The use of Internet of Drones (IoD) technology has surged across various domains such as logistics, surveying, industrial inspections, emergency response, security, infrastructure monitoring, crop management, and more. However, real-time communication with drones or Unmanned Aerial Vehicles (UAVs) in the IoD environment occurs over an insecure open channel, making it susceptible to various security and privacy vulnerabilities, including unauthorized access, data interception, denial of service attacks, and privacy concerns. Due to their unique characteristics, including long transmission distances, unstable communication environments, resource limitations, and the highly dynamic nature of UAVs, ensuring the security and privacy of IoD systems is of paramount importance for the success of IoD-based applications. Furthermore, drones are resource-constrained devices, and employing expensive security solutions is impractical, as it would significantly reduce the operational capacity of drones. In this paper, we present the design of an ultralightweight, secure, and robust user-authenticated key agreement framework for the IoD environment, named USAF-IoD. The proposed USAF-IoD is developed by incorporating authenticated encryption (ASCON), cryptographic hashing, XOR operations, and the use of physical unclonable functions (PUFs). PUFs are employed to enhance resistance against physical tampering attacks. The security analysis reveals that the proposed USAF-IoD meets the essential security requirements of the IoD environment. The comparative analysis further highlights the effectiveness of the proposed USAF-IoD, notably excelling in terms of security and functionality characteristics when compared to existing benchmark schemes, and showcasing competitive performance in computation, communication, and energy overheads.
The use of Internet of Drones (IoD) technology has surged across various domains such as logistics, surveying, industrial inspections, emergency response, security, infrastructure monitoring, crop management, and more. However, real-time communication with drones or Unmanned Aerial Vehicles (UAVs) in the IoD environment occurs over an insecure open channel, making it susceptible to various security and privacy vulnerabilities, including unauthorized access, data interception, denial of service attacks, and privacy concerns. Due to their unique characteristics, including long transmission distances, unstable communication environments, resource limitations, and the highly dynamic nature of UAVs, ensuring the security and privacy of IoD systems is of paramount importance for the success of IoD-based applications. Furthermore, drones are resource-constrained devices, and employing expensive security solutions is impractical, as it would significantly reduce the operational capacity of drones. In this paper, we present the design of an ultralightweight, secure, and robust user-authenticated key agreement framework for the IoD environment, named USAF-IoD. The proposed USAF-IoD is developed by incorporating authenticated encryption (ASCON), cryptographic hashing, XOR operations, and the use of physical unclonable functions (PUFs). PUFs are employed to enhance resistance against physical tampering attacks. The security analysis reveals that the proposed USAF-IoD meets the essential security requirements of the IoD environment. The comparative analysis further highlights the effectiveness of the proposed USAF-IoD, notably excelling in terms of security and functionality characteristics when compared to existing benchmark schemes, and showcasing competitive performance in computation, communication, and energy overheads.
With the increasing demand for drones in diverse tasks, the Internet of Drones (IoD) has recently emerged as a significant technology in academia and industry. The IoD environment enables various services, such as traffic and environmental monitoring, disaster situation management, and military operations. However, IoD communication is vulnerable to security threats due to the exchange of sensitive information over insecure public channels. Moreover, public key-based cryptographic schemes are impractical for communication with resource-constrained drones due to their limited computational capability and resource capacity. Therefore, a secure and lightweight key agreement scheme must be developed while considering the characteristics of the IoD environment. In 2024, Alzahrani proposed a secure key agreement protocol for securing the IoD environment. However, Alzahrani’s protocol suffers from high computational overhead due to its reliance on elliptic curve cryptography and is vulnerable to drone and mobile user impersonation attacks and session key disclosure attacks by eavesdropping on public-channel messages. Therefore, this work proposes a lightweight and security-enhanced key agreement scheme for the IoD environment to address the limitations of Alzahrani’s protocol. The proposed protocol employs a physical unclonable function and simple cryptographic operations (XOR and hash functions) to achieve high security and efficiency. This work demonstrates the security of the proposed protocol using informal security analysis. This work also conducted formal security analysis using the Real-or-Random (RoR) model, Burrows–Abadi–Needham (BAN) logic, and Automated Verification of Internet Security Protocols and Applications (AVISPA) simulation to verify the proposed protocol’s session key security, mutual authentication ability, and resistance to replay and MITM attacks, respectively. Furthermore, this work demonstrates that the proposed protocol offers better performance and security by comparing the computational and communication costs and security features with those of relevant protocols.
Internet of drones (IoD) environments can provide convenient services such as safety monitoring, map exploration, and military applications using unmanned aerial vehicles (UAVs). However, UAVs can be vulnerable to security attacks because they provide services to users through aerial networks. Moreover, the limited computational power of UAVs, due to their restricted resources, must be considered. Therefore, lightweight and secure authentication protocol is necessary for IoD environments. In 2024, Zhang et al. propose a “PUF-based robust and lightweight authentication protocol for IoD (PRLAP-IoD)” environments. In this paper, we conduct a cryptanalysis of PRLAP-IoD and prove that their protocol can encounter “ephemeral secret leakage (ESL)” and “stolen verifier attacks”. Moreover, PRLAP-IoD does not ensure “perfect forward secrecy (PFS)” and “untraceability”. After that, we present mitigation strategies to reinforce security and privacy of PRLAP-IoD.
The Internet of Drones (IoD) will have revolutionized civil and commercial applications, in much the similar way that the Internet of Things (IoT) transformed the way information is exchanged with other devices and systems over the Internet. The drones are generally considered to have constrained resources, which make them less compatible with complicated algorithms and more prone to attacks. Moreover, the IoD applications are facing information security and privacy challenges in the cyber-threat environment, where the adversary could intercept communicating messages and compromise their confidentiality or integrity. Consequently, the security protocols which are designed for IoD applications should not only provide desirable security guarantees, but also be resource-efficient. Existing authenticated key exchange protocols can authenticate the identities of communication parties and realize the exchange of session key, however, they either incur high communication overhead, suffer from non-negligible computational cost, or have inherent security design flaws. Thus, these approaches are not suitable for resource-constrained drones involved in critical IoD applications. To address the above challenges, this paper presents a featherweight authentication and key agreement scheme (hereafter referred to as fwAKA) for IoD applications based on elliptic curve cryptography, physical unclonable function, hash function, and XOR operation. The fwAKA only requires two handshakes to achieve authenticated key agreement. We prove that the fwAKA is perfectly secure in the adversarial setting through the security verification using the AVISPA. We set up a simulation environment, implement the fwAKA and its counterparts, and conduct performance evaluation in terms of communication overhead and running time. Experimental results indicate that not only is the fwAKA robust against well-known attacks but also it is more resource-efficient than its opponents.
The Internet of Drones (IoD) is a network layer control system that manages the communication of Unmanned Aerial Vehicles (UAVs). Drones have emerged as a novel approach to addressing everyday human challenges and are now used in a variety of domains, such as personal activities (e.g., photography and videography), urban applications (e.g., traffic monitoring and structural inspection), commercial operations (e.g., power line and tower inspection), agriculture, and military operations. Given the rapid growth of UAVs and their expanding applications, interconnecting drones to form an IoD is a desirable trend for enhancing flight safety and quality. However, challenges related to security, privacy, and inter-drone communication remain significant obstacles. Numerous authentication protocols have been developed to address these concerns. Recently, Zhang et al. proposed a PUF-based authentication scheme that uses unique identifiers and hash functions to secure authentication in the IoD environment. However, in this paper, we demonstrate that Zhang et al.'s scheme is vulnerable to several attacks, including secret value disclosure, integrity violation, key extraction, traceability, and anonymity violation. The presented attacks are shown to have a success probability of one. We also introduce two enhanced protocols that, through both informal and formal security proofs using the Scyther tool, demonstrate that they do not suffer from the vulnerabilities found in the earlier protocol. The communication costs of the proposed protocols (a) and (b) have increased by [Formula: see text] and [Formula: see text], respectively, compared to the previous protocol. The computational costs for the proposed protocols (a) and (b) have also increased by [Formula: see text] and [Formula: see text], respectively, while the storage costs in both proposed protocols remain unchanged compared to the previous protocol. It is true that the costs in the proposed protocols have risen; however, the previous design was vulnerable to various attacks, whereas the proposed protocols have demonstrated better security and have successfully achieved all their security objectives.
The existing authentication and key agreement (AKA) schemes for the internet of drones (IoD) still suffer from various security attacks and fail to ensure required security properties. Moreover, drones generally have limited memory and computation capability. Motivated by these issues, a secure and lightweight AKA protocol for IoD (SLAKA-IoD) is proposed based on physical unclonable function (PUF), “exclusive or” (XOR) operation and hash function, which are simple cryptographic operations and functions that can provide better performance. In the SLAKA-IoD protocol, a drone and the ground station (GS) perform mutual authentication and establish a secure session key between them, and any two drones can also perform mutual authentication and establish a secure session key between them. Via informal security analysis, formal security analysis using the strand space model, and security verification based on the Scyther tool, the SLAKA-IoD protocol is proven to resist various security attacks and ensure required security properties. Further comparative analysis shows that the SLAKA-IoD protocol can provide more security features, and is generally lightweight as compared with these related AKA protocols for IoD, so it is suitable for IoD.
With the emergence of the concept of smart city and the increasing demands for a range of drones, Internet of Drones (IoD) has achieved a variety of attention by providing multiple benefits in academia and industry. IoD offers numerous services, such as traffic monitoring, environmental monitoring, and disaster management by combining infrastructure, Internet of Things (IoT), and Flying Ad-Hoc Networks (FANET) in smart city environments. However, communication among drones is vulnerable to potential security threats because the sensitive messages in various applications are exchanged via an insecure channel in IoD-based smart city environments. Since IoDs can be operated in unattended environment with minimum human interventions, smart devices (e.g., drones and sensors) deployed in IoD architectures are vulnerable to physical capture attacks. In addition, drones are resource-constrained in terms of computation and communication overheads, and it is not much viable to apply public key cryptography (PKC) that requires high computation and communication overheads. Thus, we design a secure and lightweight authentication protocol using a physical unclonable function (PUF) for IoD to guarantee reliable and useful services in smart city environments, called SLAP-IoD. We prove the security of the SLAP-IoD using informal and formal security analyses using the broadly recognized Real-Or-Random (ROR) random oracle model, and also through the formal security verification using the widely-accepted Automated Validation of Internet Security-sensitive Protocols and Applications (AVISPA) security verification. Furthermore, we compare the performance of the SLAP-IoD with related schemes. Consequently, we show that SLAP-IoD offers better security and efficiency than other related schemes and is suitable for IoD-based smart city environments.