Handshake:
1) Client To Server: "AES-GCM(Client_random_128bit,client_iv,psk),client_id,tag,client_iv"
2) Server To Client: "AES-GCM(Server_random_128bit,client_iv++,psk),tag
Client_key_256bit = Client_random_128bit + Server_random_128bit
Server_key_256bit = Server_random_128bit + Client_random_128bit
Communication:
$c_{iv}=1, \space s_{iv}=1$
Client_Encrypted_Message = AES-GCM(Message,$c_{iv} \space$,Client_key_256bit),$c_{iv} \space$,tag;
Server_Encrypted_Message = AES-GCM(Message,$s_{iv} \space$,Server_key_256bit),$s_{iv} \space $,tag;
For every Subsequent Message $c_{iv}$ and $s_{iv}$ is incremented by $1$ by client and server respectively.
Client and Server makes sure every new massage's $c_{iv}$ or $s_{iv}$ is greater than the previous massage's else the session is terminated. (tcp protocol)
This is because I don't know any other way to make sure the massage/command is executed only once or to prevent replay attack.
Is there better way to do this considering the device can't keep track of time?
Would it be OK if the $iv$ used in handshake gets repeated considering the plain text is a random number?
Is this secure enough?
Here client is referred to iot_device and device_id as client_id.
psk is referred to pre_shared_key configured in the device at company and known to server.