Internet of Things (IoT) has become a new era of communication technology for performing information exchange. With the immense increment of usage of smart devices, IOT services become more accessible. To perform secure transmission of data between IOT network and remote user, mutual authentication, and session key negotiation play a key role. User authentication is becoming crucial in accelerating the environment of internet of things (IOT).It is mostly used in several applications in management of surveillance, healthcare, security etc. In this project, the proposed model is based on ECC-based three-factor remote user authentication scheme that runs in the smart device and preserves privacy, and data confidentiality while communicating with the user.This model establishes a secure session between the user node and IOT node.Here three-factor authentication is performed between the remote user and the gateway as well as between the gateway and sensor node. ECC is a public key encryption technique based on an elliptic curve theory, in this model ECC is used to generate public key and private key at user, gateway and smart device and it is also conjunction with public key encryption techniques like ECDSA algorithm used to perform mutual authentication through digital signatures, ECDH used to create faster, smaller and more efficient symmetric keys in order to provide secure session environment. Finally, the computation and communication overheads of the proposed scheme are reduced to maximum extent to confirm that the proposed scheme is lightweight and secure. We prove the security strength of our proposed system using formal security analysis tool called AVISPA simulation tool. On implementing this tool, it determines that the proposed model is robust with holding various security threats like all active, passive attacks and then confirms its security in the presence of an intruder. It is found that our model holds all the security functionalities. Therefore, it can be concluded that the proposed scheme is secure against relevant existing security attacks and provides security.