With the evolution of the Internet of Things (IoT), Elliptic Curve Cryptography (ECC) appears to be a highly effective solution for securing devices with limited resources. Since authentication helps prevent unauthorized access and misuse of data exchanged between IoT devices, numerous lightweight IoT authentication protocols have been introduced by researchers. Many IoT authentication schemes that rely on two-factor authentication often fall short in achieving important security goals. To address this challenge, we introduce a robust three-factor authentication scheme based on ECC to authenticate both ends of the communication. We validate the security of our scheme through informal analysis and formal verification using the AVISPA tool, demonstrating its resilience against known attacks. A comparative analysis reveals that our protocol outperforms existing schemes by offering higher functionality and enhanced security, all while maintaining minimal computational cost.