Lightweight Secure Authentication for IoT Devices: A Systematic Literature Review
TL;DR
A systematic literature review based on the PRISMA methodology, encompassing 45 peer-reviewed articles published between 2021 and 2025 on lightweight secure authentication for IoT devices, indicates that, while ECC-based and PUF-based protocols exhibit the strongest overall risk mitigation profiles, considerable unmitigated risks persist across all categories.
Abstract
: The rapid proliferation of Internet of Things (IoT) devices across smart homes, healthcare facilities, industrial networks, and smart cities has raised critical security concerns, particularly regarding device authentication. IoT devices are typically characterized by limited computational resources, constrained memory, and restricted energy budgets, which renders the deployment of traditional cryptographic protocols infeasible; consequently, lightweight authentication schemes are required. Although numerous lightweight authentication protocols have been proposed, a systematic risk evaluation of such protocols against established threat modeling frameworks remains largely absent from the existing literature. This paper presents a systematic literature review (SLR) based on the PRISMA methodology, encompassing 45 peer-reviewed articles published between 2021 and 2025 on lightweight secure authentication for IoT devices. The review integrates the STRIDE threat modeling framework for systematic threat identification with the DREAD risk assessment model for quantitative risk prioritization across authentication protocol categories. The protocols reviewed include Physical Unclonable Function (PUF)-based, Elliptic Curve Cryptography (ECC)-based, blockchain-based, multi-factor, Authenticated Encryption with Associated Data (AEAD)-based, post-quantum, and zero-knowledge proof authentication techniques. Our STRIDE-DREAD analysis indicates that, while ECC-based and PUF-based protocols exhibit the strongest overall risk mitigation profiles, considerable unmitigated risks persist across all categories, particularly in spoofing and information disclosure threats. The findings reveal critical gaps in real-world deployment validation, post-quantum readiness, cross-domain interoperability, and alignment with established risk management standards. This review contributes a risk-centric classification framework, quantitative risk scores per protocol category, and actionable research directions for the