An OAuth 2.0 and Lightweight Cryptography Framework for Secure IoT Communication and Authentication

The rapid evolution of the Internet of Things (IoT) has transformed key sectors such as healthcare, manufacturing, smart homes, and transportation by enabling autonomous and real-time communication among interconnected devices. These advancements support the growing demands of digital societies where efficiency, automation, and data-driven decision-making are increasingly critical. As IoT ecosystems continue to expand, they introduce new layers of complexity and significantly elevate the scale of security challenges, particularly in maintaining trustworthy communication and robust authentication mechanisms [1].

Many IoT devices operate under severe resource constraints, including limited processing power, small memory capacities, and strict energy budgets. These limitations often prevent the deployment of conventional security mechanisms and leave devices vulnerable to a wide range of attacks. Common threats include data breaches, device manipulation, spoofing, unauthorized access, and Distributed Denial of Service (DDoS) attacks that can disrupt critical services [2]. As IoT infrastructures increasingly serve as essential components of socio-technical systems—such as healthcare delivery, industrial automation, and smart-city operations—strengthening both device-level and system-level security has become an urgent priority.

OAuth has emerged as a promising authorization protocol capable of addressing some of these challenges. OAuth enables secure and granular access control while preventing the exposure of user credentials, which reduces the risk of identity theft and unauthorized system access [3]. Its use of temporary access tokens allows controlled and time-bound permissions that can be easily revoked when necessary. However, implementing OAuth in constrained environments remains challenging due to the computational cost of cryptographic operations and token validation processes.

Concurrently, lightweight cryptographic algorithms offer a practical solution to the resource limitations of IoT devices. Algorithms such as SPECK, PRESENT, and ChaCha20 provide confidentiality and integrity with significantly lower computational and energy requirements than traditional schemes like AES or RSA [4, 5]. Theoretically, the synergy between OAuth’s authorization framework and lightweight cryptography’s efficiency provides a robust foundation for secure and scalable IoT communication [6]. However, despite this conceptual potential, the integration of these technologies has seen limited empirical validation. Existing work seldom compares them with established IoT security standards such as Authentication and Authorization for Constrained Environments (ACE-OAuth), OAuth-IoT, Datagram Transport Layer Security (DTLS), or Object Security for Constrained RESTful Environments (OSCORE), leaving a gap in understanding their real-world performance, interoperability, and feasibility on low-cost, resource-constrained devices.

Existing literature has proposed adaptations of OAuth 2.0 for IoT or hybrid authorization mechanisms, such as the ACE-OAuth framework for constrained environments (RFC 9200) [7]. Yet, the majority of these contributions remain conceptual, confined to simulation environments, or limited to isolated prototypes [8]. Empirical validation in realistic deployments, such as heterogeneous smart home infrastructures or industrial networks, is noticeably scarce. Furthermore, evaluations of lightweight cryptography often prioritize algorithmic benchmarking over system-level interoperability assessments [9]. To bridge these gaps, this study adopts the Design Science Research Methodology (DSRM) to design, implement, and evaluate a unified framework. This framework integrates OAuth-based authorization with lightweight cryptographic algorithms, validated on actual resource-constrained hardware, including the ESP32 and Raspberry Pi.

Consequently, the primary aim of this study is to develop and validate a secure communication framework for resource-constrained IoT devices. The specific objectives are:

• To critically analyze the current IoT security landscape and identify limitations in existing OAuth adaptations and lightweight cryptographic approaches for constrained environments. 
• To design and implement a secure IoT communication system that integrates OAuth-based authorization with lightweight encryption on ESP32 and Raspberry Pi platforms. 
• To empirically evaluate the system under realistic conditions by measuring security resilience, computational performance, scalability, and interoperability. 
• To provide practical recommendations for real-world deployment and future scalability, including potential integration with edge computing architectures.

This study contributes to the existing body of knowledge in several key aspects. First, it provides a real-world implementation of an integrated OAuth 2.0 and lightweight cryptography framework on resource-constrained IoT devices (ESP32 and Raspberry Pi), addressing the lack of practical validation in prior studies. Second, it proposes a unified system-level architecture that combines authentication, authorization, encrypted communication, and monitoring within a single framework. Third, it delivers comprehensive experimental validation through functional, security, and performance testing under realistic network conditions, rather than simulation-based evaluation.

The object of this research is the design and implementation of a secure IoT communication framework that integrates the OAuth protocol with lightweight cryptography. Specifically, the proposed system combines OAuth-based authorization and lightweight cryptographic algorithms to enhance authentication and data protection in resource-constrained environments. The study was conducted within a controlled local network consisting of ESP32 and Raspberry Pi devices, representing low-resource IoT nodes. The main variables analyzed include authentication accuracy, encryption latency, and throughput under various load and attack conditions.

The main research hypothesis assumes that integrating token-based authentication with resource-efficient encryption algorithms can significantly improve IoT security while minimizing computational and energy overhead on constrained devices. To verify this hypothesis, the study employs the DSRM, which is selected because it emphasizes the creation and evaluation of innovative IT artifacts while ensuring both scientific rigor and practical relevance [17].

The DSRM is applied through six structured stages: (1) Problem Identification and Motivation, focusing on IoT security challenges and device limitations; (2) Define the Objectives of a Solution, which formulates the goal of designing a lightweight yet secure communication system; (3) Design and Development, involving the construction of system architecture integrating OAuth 2.0 with lightweight cryptography, implemented on ESP32 and Raspberry Pi. Although AES is not traditionally categorized as a lightweight cryptographic algorithm, it is included in this study due to hardware acceleration support available on the ESP32 platform. This optimization significantly reduces computational overhead, making AES a practical and efficient choice for constrained IoT environments. Therefore, the term “lightweight cryptography” in this study refers not only to algorithmic efficiency but also to implementation efficiency on specific hardware; (4) Demonstration, where a functional prototype is deployed and tested in practical IoT scenarios; (5) Evaluation, assessing the system’s security, performance, and energy efficiency; and (6) Communication, ensuring dissemination of findings through academic publications and practitioner forums.

Through these structured stages, the developed IoT security system is not only theoretically robust but also experimentally validated and practically feasible for real-world IoT environments. All experiments were conducted within a controlled LAN environment using Ubuntu 22.04 servers and ESP32 IoT clients. Tools such as Postman, Wireshark, and Python scripts were used for simulation and data capture, while the Delsina ISAG Dashboard served as the monitoring interface for logging and visualization.

The experimental setup consisted of a star-topology LAN environment using an Ubuntu 22.04 server (8-core CPU, 16 GB RAM) functioning as both the authorization server and resource server. The IoT nodes included ten ESP32 units and two Raspberry Pi devices connected via Wi-Fi. All devices communicated through RESTful APIs using JSON-based payloads, with token lifetimes configured at 120 seconds and retry limits applied during rate-limiting trials. Wireshark, Postman, and custom Python scripts were utilized to capture network traffic, measure encryption latency, and evaluate token-processing times across different load conditions.

As illustrated in Figure 1, the research methodology is structured according to the six stages of the DSRM. The process begins with Problem Identification and Motivation, where the study highlights critical security challenges in IoT communication, particularly the vulnerability of constrained devices to unauthorized access and attacks. The next stage, Define the Objectives of a Solution, specifies the research goal of creating a secure yet efficient IoT communication system by combining OAuth 2.0 with lightweight cryptographic algorithms. The Design and Development stage focuses on constructing the system architecture, which includes an authorization server, a resource server implemented on ESP32 and Raspberry Pi devices, and a monitoring dashboard, while embedding token management and encryption mechanisms.

Figure 1. Design Science Research Methodology (DSRM)

This is followed by the Demonstration stage, where a prototype is deployed and tested in practical IoT communication scenarios to show its feasibility. In the Evaluation stage, the prototype undergoes systematic testing to measure security robustness, system performance, and energy efficiency, ensuring that the proposed solution meets its objectives. Finally, the Communication stage ensures dissemination of the findings through academic publications and practitioner forums, enabling knowledge transfer and potential real-world adoption. By following this structured approach, the research ensures that the developed IoT security system is not only conceptually sound but also experimentally validated and practically relevant.

The results of this study demonstrate that the integration of the OAuth protocol with lightweight cryptographic algorithms provides a reliable and efficient approach to securing communication in resource-constrained IoT environments. This section compares the obtained results with those from previous studies [18-20] to highlight key improvements in security robustness, scalability, and real-world validation. Compared with previous works [19, 20], the proposed framework demonstrates clearer system-level validation and practical deployment testing, while maintaining similar or better latency and throughput results. This comparative analysis highlights that the presented system not only aligns with existing models but also extends them by providing experimental proof on real IoT hardware.

As illustrated in Figure 2, the system architecture enables secure token issuance, encrypted data transmission, and real-time monitoring. Functionally, the system was able to perform authentication and authorization processes as expected, where devices with valid credentials successfully received tokens, while requests with invalid or expired tokens were denied. The outcomes presented in Table 1 confirm that sensor data transmitted across the network was protected by encryption and subsequently decrypted on the server without loss of integrity. These findings show that the proposed solution ensures both access control and data confidentiality, exceeding the functionality of earlier token-based schemes that focused primarily on authentication but did not guarantee full end-to-end security [18].

From the security perspective, the experimental results in Table 2 demonstrate strong resilience against token replay, forgery, brute-force, man-in-the-middle, expired token, and token revocation attacks. Unlike other lightweight token frameworks that lack robust revocation and replay protection, the proposed integration of OAuth and lightweight cryptography successfully mitigated all these attack vectors. This ensures confidentiality, integrity, and authenticity in inter-device communication, thereby reducing the risks of unauthorized access and data leakage [19].

In terms of scalability, performance outcomes in Table 3 and Figure 3 show that the system was capable of handling up to 1,000 devices operating simultaneously, with latency and throughput remaining within acceptable thresholds. Although CPU and memory consumption increased under heavy load, the system remained responsive and did not experience failures. These results indicate better scalability compared to existing lightweight authentication models that were validated mainly in simulations but lacked real-world high-load verification [20]. Nonetheless, further optimization, such as load balancing, may be required for ultra-large deployments involving more than 5,000 devices.

AES was included in the evaluation not merely as a baseline but because the ESP32 platform provides native hardware acceleration for AES-ECB and AES-CBC modes, resulting in significantly lower latency compared to many software-based lightweight ciphers. This hardware optimization has practical implications for real IoT deployments, as the algorithm that appears theoretically lightweight may not always offer the best performance on constrained devices. To contextualize the contribution of this study relative to existing research, Table 7 presents a comparative summary of representative works, highlighting differences in security mechanisms, hardware platforms, evaluation metrics, and validation approaches.

Table 7. Comparison with representative studies

Integration testing confirmed seamless interoperability among IoT devices, authorization servers, resource servers, databases, and the administrator dashboard. Token validation across servers was processed successfully, while logging and audit trails recorded all security events in real time. Each log contained detailed information, including timestamps, device IDs, IP addresses, and token usage, which are critical for monitoring and forensic investigation. Compared with blockchain- or fog-based security frameworks, which often increase system complexity, the proposed architecture provided simpler implementation while maintaining transparency and traceability [21].

These results directly address the research gap highlighted in Section 2, namely, the absence of validated integration between OAuth and lightweight cryptography in practical IoT scenarios. Unlike prior studies that remained confined to laboratory simulations, this research demonstrates system-level validation in smart home and industrial-like environments [22]. The combination of functional reliability, security robustness, scalability, and monitoring features underscores the practical value of the proposed solution.

However, several limitations of this study must be acknowledged. First, the evaluation was restricted to a medium-scale deployment of 1,000 devices, and larger-scale environments may demand infrastructure optimization. Second, the study focused on selected lightweight cryptographic algorithms, primarily AES variants and ChaCha20. AES was intentionally included as a baseline reference because it is a widely adopted industry-standard symmetric encryption algorithm, providing a well-established benchmark for evaluating both security strength and computational overhead.

By comparing AES with lighter algorithms such as ChaCha20, the study demonstrates the relative efficiency gains that lightweight cryptography can provide in resource-constrained IoT environments.

Moreover, the experiments were conducted using actual implementations on low-power devices (e.g., ESP32 and Raspberry Pi), thereby validating the feasibility of lightweight cryptographic approaches in practical scenarios rather than limiting the analysis to simulations [23]. Nevertheless, other emerging approaches, such as chaos-based encryption methods and post-quantum cryptographic algorithms, were not included in this study. Third, energy consumption was not analyzed in depth, although it is critical for battery-powered IoT devices.

Finally, the system architecture relied on a centralized server, which could become a bottleneck in very large deployments. Despite these shortcomings, the research represents a significant step toward developing adaptive, efficient, and secure IoT communication systems. Future work should explore edge and fog computing integration to reduce latency, test the scalability of the system under larger deployments, expand the range of lightweight cryptographic algorithms considered, and include detailed energy profiling to optimize performance for battery-operated devices. Additionally, the adoption of quantum-resistant cryptography could provide long-term resilience against emerging security threats.

In summary, the comparative evaluation confirms that the proposed system achieves balanced improvements across multiple performance dimensions. It provides stronger resistance to token replay and brute-force attacks than earlier frameworks, while maintaining encryption latency within acceptable limits for real-time IoT applications.

Furthermore, unlike most prior works that validated only algorithmic performance, this study demonstrates complete system integration from authentication to encrypted data transmission and monitoring. These findings underline the novelty and practical relevance of the proposed framework as a holistic, experimentally validated IoT security solution.

This work was supported by Padang State University under Grant No.: 350/UN35/LT/2025. The funding body had no involvement in the design of the study, data collection, analysis, interpretation of results, or preparation of the manuscript.