Since the Federal Aviation Administration (FAA) announced the Remote ID rule in 2021, ensuring drone privacy has become critical. Although the rule aims to increase accountability, it raises privacy concerns by exposing flight paths. Previous privacy-preserving protocols for drones rely on trusted third parties (TTPs) for drone authentication, which is unacceptable in critical infrastructure settings where flight data is sensitive and the ground control server (GCS) must authenticate drones in real-time. Furthermore, since existing studies rely on traditional public-key cryptographic algorithms, such as ECC or RSA, they should migrate to post-quantum cryptography (PQC) to ensure security against future quantum threats. However, applying PQC to existing protocols dramatically enlarges signatures and ciphertexts, causing them to exceed the 255-byte payload limit of Bluetooth/Wi-Fi Remote ID broadcasts. To address these challenges, we propose pqRID, the first method that supports both privacy and quantum-safe authentication under Remote ID constraints. pqRID uses pseudonym certificates for identification while preserving privacy and decouples identification from PQC-based authentication to satisfy broadcast size constraints. In pqRID, drones are provisioned with pseudonym certificates and IDs before flight. During flight, they broadcast their pseudonym IDs and use the corresponding certificate to authenticate themselves when prompted by the GCS without involving a TTP. We formally verified pqRID using ProVerif, ensuring authentication and unique ID non-disclosure. We implemented pqRID on a real UAV: a Raspberry Pi 4B mounted on a DJI-F450 drone. Our experimental results show that generating a PQC-based authentication message takes only 9ms and consumes 0.8J of energy on average.
Since the Federal Aviation Administration (FAA) announced the Remote ID rule in 2021, ensuring drone privacy has become critical. Although the rule aims to increase accountability, it raises privacy concerns by exposing flight paths. Previous privacy-preserving protocols for drones rely on trusted third parties (TTPs) for drone authentication, which is unacceptable in critical infrastructure settings where flight data is sensitive and the ground control server (GCS) must authenticate drones in real-time. Furthermore, since existing studies rely on traditional public-key cryptographic algorithms, such as ECC or RSA, they should migrate to post-quantum cryptography (PQC) to ensure security against future quantum threats. However, applying PQC to existing protocols dramatically enlarges signatures and ciphertexts, causing them to exceed the 255-byte payload limit of Bluetooth/Wi-Fi Remote ID broadcasts. To address these challenges, we propose pqRID, the first method that supports both privacy and quantum-safe authentication under Remote ID constraints. pqRID uses pseudonym certificates for identification while preserving privacy and decouples identification from PQC-based authentication to satisfy broadcast size constraints. In pqRID, drones are provisioned with pseudonym certificates and IDs before flight. During flight, they broadcast their pseudonym IDs and use the corresponding certificate to authenticate themselves when prompted by the GCS without involving a TTP. We formally verified pqRID using ProVerif, ensuring authentication and unique ID non-disclosure. We implemented pqRID on a real UAV: a Raspberry Pi 4B mounted on a DJI-F450 drone. Our experimental results show that generating a PQC-based authentication message takes only 9ms and consumes 0.8J of energy on average.
The rapid proliferation of Internet of Drones Networks (IoDN) in mission-critical applications such as surveillance, logistics, precision agriculture, and disaster response has intensified the demand for robust, scalable authentication mechanisms that ensure data confidentiality and integrity in dynamic, resource-constrained environments. Traditional cryptographic authentication schemes—such as RSA and ECC—are increasingly vulnerable to the computational power of quantum adversaries, particularly due to Shor's and Grover's algorithms, which compromise their long-term viability. This study conducts a systematic and comparative evaluation of over 50 authentication schemes spanning classical, lightweight, blockchain-augmented, and post-quantum cryptographic (PQC) domains. The analysis benchmarks protocols against multidimensional metrics including quantum resistance, computational and memory overhead, key generation cost, and deployment feasibility in UAV swarms. Notably, PQC primitives such as lattice-based CRYSTALS-Dilithium and hash-based SPHINCS+ exhibit superior quantum robustness but introduce latency and footprint challenges, impeding real-time IoDN operations. In contrast, optimized Ring-LWE and NTRU variants demonstrate 25–40% reductions in energy consumption on embedded drone platform, while preserving NIST-compliant security levels. Hybrid architectures integrating blockchain for decentralized trust and PQC primitives for key encapsulation show promise in balancing performance and fault tolerance, addressing key distribution bottlenecks without undermining scalability. However, interoperability gaps with IoT-centric protocols (e.g., LoRaWAN, MQTT) highlight standardization challenges. This study advocates for the co-design of quantum-resilient, lightweight authentication frameworks tailored to the spatio-temporal constraints of IoDN and outlines strategic directions for cross-sectoral collaboration to accelerate secure transition into the post-quantum era.
The use of drones in military operations is a growing phenomenon that presents substantial security implications, especially related to authentication, data integrity, and the treatment of cyber threats. While traditional schemes like Elliptic Curve Cryptography (ECC) have computational efficiency, they are susceptible to quantum attacks. To solve the aforementioned problem, in this paper, we design a Lightweight and Quantum Resistant Authentication Protocol for Military IoD Using Dilithium Signatures, which is a post-quantum cryptographic (PQC) method implemented using the PQC solution based on lattice-based cryptographic evidence. The proposed protocol provides quantum-safe mutual authentication of drones, soldiers, and the command center (CC) while also protecting against impersonation attacks and side-channel attacks. In contrast to ECC-based authentication and its vulnerability to Shor’s Algorithm, the proposed system is long-term quantum secure. While Dilithium incurs increased computational and communication costs, our performance evaluations show that it provides security against quantum adversaries and replay attacks, thereby deeming it a worthwhile choice, especially in light of the swift advancements in ASIC technology. In an effort to be truly efficient, signature compression, parallel authentication verification, and an improved key management approach further enhance the scalability of the proposed scheme in the military Internet of Drones (IoD) network. The results substantiate the necessity of deploying full post-quantum authentication schemes to protect UAV networks. We intend to focus on developing energy-saving hardware and optimizations for real-world deployment in future work.
Remote Identification supports unmanned aerial vehicle accountability, but routine broadcasts are openly observable and copyable. The selected post-quantum key-encapsulation and signature objects exceed the compact Broadcast Remote ID authentication capacity, while per-pseudonym credentials impose linear provisioning and storage costs. This paper presents a commitment-based architecture in which a Trusted-Authority-signed Merkle root authorizes n interval pseudonyms. Routine broadcasts carry a 128-bit pseudonym; an authorized verifier obtains an ordered Merkle path and transcript signature through a unicast exchange protected by post-quantum key encapsulation and authenticated encryption. Authority provisioning and nonvolatile credential state are O(1) per root, whereas tree construction, activation, and volatile state remain O(n) . A modeled ring-oscillator physically unclonable function is evaluated for credential reconstruction using top-950 selection and shortened Bose–Chaudhuri–Hocquenghem decoding; Toeplitz extraction is benchmarked separately. Across 1300 pre-silicon runs, 500 nominal virtual devices produced approximately 50% uniformity and inter-instance Hamming distance. Of 100 fixed-mismatch PVT devices, 54 enrolled and all 54 reconstructed successfully across eight nonnominal corners. Processor evaluation showed about 4.5 ms Raspberry Pi 5 authentication latency and 5.64±0.14 mJ per authentication at n=16384 . ESP32 processor measurements demonstrated execution of the selected post-quantum operations; a UAV-mounted ESP32 completed 120/120 recorded outdoor-hover authentication exchanges using provisioned credentials, without physical PUF reconstruction. Controlled mixed-load and network-impairment tests incurred no legitimate-request failures; Tamarin verified authentication and revocation properties. Verifier acceptance establishes credential possession and authorized-set membership; it does not provide physical-source verification or relay resistance.
Unmanned Aerial Vehicles (UAVs), commonly known as drones, are increasingly being employed across a broad spectrum of applications, ranging from military operations to commercial purposes. However, as UAVs become more integrated into everyday life, security and privacy concerns are similarly escalating due to vulnerabilities arising from operating on open wireless channels and having limited onboard computational resources. Moreover, with the emergence of quantum computers, conventional cryptographic methods that ensure the security and privacy of UAV communications are at severe risk. These risks encompass the possibility of unauthorized access, breaches of data, and cyber-physical attacks that jeopardize the integrity, confidentiality, and availability of UAV operations. Quantum computers are expected to break the conventional cryptography methods, such as symmetric and asymmetric schemes, with the support of Grover’s and Shor’s algorithms, respectively. Consequently, traditional cryptographic algorithms must give way to quantum-resistant algorithms, referred to as Post-Quantum Cryptography (PQC) algorithms. Although researchers actively develop, test, and standardize new PQC algorithms, the threat persists despite the progress made through these consistent efforts. This review article first examines the security and privacy landscape, including threats and requirements of UAVs. This article also discusses PQC and various PQC families and the status of the NIST’s implementation and standardization process. Lastly, we explore challenges and future directions in implementing PQC for UAVs.
Modern societies increasingly rely on interconnected devices and individuals for information exchange and monitoring. In this manner, drones, as flying smart nodes in the wireless network ecosystem, facilitate diverse applications, such as industrial, civilian, and disaster response operations. However, the widespread adoption of drone networks introduces significant challenges regarding interoperability, privacy, and security. Advances in quantum computing exacerbate these issues by rendering classical cryptographic measures inadequate, necessitating the adoption of quantum-safe approaches. Existing solutions fail to address all potential threats or lack post-quantum security. This work sets out to propose a robust lattice-based authentication and communication protocol for drone networks, addressing these challenges. The protocol integrates dynamic credentials, timestamps, multi-factor authentication, and context information to enhance security. The scheme's security is analyzed using the DY and BPR models and formally verified via the AVISPA tool. Performance evaluations and comparisons with existing solutions demonstrate the protocol's functionality, showcasing a reasonable trade-off between security and performance. By leveraging modern cryptographic techniques, the proposed scheme ensures reliable and robust drone operations, effectively mitigating various attacks beyond session establishment while safeguarding privacy, and supporting dynamic network events.
The rapid advancement of quantum computing poses significant challenges to traditional cryptographic methods. Algorithms such as Shor’s and Grover’s have substantially weakened the security of symmetric and asymmetric encryption, exposing critical vulnerabilities in drone networks, particularly in identity authentication and key exchange. This paper examines the impact of quantum computing on drone network security, introduces an enhanced Dolev-Yao model to address quantum threats, and explores security challenges in both centralized and distributed drone networks. Using the ProVerif tool, this study evaluates existing drone security protocols under quantum attack scenarios. The results reveal that current protocols are inadequate against quantum threats, underscoring the urgent need for post-quantum cryptographic solutions to ensure the security of drone networks.