Internet of drones (IoD) environments can provide convenient services such as safety monitoring, map exploration, and military applications using unmanned aerial vehicles (UAVs). However, UAVs can be vulnerable to security attacks because they provide services to users through aerial networks. Moreover, the limited computational power of UAVs, due to their restricted resources, must be considered. Therefore, lightweight and secure authentication protocol is necessary for IoD environments. In 2024, Zhang et al. propose a “PUF-based robust and lightweight authentication protocol for IoD (PRLAP-IoD)” environments. In this paper, we conduct a cryptanalysis of PRLAP-IoD and prove that their protocol can encounter “ephemeral secret leakage (ESL)” and “stolen verifier attacks”. Moreover, PRLAP-IoD does not ensure “perfect forward secrecy (PFS)” and “untraceability”. After that, we present mitigation strategies to reinforce security and privacy of PRLAP-IoD.
Internet of drones (IoD) environments can provide convenient services such as safety monitoring, map exploration, and military applications using unmanned aerial vehicles (UAVs). However, UAVs can be vulnerable to security attacks because they provide services to users through aerial networks. Moreover, the limited computational power of UAVs, due to their restricted resources, must be considered. Therefore, lightweight and secure authentication protocol is necessary for IoD environments. In 2024, Zhang et al. propose a “PUF-based robust and lightweight authentication protocol for IoD (PRLAP-IoD)” environments. In this paper, we conduct a cryptanalysis of PRLAP-IoD and prove that their protocol can encounter “ephemeral secret leakage (ESL)” and “stolen verifier attacks”. Moreover, PRLAP-IoD does not ensure “perfect forward secrecy (PFS)” and “untraceability”. After that, we present mitigation strategies to reinforce security and privacy of PRLAP-IoD.
The Internet of Drones (IoD) is a network layer control system that manages the communication of Unmanned Aerial Vehicles (UAVs). Drones have emerged as a novel approach to addressing everyday human challenges and are now used in a variety of domains, such as personal activities (e.g., photography and videography), urban applications (e.g., traffic monitoring and structural inspection), commercial operations (e.g., power line and tower inspection), agriculture, and military operations. Given the rapid growth of UAVs and their expanding applications, interconnecting drones to form an IoD is a desirable trend for enhancing flight safety and quality. However, challenges related to security, privacy, and inter-drone communication remain significant obstacles. Numerous authentication protocols have been developed to address these concerns. Recently, Zhang et al. proposed a PUF-based authentication scheme that uses unique identifiers and hash functions to secure authentication in the IoD environment. However, in this paper, we demonstrate that Zhang et al.'s scheme is vulnerable to several attacks, including secret value disclosure, integrity violation, key extraction, traceability, and anonymity violation. The presented attacks are shown to have a success probability of one. We also introduce two enhanced protocols that, through both informal and formal security proofs using the Scyther tool, demonstrate that they do not suffer from the vulnerabilities found in the earlier protocol. The communication costs of the proposed protocols (a) and (b) have increased by [Formula: see text] and [Formula: see text], respectively, compared to the previous protocol. The computational costs for the proposed protocols (a) and (b) have also increased by [Formula: see text] and [Formula: see text], respectively, while the storage costs in both proposed protocols remain unchanged compared to the previous protocol. It is true that the costs in the proposed protocols have risen; however, the previous design was vulnerable to various attacks, whereas the proposed protocols have demonstrated better security and have successfully achieved all their security objectives.
With the increasing demand for drones in diverse tasks, the Internet of Drones (IoD) has recently emerged as a significant technology in academia and industry. The IoD environment enables various services, such as traffic and environmental monitoring, disaster situation management, and military operations. However, IoD communication is vulnerable to security threats due to the exchange of sensitive information over insecure public channels. Moreover, public key-based cryptographic schemes are impractical for communication with resource-constrained drones due to their limited computational capability and resource capacity. Therefore, a secure and lightweight key agreement scheme must be developed while considering the characteristics of the IoD environment. In 2024, Alzahrani proposed a secure key agreement protocol for securing the IoD environment. However, Alzahrani’s protocol suffers from high computational overhead due to its reliance on elliptic curve cryptography and is vulnerable to drone and mobile user impersonation attacks and session key disclosure attacks by eavesdropping on public-channel messages. Therefore, this work proposes a lightweight and security-enhanced key agreement scheme for the IoD environment to address the limitations of Alzahrani’s protocol. The proposed protocol employs a physical unclonable function and simple cryptographic operations (XOR and hash functions) to achieve high security and efficiency. This work demonstrates the security of the proposed protocol using informal security analysis. This work also conducted formal security analysis using the Real-or-Random (RoR) model, Burrows–Abadi–Needham (BAN) logic, and Automated Verification of Internet Security Protocols and Applications (AVISPA) simulation to verify the proposed protocol’s session key security, mutual authentication ability, and resistance to replay and MITM attacks, respectively. Furthermore, this work demonstrates that the proposed protocol offers better performance and security by comparing the computational and communication costs and security features with those of relevant protocols.
The use of Internet of Drones (IoD) technology has surged across various domains such as logistics, surveying, industrial inspections, emergency response, security, infrastructure monitoring, crop management, and more. However, real-time communication with drones or Unmanned Aerial Vehicles (UAVs) in the IoD environment occurs over an insecure open channel, making it susceptible to various security and privacy vulnerabilities, including unauthorized access, data interception, denial of service attacks, and privacy concerns. Due to their unique characteristics, including long transmission distances, unstable communication environments, resource limitations, and the highly dynamic nature of UAVs, ensuring the security and privacy of IoD systems is of paramount importance for the success of IoD-based applications. Furthermore, drones are resource-constrained devices, and employing expensive security solutions is impractical, as it would significantly reduce the operational capacity of drones. In this paper, we present the design of an ultralightweight, secure, and robust user-authenticated key agreement framework for the IoD environment, named USAF-IoD. The proposed USAF-IoD is developed by incorporating authenticated encryption (ASCON), cryptographic hashing, XOR operations, and the use of physical unclonable functions (PUFs). PUFs are employed to enhance resistance against physical tampering attacks. The security analysis reveals that the proposed USAF-IoD meets the essential security requirements of the IoD environment. The comparative analysis further highlights the effectiveness of the proposed USAF-IoD, notably excelling in terms of security and functionality characteristics when compared to existing benchmark schemes, and showcasing competitive performance in computation, communication, and energy overheads.
With the emergence of the concept of smart city and the increasing demands for a range of drones, Internet of Drones (IoD) has achieved a variety of attention by providing multiple benefits in academia and industry. IoD offers numerous services, such as traffic monitoring, environmental monitoring, and disaster management by combining infrastructure, Internet of Things (IoT), and Flying Ad-Hoc Networks (FANET) in smart city environments. However, communication among drones is vulnerable to potential security threats because the sensitive messages in various applications are exchanged via an insecure channel in IoD-based smart city environments. Since IoDs can be operated in unattended environment with minimum human interventions, smart devices (e.g., drones and sensors) deployed in IoD architectures are vulnerable to physical capture attacks. In addition, drones are resource-constrained in terms of computation and communication overheads, and it is not much viable to apply public key cryptography (PKC) that requires high computation and communication overheads. Thus, we design a secure and lightweight authentication protocol using a physical unclonable function (PUF) for IoD to guarantee reliable and useful services in smart city environments, called SLAP-IoD. We prove the security of the SLAP-IoD using informal and formal security analyses using the broadly recognized Real-Or-Random (ROR) random oracle model, and also through the formal security verification using the widely-accepted Automated Validation of Internet Security-sensitive Protocols and Applications (AVISPA) security verification. Furthermore, we compare the performance of the SLAP-IoD with related schemes. Consequently, we show that SLAP-IoD offers better security and efficiency than other related schemes and is suitable for IoD-based smart city environments.
The technology of Autonomous Vehicles (AVs) and Unmanned Aerial Vehicles (UAVs) has evolved and contributed to improving road safety and traffic efficiency in Intelligent Transportation Systems (ITS). ITS applications are dependent on a communication network formed between AVs and UAVs suffer from security and privacy issues owing to vulnerable wireless communication channels. Considering these issues, SP2AP, a Physically Unclonable Function (PUF) and Elliptic Curve Cryptography (ECC)-based efficient and reliable privacy-preserving authentication protocol for secure UAV-UAV communications in IoT systems is presented in this paper. The proposed protocol not only offers anonymity and untraceability features but also mitigates UAV capture attacks. A robust informal security analysis confirms that the SP2AP protocol safeguards against various known security attacks, such as masquerade, Man-In- The-Middle (MITM), Ephemeral Secret Leakage (ESL), replay, node tampering, cloning, etc. The proposed protocol offers other security features, including mutual authentication, secure key agreement, no clock synchronization, user anonymity, untraceability, (for/back)ward secrecy, property, and drone-to-drone direct authentication. The formal security proof is performed using the Real-OR-Random (ROR) model, and the Scyther tool also demonstrates that the SP2AP protocol is more robust in terms of security and privacy. Performance analysis evaluates computation and communication costs, which show better superiority compared to similar existing protocols.