Abstract: With the widespread adoption of smart home devices,the resource-constrained nature of these devices and the diverse array of potential attack threats present significant challenges to traditional security protocols.In particular,the popular cloud-based smart home Internet of Things(IoT) technologies,while enhancing the intelligence and management efficiency of household devices,have also introduced more complex control models compared to previous systems.Specifically,users can set control rules on the cloud platform for automated device management or remotely control household devices via Apps provided by smart home manufacturers.However,in both control modes,if the identity of the remote controller is not authenticated and a secure session key is not established,attackers may send malicious commands to household devices,thus endangering home security.However,existing security solutions do not address these two mainstream control models and struggle to balance computational overhead,communication efficiency,and security.This highlights the need for a lightweight and efficient authentication and key negotiation protocol.Therefore,to address the security risks in these two control scenarios,this paper proposes a lightweight bidirectional authentication and key negotiation scheme based on elliptic curve cryptography for cloud platforms and smart devices,as well as a bidirectional authentication and key negotiation scheme between users and smart devices,enabling efficient and secure authentication between remote controllers and household devices.The security of the proposed schemes is analyzed using the formal verification tool ProVerif and heuristic methods.A comparison with similar solutions in terms of both security and performance de- monstrates that the proposed scheme can offer more security features while maintaining lightweight performance requirements.

Key words: Cloud-assisted smart home, Mutual authentication, Key agreement, Lightweight authentication protocol, Formal verification