A gateway-optimized certificateless authentication scheme with dynamic anonymity for resource-asymmetric smart environments

• Reasonable allocation of system resources to avoid threats from malicious gateways. • One-time password method based on hash chains to realize full dynamic anonymity. • Fuzzy extractor to enable two-factor authentication including user biometrics. • Dynamic update of authentication employs random numbers rather than timestamps. The rapid evolution of Internet of Things (IoT) demands secure and lightweight authentication schemes for resource-asymmetric environments, where gateways are powerful but user and device sides are constrained. Existing authentication and key agreement (AKA) protocols often fail to provide dynamic anonymity, resist malicious gateways, and support low-entropy passwords. To address these limitations, we propose a certificateless AKA scheme that combines a one-time password algorithm based on hash chains (HOTP) with fuzzy extractors for multi-factor authentication. The scheme ensures full dynamic anonymity, resists replay and impersonation attacks, and eliminates reliance on time synchronization. We formally verify its security using ProVerif and provide informal analysis. Performance comparisons demonstrate that the proposed scheme significantly reduces computational overhead while enhancing security, outperforming existing methods. These results confirm its suitability for secure, scalable IoT applications.