The rapid development of the Industrial Internet of Things (IIoT) has accelerated the digitalization and intelligence of industrial manufacturing. However, during cross-domain collaboration, device authentication and secure communication still face numerous challenges. Due to heterogeneous trust anchors and diverse security policies among different management domains, traditional cross-domain authentication mechanisms suffer from issues such as single-point failure of the trusted authority, complex certificate management, and low authentication efficiency. To address these challenges, this paper proposes a cross-domain authentication and key agreement scheme based on Elliptic Curve Cryptography (ECC). The proposed scheme enables bidirectional authentication and session key establishment between domains and nodes through collaborative operations of Edge Servers (ESs). Security analysis demonstrates that the scheme can resist common attacks and satisfies essential security properties, including mutual authentication, anonymity, and forward secrecy. Performance evaluation results further show that, compared with recent ECC and bilinear pairing-based schemes, the proposed protocol achieves superior computational efficiency.

In this paper, we present CTRU-Light, an IND-CCA-secure key encapsulation mechanism (KEM) derived from NTRU and RLWE (and RLWR in variant) assumptions over power-of-two cyclotomic rings. Our CTRU-Light employs a compact NTT-compatible modulus $q=641$ while maintaining minimal public key and ciphertext dimensions with negligible error probability. Specifically, the design yields public key and ciphertext sizes of 1206 bytes under an error probability bound of $\le 2^{-110}$. When benchmarked against Kyber (NIST’s sole standardized KEM), CTRU-Light demonstrates 23.0–30.0% lower bandwidth consumption, accelerates key generation by at least 6.0%, and achieves over 1.3× speed enhancement in both encapsulation and decapsulation procedures.