Lightweight Zero-Knowledge Proof-Based Cryptographic Protocols for Secure and Privacy-Preserving Wearable IoT

Abstract

Wearable Internet of Things (IoT) devices continuously capture physiological, behavioural, and locational data that are highly sensitive, yet the microcontrollers embedded in these devices possess only kilobytes of RAM, sub-100 MHz clock speeds, and milliampere-hour battery budgets. Conventional authentication and credential-verification mechanisms based on RSA, bilinear pairing, or heavyweight public-key infrastructure impose computation, bandwidth, and energy costs that are incompatible with such constraints, while simultaneously exposing raw or derived biometric data during verification. This paper proposes a lightweight, elliptic-curve-based Zero-Knowledge Proof (ZKP) framework that enables wearable devices to authenticate themselves and attest to properties of their sensed data without revealing the underlying secret or raw biosignal. The framework instantiates a Sigma-protocol-based commit-challenge-response exchange, hardened into a non-interactive zero-knowledge (NIZK) mode via the Fiat–Shamir heuristic for asynchronous wearable-to-gateway communication, and layers batched verification, session-key derivation, and revocation handling on top of a five-layer architecture spanning the sensing, prover, edge-gateway, verification, and application tiers. A formal security analysis establishes completeness, soundness, and honest-verifier zero-knowledge, and shows resistance to replay, man-in-the-middle, impersonation, and linkability attacks under the elliptic-curve discrete logarithm assumption. Simulation on a Cortex-M4-class microcontroller (secp256r1, 128-bit security) shows that the proposed protocol reduces prover-side computation by up to 91% relative to RSA-based ZKP baselines and by 58% relative to standard ECC-Schnorr identification, cuts communication overhead to 80 bytes per authentication, and reduces cumulative energy consumption by approximately 86% over 300 authentication rounds on a coin-cell-class power budget. These results indicate that carefully engineered ZKP protocols are practically deployable on constrained wearable hardware and offer a viable path toward privacy-preserving, mathematically verifiable trust in remote health monitoring, fitness analytics, and consumer wearable ecosystems.