Smart IoT and wearable devices have been presenting through many companies lately. Most devices are interacted with a variety of sensors and they have feature to connect the internet. For this reason, those devices provide a wide range of IoT services, such as smart home, smart car and smart city, to users. However, if you do not consider the proper security features needed for safe service operation, the extent of damage will be expanded widely with increased security threats. Therefore, we propose a lightweight mutual authentication and dynamic session key scheme for IoT devices in this paper.