A Lightweight Zero-Trust Authentication and Key Agreement Scheme for the Industrial Internet of Things

The Industrial Internet of Things (IIoT) demands authentication that protects resource-constrained field devices, supports fine-grained access control, and reduces reliance on implicitly trusted gateways. Existing IIoT authentication and key agreement schemes mainly verify cryptographic identity and establish session keys, but provide limited support for zero-trust access decisions after authentication such as role-specific operation control, gateway-side relation protection, emergency override, and context-aware re-verification. This paper proposes a lightweight zero-trust authentication and key agreement scheme for IIoT. The scheme embeds role-, device-, environment-, and behavior-aware control points into the authentication flow, protects gateway-side authentication relations and operator–asset mappings using secGear-based confidential computing, and supports pseudonym-based identity protection and break-the-glass emergency access. To complement deterministic access control, an optional auxiliary risk evaluation module provides trust evidence from contextual and operator-state signals without becoming part of the cryptographic critical path. This module is used to trigger re-verification, privilege degradation, audit escalation, or session termination before high-risk control privileges are released; it does not replace cryptographic authentication or constitute a formal guarantee of coercion detection, and the cryptographic layer remains fully functional and formally analyzable even when the auxiliary risk evaluation module is disabled. BAN logic and AVISPA analyses verify the cryptographic authentication and key agreement layer, while a comparative overhead analysis under an analytical operation count basis indicates low computation and communication cost relative to representative resource-constrained IoT authentication schemes.