A Scalable Group Authentication Protocol for IoT Based on PUF-Derived Bases in Inner Product Spaces

This paper presents a scalable group authentication and key agreement protocol for dynamic IoT environments that integrates Physical Unclonable Function (PUF)-derived device bases with inner product space projections. During registration, each device is assigned a private basis Bᵢ B i derived from its PUF responses, enabling efficient group authentication without per-device centralized verification and thereby mitigating long-term reliance on the group manager (GM). The protocol provides single-broadcast operations for member joining and leaving as well as decentralized group key updates. Formal security analysis under the Real-or-Random (ROR) model and experimental evaluation demonstrate robustness against common attacks, low communication overhead (6.5- $$-$$ - 7.9 KB for 100 devices), and low authentication latency (1.135 ms for members and 0.051 ms for guests).