  The Internet of Things (IoT) has improved people's lives by seamlessly
integrating into many facets of modern life and facilitating information
sharing across platforms. Device Authentication and Key exchange are major
challenges for the IoT. High computational resource requirements for
cryptographic primitives and message transmission during Authentication make
the existing methods like PKI and IBE not suitable for these resource
constrained devices. PUF appears to offer a practical and economical security
mechanism in place of typically sophisticated cryptosystems like PKI and IBE.
PUF provides an unclonable and tamper sensitive unique signature based on the
PUF chip by using manufacturing process variability. Therefore, in this study,
we use lightweight bitwise XOR, hash function, and PUF to Authenticate IoT
devices. Despite several studies employing the PUF to authenticate
communication between IoT devices, to the authors' knowledge, existing
solutions require intermediary gateway and internet capabilities by the IoT
device to directly interact with a Server for Authentication and hence, are not
scalable when the IoT device works on different technologies like BLE, Zigbee,
etc. To address the aforementioned issue, we present a system in which the IoT
device does not require a continuous active internet connection to communicate
with the server in order to Authenticate itself. The results of a thorough
security study are validated against adversarial attacks and PUF modeling
attacks. For formal security validation, the AVISPA verification tool is also
used. Performance study recommends this protocol's lightweight characteristics.
The proposed protocol's acceptability and defenses against adversarial assaults
are supported by a prototype developed with ESP32.
