{R}_j\oplus R_j$, and updates $D{R}_j$ with $D{R}_j^{new}$.

4.7. Password Update Phase

An authorized user $U_i$ can update the password autonomously.

$PU1$: $U_i$ inputs $I{D}_i,P{W}_i,BI{O}_i$ to get ${\sigma }_i=Rep(BI{O}_i,{\tau }_i)$, $V_1^{*}=h(I{D}_{sc}\Vert {\sigma }_i\Vert P{W}_i\Vert I{D}_i)$. $SC$ computes $V_1^{*}=V_1?$ Then, $SC$ obtains $R_g=P{R}_g\oplus h(I{D}_i\Vert I{D}_{sc}\Vert P{W}_i\Vert {\sigma }_i)$ and $R_u=P{R}_u\oplus h(R_g\Vert P{W}_i)$.

$PU2$: $U_i$ inputs new password $P{W}_i^{new}$. Then, $SC$ computes $V_1^{new}=h(I{D}_{sc}\Vert {\sigma }_i\Vert P{W}_i^{new}\Vert I{D}_i)$ and $P{R}_g^{new}=R_g\oplus h(I{D}_i\Vert I{D}_{sc}\Vert P{W}_i^{new}\Vert {\sigma }_i)$.

$PU3$: The $SC$ parameters $\{V_1,P{R}_g\}$ are replaced with new parameters $\{V_1^{new},P{R}_g^{new}\}$.

4.8. Smartcard Revocation Phase

In the scenario of Industrial Internet of Things, $SC$ may be lost/stolen. Therefore, we design the smartcard revocation phase, which must be carried out under the supervision of $SA$.

$SR1$: $U_i$ the smartcard into the reader and computes ${\sigma }_i$, and requests $SA$ to revoke the smartcard. $SA$ computes $R_g$, $R_u$, $P{D}_u=R_u\oplus h(R_g\Vert I{D}_{GWN})$ and sends the revocation order to the $GWN$.

$SR2$: Upon receiving $P{D}_u$ and the revocation order, the $GWN$ checks $P{D}_u$. If $P{D}_u$ exists in $\{P{D}_u,T{R}_g\}$, the $GWN$ deletes this record.

$SR3$: $SA$ assigns a new smartcard to the user, and the user registers online.

4.9. Dynamic Sensing Device Addition Phase

In the scenario of IIoT, it is sometimes necessary to register a new sensing device online. Therefore, we design the dynamic sensing device addition phase.

$DSA1$: $SA$ initializes a new sensing device and $SA$ computes $R{D}_j=S{D}_j\oplus I{D}_{GWN}$ and writes $R{D}_j$ into the registry in the $GWN$.

$DSA2$: After the registration information is written, the ISD registers online.

5. Security Analysis

5.1. Formal Security Analysis

ProVerif Simulation

ProVerif is an automatic authentication protocol verification tool in the DY model, and it has been extensively adopted for the formal evaluation of authentication schemes [44,45]. The ProVerif analysis is conducted at the symbolic protocol level. It supports session-key secrecy and authentication properties in the formal model, but does not capture implementation-level threats such as side-channel leakage, SGX microarchitectural attacks, or concrete software/hardware flaws. Moreover, ProVerif supports a wide range of cryptographic primitives, including hash functions as well as symmetric and public-key algorithms. Accordingly, we employ ProVerif to conduct a formal security verification of our scheme.

In Figure 5, we define a public channel $ch$ for online registration, authentication and key agreement. Then, we define the relevant variables and model the encryption function. Moreover, we define two queries $\{sku,sks\}$ to verify the security of $SK$. Finally, the query checks whether the corresponding protocol events are properly matched.

The simulation results in Figure 6 indicate that the proposed scheme preserves the privacy and robustness of the session key and achieves mutual authentication among all participating entities.

5.2. Informal Security Analysis

We examine the security of our scheme through an informal analysis. For the sake of clarity, the following attacks are examined individually, as they reflect distinct adversarial capabilities or threat models, even though some of these attack types may overlap in practical scenarios. The analysis process will be discussed in detail below.

5.2.1. Forward Security

In our scheme, each entity generates a unique random value for every authentication session, which contributes to the derivation of the session key $SK$. This approach ensures that $SK$ is continuously refreshed and unpredictable for each session. Additionally, when an ISD either joins or leaves the IIoT network, neither past nor future session keys can be inferred by any participant. Therefore, the scheme robustly satisfies the forward security essential for IIoT systems.

5.2.2. Privileged User Attack

A privileged user attack denotes an insider threat in which a legitimate yet malicious internal entity seeks to undermine system security by abusing its authorized access privileges. In practice, the GWN needs to maintain authentication-related records $\{P{D}_u,T{R}_g\}$ to support interactions between users and sensing devices. Hence, we consider a strong insider setting in which the adversary can obtain the entire gateway-side table as well as all messages transmitted over public channels.

In the proposed scheme, the authentication master key X is protected inside the SGX enclave and is never exposed to the untrusted GWN environment. The gateway stores only masked values derived from X. For example, even if the adversary obtains $T{R}_g=R_g\oplus X$ and $P{D}_u=R_u\oplus h(R_g\Vert I{D}_{GWN})$, it still cannot recover $R_g$ without X. Consequently, it cannot derive the session key nor forge valid authentication tags, since these values additionally depend on fresh nonces and session-dependent keys. Moreover, the dynamic authentication credential update phase refreshes the gateway-side records after successful sessions, further limiting the usefulness of any previously leaked information. Therefore, leakage of the gateway-side table does not enable impersonation or session key compromise, and the proposed scheme is resilient against privileged user attacks.

5.2.3. Side-Channel Attack

By keeping the master key X confined within the SGX enclave, the proposed scheme reduces direct exposure of sensitive secrets at the protocol-design level. In addition, the dynamic credential update mechanism refreshes the gateway-side records after each successful session, which decreases the persistence and potential reuse of partially leaked session-dependent information. Therefore, compared with schemes that rely on static credentials, the proposed design provides a certain degree of mitigation against the impact of leakage. However, it does not assert complete resistance to all side-channel attacks.

5.2.4. Offline Guessing Attack

An offline guessing attack is a non-interactive attack in which an adversary tries to validate guessed credentials locally by using leaked or stored information, without any direct interaction with the target system. In IIoT scenarios, smartcards may be lost or stolen, allowing an adversary to access the data stored on the card. However, the adversary cannot directly recover sensitive information, such as $I{D}_i,P{W}_i$, because all stored data are protected in hashed or encrypted form. According to the assumed threat model, the adversary may obtain ${PR}_g=R_g\oplus h\left({ID}_i\Vert {ID}_{sc}\Vert {PW}_i\Vert {\sigma }_i\right)$, ${PR}_u=R_u\oplus R_g$, and $V_1=h\left({ID}_{sc}\Vert {\sigma }_i\Vert {PW}_i\Vert {ID}_i\right)$. In particular, offline guessing is infeasible even if the adversary assumes two factors are known, because verifying a guessed $\langle I{D}_i,P{W}_i,{\sigma }_i\rangle$ tuple requires simultaneously matching $V_1=h(I{D}_{sc}\Vert {\sigma }_i\Vert P{W}_i\Vert I{D}_i)$ and the masked value $P{R}_g=R_g\oplus h(I{D}_i\Vert I{D}_{sc}\Vert P{W}_i\Vert {\sigma }_i)$, where $R_g$ remains unknown and is never stored in plaintext on the smartcard. Nevertheless, it is computationally infeasible for an adversary to recover $I{D}_i,P{W}_i$ from $V_1,P{R}_g,P{R}_u$. Hence, the proposed scheme effectively withstands the above attacks.

5.2.5. Online Guessing Attack

An online guessing attack is an interactive attack in which the adversary takes part in protocol execution and depends on system responses to verify guessed credentials. Under the assumed threat model, the adversary can eavesdrop on the public channel and obtain the transmitted messages. Based on this capability, the adversary may attempt to perform an online guessing attack as follows.

• The adversary can get $P{D}_u=R_u\oplus h(R_g\Vert I{D}_{GWN})$, $D{K}_u=K_u\oplus h(T{C}_i\Vert I{D}_{GWN}\Vert T{S}_1)$ from $m_1$, get $D{K}_g=K_u\oplus h(T{C}_j\Vert T{S}_2\Vert S{D}_j)$ from $m_2$, get $D{K}_s=K_s\oplus h(T{C}_j\Vert S{D}_j\Vert T{S}_3)$ from $m_3$, and get $DD{K}_s=K_s\oplus h(T{C}_i\Vert I{D}_{GWN}\Vert S{D}_j\Vert T{S}_4)$ from $m_4$ to compute the session key.
• When the adversary wants to obtain $K_u$ or $K_s$, the adversary must get $T{C}_i$, $T{C}_j$, $I{D}_{GWN}$ and $S{D}_j$. However, the information $T{C}_i,T{C}_j,I{D}_{GWN},S{D}_j$ is transmitted only in hashed form. As a result, the adversary cannot simultaneously recover two unknown parameters through a guessing attack.

5.2.6. Tracking Attack

The adversary can track user $U_i$ and $IS{D}_j$ according to the occurrence frequency of tracking entity information. According to the above analysis of online guessing attack, the adversary can obtain $m_1=\{Q_1,P{D}_u,D{K}_u,DS{D}_j,T{S}_1\}$, $m_2=\{Q_2,PI{D}_{GWN},DI{D}_{GWN},D{K}_g,T{S}_2\}$, $m_3=\{Q_3,D{K}_s,T{S}_3\}$ and $m_4=\{Q_4,$$DD{K}_s,T{S}_4\}$. We can find that $Q_1$, $P{D}_u$, $D{K}_u$, $DS{D}_j$, $Q_2$, $D{K}_g$, $Q_3$, $D{K}_s$, $Q_4$, and $DD{K}_s$ are dynamic in each authentication. This is achieved by incorporating random nonces and timestamps into the computations. Moreover, the scheme incorporates a dynamic credential update phase for authentication. Consequently, an adversary cannot track network entities using these dynamically changing parameters.

5.2.7. Replay Attack

A replay attack arises when an adversary captures previously transmitted messages and resends them in an attempt to masquerade as a legitimate participant. In the proposed scheme, when a message containing timestamp $T{S}_x$ arrives at local time $T_{\mathrm{cur}}$, the receiver verifies whether $0<T_{\mathrm{cur}}-T{S}_x\le \mathrm{\Delta }T$, where $\mathrm{\Delta }T$ denotes the maximum tolerable transmission delay. If this requirement is violated, the message is rejected immediately. Consequently, even if an adversary intercepts and replays $m_2=\{Q_2,PI{D}_{GWN},DI{D}_{GWN},D{K}_g,T{S}_2\}$ or $m_3=\{Q_3,D{K}_s,T{S}_3\}$, the resent message will be discarded once it lies outside the acceptable time interval.

More importantly, the authentication values $D{K}_g$ and $D{K}_s$ are not independent message tags, they are generated from fresh session-dependent elements, including the current random values, temporary authentication credentials, and the derived session key, together with the timestamp. Hence, after receiving $m_2$ or $m_3$, the verifier does not only check $T{S}_2$ or $T{S}_3$, but also recomputes the corresponding authentication value and compares it with the received one. If an adversary tampers with a replayed message within the valid $\mathrm{\Delta }T$ window, the modified $D{K}_g$ or $D{K}_s$ will no longer match the recomputed value, and the verification fails immediately. Therefore, the proposed scheme can effectively resist replay attacks.

5.2.8. Man-in-the-Middle Attack

The adversary can intercept messages $m_1,m_2,m_3,m_4$, but these messages are hashed and updated dynamically. Any attempt to reuse or alter them will result in authentication failure. Therefore, the proposed scheme provides effective resistance to man-in-the-middle attacks.

5.2.9. Sensing Device Capture Attack

A sensing device capture attack describes a physical-compromise threat in which an adversary seizes a device, extracts the data stored locally on it, and then attempts to exploit that information for further attacks. Based on the preceding analysis, an adversary may physically compromise an ISD and thereby obtain the stored parameter $PT{C}_j$. However, an adversary fails to successfully get $T{C}_j$ from $PT{C}_j$. We suppose the adversary tries to use a guessing attack to guess $T{C}_j$. The probability of success is $1/2^{160+160}$, which is almost impossible to succeed. Therefore, our proposed scheme in this paper can successfully resist sensing device capture attacks.

5.2.10. Security Comparison

This section compares our scheme with related schemes with respect to security and functional properties, with detailed results summarized in

Table 2. Security and functionality comparison.

Property	[46]	[47]	[48]	[49]	[50]	[51]	Ours
Online registration	✕	✕	✕	✕	✕	✕	✔
Dynamic credential	✕	✕	✕	✔	✔	✕	✔
Mutual authentication	✔	✔	✔	✔	✔	✔	✔
Forward security	✔	✕	✔	✔	✔	✔	✔
Privileged user attack	✔	✕	✔	✕	✕	✔	✔
Offline guessing attack	✕	✔	✔	✔	✔	✔	✔
Online guessing attack	✔	✔	✔	✔	✔	✔	✔
Tracking attack	✕	✕	✕	✔	✔	✕	✔
Replay attack	✔	✔	✔	✔	✔	✔	✔
Man-in-the-middle attack	✕	✔	✔	✔	✔	✔	✔
Sensing devices capture attack	✕	✕	✕	✔	✕	✕	✔
Mitigating side-channel attack	✕	✕	✕	✕	✕	✔	✔

.

6. Performance Analysis

6.1. Analysis Basis

We quantify the computational overhead by accounting for the dominant operations employed in our scheme, where the XOR operation and the bitwise concatenation operation are not included. Moreover, Wang et al. [52] reported that invoking the SGX interface incurs an additional latency of only about $20\mathrm{\mu }$s. Therefore, we also ignore the computational delay introduced by SGX. Following Fan et al. [53], we assume that the execution time on $U_i$ and $IS{D}_j$ is comparable to that measured on a Raspberry Pi, while the function runtime at the GWN is equal to that of a personal computer. The dynamic credential update introduces negligible overhead because it requires only XOR operations at the user and gateway sides, together with a single hash operation at the $IS{D}_j$ side, and does not incur any additional communication cost. The runtimes of several functions used in the scheme are shown in

Table 3. The running time of several operations.

Notation	Operation	Raspberry Pi	Computer
$T_H$	Hash function	0.02 ms	0.003 ms
$T_R$	Fuzzy extractor	2.226 ms	−
$T_S$	AES encryption/decryption	0.142 ms	0.05 ms

. Similarly, we assume that the timestamp length is 32 bits, while the identity, secret value, and random number are each 160 bits. The hash output length is assumed to be 160 bits, and an elliptic-curve point multiplication yields a 320-bit point representation. Moreover, we assume that symmetric encryption produces ciphertexts whose lengths match those of the corresponding plaintexts.

6.2. Computation Overhead

We compare the computation overhead with that of six representative lightweight authentication schemes. As shown in

Table 4. Computation overhead.

Schemes	${\mathit{U}}_{\mathit{i}}$	$\mathbf{GWN}$	${\mathbf{ISD}}_{\mathit{j}}$	Total/ms
Lee et al. [46]	$8T_H+T_R$	$7T_H+2T_S$	$7T_H$	2.647
Ryu et al. [47]	$13T_H+T_R$	$14T_H$	$12T_H$	2.768
Wu et al. [48]	$13T_H+T_R$	$15T_H$	$4T_H$	2.543
Chaudhry et al. [49]	$20T_H+T_R$	$14T_H$	$10T_H$	2.868
Li et al. [50]	$11T_H+T_R$	$13T_H$	$6T_H$	2.605
Wu et al. [51]	$10T_H+T_R$	$6T_H$	$12T_H$	2.684
Ours	$10T_H+T_R$	$13T_H$	$6T_H$	2.585

and Figure 7c, we can observe that the computation overhead of our scheme on $IS{D}_j$ is slightly higher than that of Wu et al. [48]. Moreover, in Figure 7a,b, the computation overhead of our scheme on $U_i$ and the GWN is also higher than that of Lee et al. [46] and Wu et al. [51], respectively. In addition, we concentrated most of the computation is concentrated on the GWN, and Table 4 and Figure 7d show that our scheme has the smallest total computation overhead.

6.3. Communication Overhead

We contrast the communication overhead with six existing authentication schemes in the same domain. As shown in

Table 5. Communication overhead.

Schemes	${\mathit{U}}_{\mathit{i}}$/Bits		$\mathit{GWN}$/Bits		${\mathit{ISD}}_{\mathit{j}}$/Bits		Total/Bits
	XMT	RX	XMT	RX	XMT	RX
Lee et al. [46]	672	672	1824	1472	800	1152	3296
Ryu et al. [47]	672	544	1568	1184	512	1024	2752
Wu et al. [48]	992	672	1184	1344	352	512	2528
Chaudhry et al. [49]	672	864	1376	1184	512	512	2560
Li et al. [50]	832	512	1184	1184	352	672	2368
Wu et al. [51]	672	352	1504	1344	672	1152	2848
Ours	672	352	1024	1024	352	672	2048

, XMT and RX represent the transmit and receive actions, respectively. It can be concluded from Table 5 that our scheme has the smallest communication overhead on the user and GWN side. Additionally, Figure 8a indicates that the communication overhead on the resource-constrained $IS{D}_j$ side is slightly higher than that of Wu et al. [48]. However, as illustrated in Figure 8b, our scheme exhibits the lowest total overhead among the compared schemes.

6.4. NS-3 Simulation

We employ NS-3 [54] to evaluate the network-level performance of the proposed scheme in terms of two widely used metrics, namely network throughput and end-to-end latency. All simulations are conducted on Ubuntu 16.04.7 LTS and run for 1600 s. In the simulation topology, a gateway is placed at the center of a $150\mathrm{m}\times 150\mathrm{m}$ area. Users are uniformly and randomly distributed in this area and move according to a random mobility model with speeds ranging from 0 to 3 m/s. ISDs are deployed in an annular region centered at the gateway, with an inner radius of 20 m and an outer radius of 80 m. All entities communicate over a wireless channel using the IEEE 802.11a standard at 2.4 GHz. To assess scalability, we consider five scenarios in which the number of users is fixed at $U_i=5$, while the number of sensing devices varies as $IS{D}_j\in \{10,20,30,40,50\}$.

6.4.1. End-to-End Delay

End-to-end delay is a fundamental network performance metric, defined as the average time required for a message to be transmitted from the sender to the receiver. The simulation results are illustrated in Figure 9a. As the number of sensing devices increases, the end-to-end delay of all schemes gradually increases due to higher channel contention and longer transmission paths. The proposed scheme exhibits slightly higher latency compared with the schemes of Wu et al. [48] and Chaudhry et al. [49]. This may be attributed to the combined communication and processing overhead introduced by the additional security mechanisms in the proposed scheme.

6.4.2. Network Throughput

Network throughput measures the amount of successfully delivered data per unit time, and the corresponding results are shown in Figure 9b. As the number of sensing devices grows, the throughput of all schemes decreases, which can be attributed to increased channel contention and packet collisions. The proposed scheme achieves slightly lower throughput than the baseline schemes under the tested settings. This behavior is primarily related to the additional control information introduced by the authentication exchanges, which increases the communication burden during protocol execution.

Overall, the simulation results indicate that the proposed scheme maintains acceptable network-level performance under increasing network scale, while providing stronger security guarantees. The observed performance differences reflect the trade-off between security functionality and communication overhead, and they suggest that the proposed design remains practical for large-scale IIoT application scenarios.

7. Conclusions

This paper presents an efficient three-factor authentication scheme with secure online registration for IIoT, aiming to balance availability requirements in open environments and security requirements against insider threats. By leveraging Intel SGX, the registration master key is protected within a hardware-enforced trusted execution environment, enabling secure online registration. In addition, we introduce a lightweight dynamic credential update mechanism to mitigate privileged-user attacks. The security of the proposed scheme is validated through ProVerif and informal analysis. Comparative evaluation against six representative schemes and NS-3 simulations further demonstrate that our scheme provides stronger security guarantees with competitive overhead, indicating practical applicability in large-scale IIoT deployments.