Abstract
Nowadays, unmanned aerial vehicles (UAVs) are used in various fields due to their high maneuverability and low cost of construction and use. With the development of UAV technology, it has become a trend for UAVs to cooperate with each other to complete assigned tasks. Multiple UAVs are combined according to a certain structure, and through the information sharing between them, a cooperative effect is generated to achieve intelligent collaborative task execution. However, information sharing is carried out on a public channel, so ensuring secure communication between UAVs is crucial. Moreover, UAVs are easily captured by an adversary, who can impersonate legitimate UAVs to disrupt communications if UAVs’ internal secrets that are stolen. Therefore, we propose a lightweight authentication scheme based on physical unclonable function (PUF), to provide mutual authentication between UAVs. PUF is embedded in the unmanned aerial vehicle (UAV) to defend against physical capture attack. Furthermore, to evaluate the security and performance of our scheme, formal and informal security analyses and formal security verification of the scheme are performed, and the performance of the scheme is compared with existing UAV schemes. The above analyses show that our scheme has great advantages in terms of security and overheads.
1. Introduction
Nowadays, UAV has entered people’s sights as a new product. A drone is an unmanned microaircraft, that is, an unmanned aerial vehicle which is operated using radio remote control technology and controls embedded in the drone [1]. UAV has the characteristics of low maintenance cost and wide deployment range, so it has been applied in various fields. In the prevention and control of infectious diseases, the task of spraying disinfectant on contaminated areas can be done by UAVs [2].
With the increasing difficulty and complexity of tasks, a single UAV cannot perform such tasks due to its short flight time, limited storage space, and other limitations. Therefore, the cooperation of multiple UAVs to complete the task has become a new mode to achieve the expansion of UAV mission capability [3]. In this mode, multiple UAVs with autonomous control capabilities form a relatively large UAV group. Information is shared among the UAVs within the group [4], thereby improving the efficiency of task execution and completing the assigned task with high quality. For example, in the field of disaster rescue, when UAVs carry out search and rescue work in mountainous areas, it is easy to block the signal and affect the communication due to the complex environment in these areas. This problem can be avoided by adopting the cooperative mode of multiple UAVs [5], that is, each UAV serves as a communication relay station, and UAVs communicate with each other to achieve information sharing. In addition to disaster rescue, the UAV group is also playing an important role in intelligent mining. The underground multi-UAV cooperation mode has the advantages of strong monitoring ability and wide monitoring range, which can effectively improve the monitoring efficiency. Moreover, the wireless multihop mode will solve the problem of limited communication distance of a single UAV, which is conducive to the transmission of detected information [6].
The mode of cooperative work and information sharing among UAVs provides great convenience for industrial production and social life. However, because the communication between UAVs is carried out on the public channel, the communication process is vulnerable to security threats [6]. These threats include impersonation attack, replay attack, and man-in-the-middle attack [7]. In addition, an adversary can eavesdrop on or tamper with information transmitted on the public channel to disrupt communications. Node authentication, which is divided into information authentication and identification authentication [8], is precisely the way to resist these security threats. Information authentication is to ensure the integrity of the information transmitted between two parties and that the information has not been maliciously tampered with. Identification authentication means that the communication parties verify whether the identity of the other party is authentic and credible, to prevent the adversary from participating in communication by impersonating legitimate entities [8].
In flight, UAVs not only have the above-mentioned security threats but also are prone to physical capture attack. An UAV in the air cannot be constantly monitored by staff, so it could be captured by an adversary who steals the UAV’s secrets through power analysis attacks [9] and impersonates the UAV to participate in authentication. In recent years, to resist such attacks, physical unclonable function (PUF) has been embedded in the UAV. This function is a one-way function based on the challenge-response pair mechanism [10]. Inputting a challenge to the function will calculate a response , which is . The manufacturing process of the PUF in each UAV is the same, but due to the tiny random changes inherent in the manufacturing process, the output of each function is different [11]; that is, PUF is used to make each UAV have its own fingerprint. This fingerprint cannot be cloned, because PUF is unclonable, and it is impossible to make two identical functions [12]. Furthermore, the adversary captures an UAV and enters a challenge into the PUF in the UAV. Since the response calculated by the PUF participates in the authentication as an intermediate value, the adversary still cannot extract the corresponding response. Combining the above advantages, PUF can resist physical capture attack and is suitable for identity authentication and key generation scenarios [13].
In order to resist the attacks easily encountered in the communication process of UAVs and realize the secure communication between UAVs, this paper proposes a lightweight mutual authentication scheme between UAVs based on PUF. The specific contributions of this scheme are described below: (i)We propose an authentication and key agreement scheme suitable for Internet of drone (IoD) environment, which realizes mutual authentication between two UAVs. After the authentication, two parties discuss a session key. In addition, the introduction of PUF can ensure the physical security of the UAV(ii)Our scheme is formally security analysis by applying the widely used real-or-random (ROR) model. This model is mainly used to ensure the semantic security of session key. Moreover, an informal security analysis is performed on our scheme which showed that it could withstand several known attacks(iii)A detailed comparison is made between our scheme and existing related authentication schemes in terms of security, functional characteristics, and overheads. The results show that our scheme is efficient and security
The rest of this paper is roughly organized as follows. The related work related to UAV authentication is given in Section 2. In Section 3, we provide the system and threat models used by our scheme. Section 4 describes the specific steps of our scheme. Formal and informal security analyses and formal security verification of our scheme are shown in Section 5. In Section 6, our scheme is compared with existing similar schemes in terms of performance. Finally, Section 7 makes some important concluding remarks to the whole paper.
2. Related Work
With the diversification of user needs and the growth of the complexity of tasks, the collaborative work of multiple devices has become a reality, and the communication between devices will become more and more frequent [14]. However, communication between devices is subject to some malicious attacks. Therefore, identity authentication between devices is essential.
Semal et al. [15] proposed an IoD-based certificate-authenticated key agreement scheme to ensure identity authenticity and message integrity in UAVs’ communication. However, computation overhead of this scheme is high. In order to reduce the overhead of device authentication, Malani et al. [16] proposed a device access control scheme. The scheme uses hash function and elliptic curve cryptography to realize mutual authentication between any two neighboring devices, but it cannot provide device anonymity and resist device impersonation attack. Another access control scheme using elliptic curve encryption and hash function techniques was proposed by Bera et al. [17], which is a lightweight scheme based on IoD environment. Two neighboring UAVs authenticate each other using certificates issued by the control room and negotiate a session key. Then, Chaudhry et al. [18] pointed out that the scheme of Bera et al. cannot provide protection against UAV impersonation attack, replay attack, and man-in-the-middle attack. To address these issues, Chaudhry et al. designed an improved certificate-based authentication scheme that guarantees mutual authentication and key agreement between UAVs. Unfortunately, an adversary can calculate the private key of the control room in the scheme. Armed with a private key, he/she can deploy a malicious UAV in IoD environment and simulate ground station server to communicate with legitimate UAVs [19]. A certificate-supported access control scheme between UAVs proposed by Das et al. [19] can solve the loopholes in Chaudhry et al.’s scheme. Das et al.’s scheme supports mutual authentication of UAVs and ensures the anonymity and untraceability of UAVs, but it cannot resist drone capture attack, and the overhead is relatively high. Based on the problem of high authentication overhead, Khan et al. [20] applied lightweight operations such as hyperelliptic curve cryptography and hash function. Their scheme, which enables the authentication of two UAVs and the addition of a new UAV, is superior in performance to several similar schemes above. The authentication scheme under vehicular ad hoc networks proposed by Wang et al. [21] also requires less overhead, because the scheme uses modular exponentiation and sets up a precomputed lookup table in vehicle-to-vehicle authentication to speed up verification.
In recent years, the physical security of device has received increasing attention. The devices in the above authentication schemes are vulnerable to physical capture attack, where an adversary can obtain secrets in the device to disrupt communications. To resist such attack, PUF has been introduced in recent studies. Yıldız et al. [22] used the PUF in a group authentication and key distribution scheme, and the role of the function is to provide a unique key for each device without storing any information on those devices. A lightweight mutual authentication scheme between smart meter node and server was proposed by Harishma et al. [23]. The PUF is embedded in smart meter node to resist physical capture attack and require less secure secret value to be stored on the device. Aiming at the environment of smart home, Xia et al. [24] proposed a group authentication and key agreement protocol based on PUF, which realizes the simultaneous access of multiple devices in smart home by using the Chinese residual theorem and other technologies. The scheme uses PUF to protect secret parameters stored in the memory of smart devices. A lightweight authentication and key establishment scheme (PUF-RAKE) based on PUF were proposed by Qureshi and Munir [25], which reduces resource consumption by applying PUF. Babu et al. [26] provided a new lightweight authentication protocol, which implements mutual authentication and session key negotiation between electric vehicle and charging system. In addition, the proposed protocol uses PUF to enhance the physical security of the device.
We use similar PUF in our IoD authentication scheme to ensure the physical security of the UAV that an adversary cannot simulate a legitimate UAV even if he/she captures this UAV. In our scheme, PUF is embedded in the UAV, and mutual authentication between UAVs is realized.
3. System and Threat Models
This section presents the system and threat models required for our scheme, which explain the workflow and applicability of the scheme.
3.1. System Model
The system model of the proposed authentication scheme between UAVs is shown in Figure 1. Under this model, there are two entities, which are the UAVs deployed to the IoD environment and the ground station server. The ground station server provides registration service for each UAV and generates parameters needed for authentication. UAVs equipped with sensors and communication facilities are registered on the ground station server and assigned to perform missions in urban, rural, or mountainous locations. Related drones in the same area can monitor data around the flight environment and can use the discovery function to connect with surrounding UAVs [20]. In this area, an UAV and a nearby UAV conduct mutual authentication and negotiate a session key. The two UAVs then use the key to communicate securely, enabling both parties to share information and complete specified tasks with high quality and efficiency.
3.2. Threat Model
During the authentication process, one UAV communicates with another UAV over a public channel. According to the widely used Dolev–Yao (DY) threat model [27], this channel is wireless and insecure. An adversary can steal the messages exchanged between two parties, modify or delete them, and replay them to legitimate entities. The model also assumes that the communication parties are untrusted, and the adversary can simulate legitimate entities to participate in the communication.
The adversary also has the ability to know all the public parameters but not enough ability to know the private key of the ground station server. In addition, an UAV may be unmonitored while in the air, so the adversary can capture the UAV and use power analysis attacks [9] to gain access to its internal storage secrets.
4. Proposed Authentication Scheme
This section presents the proposed authentication and key agreement scheme. The scheme is composed of following four steps, i.e., setup phase, UAV registration phase, UAV-UAV authentication phase, and dynamic UAV addition phase. The symbols that appear in Table 1 are used to describe our scheme. Before describing, we first provide a brief introduction to elliptic curve cryptography, as it is one of the key techniques of the scheme.
We introduce an elliptic curve over a finite field , where is a large prime number representing the number of elements in . The elliptic curve is defined by the equation (mod ), where the equation satisfies the conditions and (mod ), respectively [28]. A point at infinity on , together with all the other points on , form a set . It is easy to compute the point if you set the base point on and an integer , but it is computationally difficult to find from and [29]. Calculating this point is equivalent to adding up multiple points , as shown by this formula ( times).
4.1. Assumptions
According to [6, 30], we indicate some assumptions required in our scheme, as shown below. (i)The private key of the ground station server is assumed to be secure, and an adversary cannot obtain the key(ii)Each legal UAV has a unique PUF embedded in it. The adversary capturing an UAV and tampering with its PUF will destroy the PUF [10], not get the expected response value, and fail to pass the authentication. Furthermore, the PUF used in our scheme is ideal
4.2. Setup Phase
The setup phase is done by the ground station server . At this phase, generates the parameters required by the system.
S1. chooses an elliptic curve over a finite field and a base point over . It then selects as its own private key and computes its own public key
S2. chooses its own identity and two hash functions and , where maps a string of arbitrary length to an integer, and maps a string of arbitrary length to a string of fixed length
S3. In the end, keeps the private key and identity and publishes as the system public parameters
4.3. UAV Registration Phase
During this phase, the ground station server is responsible for the registration of each UAV. Suppose there are a total of UAVs, these UAVs are registered on . After registration, they are deployed to the target area to perform tasks. The following are the detailed steps of UAV registration phase.
R1. For each UAV , selects a random number for , and computes ’s identity , where and are the abscissa and ordinate of the point , respectively. further calculates mod using its own private key . Then, sends , , and its identity to through a secure channel
R2. After receiving the information from , generates a challenge , which is the input of the embedded in , and obtains the corresponding response . Further, calculates . Finally, it stores in its own memory
Now each is ready for deployment. The UAV registration phase is briefed in Figure 2.
4.4. UAV-UAV Authentication Phase
Suppose there are two adjacent UAVs, called and . To ensure secure communication between the two UAVs, they need to authenticate each other and establish a session key for future communication after successful authentication. Figure 3 shows the calculation operations performed and various information exchanged by and during the authentication process. The two UAVs perform the following steps for mutual authentication and key agreement.
A1. takes the challenge stored in the memory as the input of the and gets the corresponding response . Then, it computes . creates a random number and calculates , where and are the abscissa and ordinate of . Further, it computes mod
A2. dispatches the message to over a public channel
A3. After receiving from , firstly checks whether the formula holds. Note that
If it fails, rejects the authentication request. Otherwise, performs the step A4.
A4. inputs the challenge into the , and the function outputs the corresponding response . Then, computes , creates a random number , and calculates , where and are the abscissa and ordinate of . Finally, it calculates mod and
A5. transmits the message to via an open channel
A6. On receiving , computes and checks whether ’s identity is authentic by verifying . Note that
If the verification is successful, passes the authentication of , and continues to the next step A7. Otherwise, this phase is terminated.
A7. computes , where and are the abscissa and ordinate of . It also calculates the session key and
A8. sends the message to through a public channel
A9. When receives from , it evaluates and to verify that the formula is equal. If the formula does not hold, terminates this authentication process. Otherwise, uses as the current session key
In the end, stores the session key for future communication with . Likewise, stores this key for communicating and sharing information with .
4.5. Dynamic UAV Addition Phase
The proposed scheme has the function of adding new UAVs to the network. Assuming that there is a new UAV to be deployed in the IoD environment, the UAV needs to perform the following steps to complete the registration on the ground station server . In addition, messages are transmitted over a secure channel during the process.
U1. chooses a random number for and computes ’s identity , where and are the abscissa and ordinate of the point , respectively. Then, calculates mod . Finally, transmits the messages , , and its identity to
U2. When receiving the messages from , generates a challenge . This challenge serves as the input value to the , and the outputs the response . Furthermore, computes . Finally, it stores in its own memory
The dynamic UAV adding process is shown in Figure 4. After the addition process is completed, the new UAV is deployed to the IoD environment, where it can perform the steps in Section 4 for mutual authentication with surrounding UAVs.
5. Security Analysis
This section presents security analyses that we perform on the proposed scheme. First, the widely applied real-or-random (ROR) model [31] is used for formal security analysis of our scheme. Then, the informal security analysis of our scheme is given. Finally, Automated Validation of Internet Security Protocols and Applications (AVISPA) tool [32] is used for formal security verification. Through these analyses, we conclude that the scheme is secure.
5.1. Formal Security Analysis Using ROR Model
The ROR model is applied in a formal security analysis to demonstrate the security of the session key (SK) of our authentication and key agreement (AKE) scheme.
Under the ROR model, an adversary interacts with the th instance of a participant, say . There are two participants in our scheme, namely, the UAV and the UAV . Both entities are involved in mutual authentication and key agreement. and represent the th instance of and the th instance of , respectively. Furthermore, in this proof, we model collision-resistant cryptographic one-way hash functions and and an ideal PUF function as random oracles, called , , and , respectively. All participants including have access to both hash functions and PUF.
The ROR model uses the elements shown below to perform [33]: (i)Execute(, ): it is modeled as an eavesdropping attack, and through this query, can obtain messages (, , and ) exchanged between and (ii)Send(, ): it is modeled as an active attack. executes this query, sends the message to the instance , and then receives a reply message based on (iii)Reveal (/): through this query, is able to obtain the current session key established between (or ) and its associated participants(iv)Freshness: the instance or is fresh, if does not use the Reveal(/) query to obtain the session key between two instances [34](v)Test(/): executes a query for the instance (or )’s session key . Then, an unbiased coin is thrown, if has been established and is fresh: (1) , will receive the session key ; (2) , will receive a random number with the same length as . Otherwise, will receive null (). Moreover, for an instance, can only execute the query once [35]
In the following, we give definitions of elliptic curve decisional Diffie-Hellman problem (ECDDHP) and the semantic security of session key, as well as the assumption of PUF unclonability required in the proof.
Definition 1 (ECDDHP). Let mod () be an elliptic curve over a finite field , and is a base point on . The ECDDHP is to give a quadruple and determine whether or is a uniform random value, where .
Definition 2 (Semantic security of session key). Under the ROR model, needs to distinguish whether a value is the instance’s session key or a random number. In addition, the adversary can perform multiple queries on multiple UAV instances. At the end of the game, has to return a guessed bit . If the condition is met, then, he/she wins the game. We represent as the event in which wins a game. ’s advantage of winning this game in polynomial time becomes , where represents our scheme. We say that in the ROR model, if this condition is satisfied, where is a sufficiently small real number, and then, is semantic security [34].
Assumption (PUF unclonability assumption). A PUF is defined as inputting a string of length and outputting an arbitrary string of length , that is, . The security of this function can be determined by described below. This mainly consists of two phases [33]:
Phase 1: selects a random challenge that has not been queried before.
Phase 2: is allowed to obtain response corresponding to other challenges except the challenge . then outputs the guessed response based on the challenge .
The correct response to is . The condition for to win the game is that . Therefore, we say , where is the length of and is also a big positive integer [36]. From this, it can be concluded that the probability of guessing the correct response is negligible.
In Theorem 1, the semantic security of session key established by our scheme is proved using the queries described above.
Theorem 1. Let a polynomial time adversary run in time against our scheme . Here, , , and denote the number of queries, queries, and queries, respectively. , , and denote the range space of , , and PUF, respectively. Furthermore, means that breaks the advantage of ECDDHP. Then, the advantage of in breaking ’s semantic security to obtain the session key SK generated between two UAVs can be estimated as
Proof. The proof of Theorem 1 is similar to the proofs given in [16, 33]. In this proof, we define the following four games, called (). In addition, represents the event that guesses the correct bit in . The detailed descriptions of these games are given below.
Game : the game is simulated as an actual attack on our scheme by under the ROR model. Here, it can be concluded as
Game : in this game, an eavesdropping attack is simulated; that is, can intercept all communication messages in UAV-UAV authentication phase through the execute query. After obtains these messages (, , ), he/she tries to establish a session key between and . then executes the test query and guesses the value of .
The constructed session key is made with , , , and , where and can be known by . Therefore, also needs to know about . Here, , where and can be intercepted by . However, it is difficult for to compute and because he/she cannot extract and from and , respectively. It follows that even if steals communication messages , and , he/she cannot calculate ; that is, the probability of winning the game does not increase. Since the games and are indistinguishable, the following conclusion is drawn:
Game : the game adds query on the basis of . The session key established between the two UAVs and is . The way to figure out the correct is to calculate or . and are what can get, and all that is left is to compute or .
Take calculating as an example, can obtain through the execute query and calculate through , where and are both known by . In order to obtain , needs multiple queries to find collisions. In our scheme, we assume that PUFs used are secure and that the probability of guessing the correct response is negligible as described in Section 5. This leads to the following results:
Game : this game is treated as an active attack, with the send query, the query and the query added base on .
performs multiple and queries to find hash collisions because he/she wants to trick legitimate instances into receiving tampered messages. Messages exchanged (, , and ) between two UAVs are safeguarded by collision-resistant one-way hash functions (, ). Since these messages all apply the random numbers, identity information, and secret credentials, there is no collision here when the , , and queries are executed by .
On the other hand, and , where can know , , , and in the execute query. The fact that computes or from and is computationally infeasible for because it is equivalent to solving the hard problem ECDDHP (see Definition 1) in polynomial time . Therefore, based on the birthday paradox of hash functions and the intractability of ECDDHP, we can infer the following results:
In the above game, simulates all queries. After executing the test query, he/she needs to guess the bit to win the game. Here, we can get
Combining Equations (4), (5), and (8), the following derivation can be obtained:
Applying the trigonometric inequalities in Equations (6) and (7) and the derived formula (9), the following is obtained:
Finally, we obtain
5.2. Informal Security Analysis
Through the discussion in this section, we show that our scheme is resistant to the attacks described below and ensures both forward and backward secrecy of the session key.
5.2.1. Replay Attack
We consider that during UAV-UAV authentication phase, an adversary may capture , , and in order to perform replay attack by resending them to receivers. However, this attack will fail due to the participation of random numbers. Let us take the message for example. sends and to . When .receives these information, it calculates and transmits to . After receiving the message, calculates and verifies that holds through and generated previously. If the formula holds, the received that contains the correct random number , , , and considers the message from to be new and receives it. This way, if replays , will perform the verification operation and get the result that the message is replayed. Similarly, this method is used to prevent the replay of other messages. Through the above discussion, our scheme is able to resist replay attack.
5.2.2. Man-in-the-Middle Attack
Under this attack, a man-in-the-middle adversary will intercept the communication information between UAV and UAV and then modify these messages in an attempt to make the tampered messages accepted by legitimate entities. Suppose that obtains the message during UAV-UAV authentication phase. In order to tamper with to become a valid message , needs to select a new random number and compute , mod . However, computing a legitimate is difficult for because he/she does not know ’s secret parameter . For the other two messages and , the adversary tries to modify them, and similar situations as occurs. It can be concluded that tampering with the communication information will fail, and man-in-the-middle attack is successfully defended by our scheme.
5.2.3. UAV Capture and Impersonation Attacks
As described in the threat model of Section 3, an adversary possesses the capability to capture a legitimate UAV flying in the air and apply power analysis attacks [9] to obtain secret parameters inside the UAV.
Here, we assume that captures the UAV and steals from it. In order to successfully simulate , the requirements for are to generate a valid message and send to , where is known by . Moreover, chooses a new random number and computes . Then, the remaining problem is that needs to calculate , which is not feasible for . The reason is because calculates a valid to obtain . Further, he/she needs to compute , where both and can be obtained by . However, even if captures , he/she cannot compute the response based on . Due to the unclonability of PUF, cannot produce identical and the same response . Furthermore, if the hardware of is damaged, still cannot get the expected response . Therefore, cannot successfully simulate a legitimate UAV.
5.2.4. Session Key Forward and Backward Secrecy
In our scheme, the session key between UAV and UAV is , where . If an adversary wants to calculate the correct , he/she needs to extract or from known or . However, this is difficult for , because obtaining or from or is equivalent to solving elliptic curve discrete logarithm problem. Therefore, computing the current session key is not feasible for . Obviously, and in each session are regenerated, so even if the current session key is stolen by , he/she cannot guess the previously established session key. Furthermore, this has no effect on the security of future session key. Therefore, our scheme can achieve forward and backward secrecy of the session key.
5.2.5. Privileged Insider Attack
Suppose an insider privileged person becomes an adversary who is able to gain access to the data stored in the ground station server , but he/she could not get the private key that belonged to . Before each UAV can be deployed to the environment, it needs to be registered on . After the registration process is over, the UAV stores the authentication-related parameters in the memory, and deletes the secret credentials related to the UAV from its own memory. In this way, cannot obtain secret parameters related to the authentication of the UAV. In addition, attempts to deploy a fake UAV into the existing network and communicate with a legitimate drone. To carry out this attack, needs to select a random number for and compute and . However, computing is a computationally difficult task for , because he/she does not have enough power to obtain ’s private key . As a result, the deployment of malicious UAVs with such attack will be defended against our scheme. According to the above discussion, our scheme provides corresponding protection against privileged insider attack.
5.3. Formal Security Verification Using AVISPA Tool
In this section, we use the AVISPA tool to verify whether our scheme can resist replay attack and man-in-the-middle attack.
AVISPA is an automatic touch-tone formal validation tool for Internet security protocols and applications that provides a modular and expressive language to appoint protocols and their security attributes [32]. The tool performs automatic analysis through the integration of four backends. These backends include OFMC, CL-AtSe, SATMC, and TA4SP [37]. In this verification tool, the high-level protocol specification language (HLPSL) is used. The language is mainly used to model protocols, and the formal semantics of this language is based on Lamport’s temporal logic of actions [38]. After modeling, the HLPSL code will be converted to an intermediate format (IF), which is then entered in one of four backends for automatic analysis. In the end, we obtain secure or insecure result.
In the implementation of our scheme, we have three basic roles, namely, an UAV , another UAV , and the ground station server . There is also an intruder, denoted by , who is also a participant in scheme execution. In addition to the above, there are also the roles for the session, environment and goal.
We have implemented our scheme using HLPSL and then selected OFMC and CL-AtSe backends for automatic analysis. The SATMC and TA4SP backends were not chosen because they do not support bitwise XOR operations. In order to check whether the replay attack can be resisted by our scheme, the backends verify that the legal agents can execute the scheme to search a passive adversary (intruder ) and then provide with information related to some normal sessions between the legitimate agents. In addition, the backends also need to verify the possibility of man-in-the-middle attack. Finally, we have obtained the simulation results, as shown in Figure 5. It can be clearly seen that our scheme provides protection against replay attack and man-in-the-middle attack.
6. Performance Comparison
In this section, we show the comparison between our scheme and existing similar schemes in terms of performance and security. Here, we have selected three recent authentication schemes [16, 18, 19] for comparison, all of which apply a similar system framework to our scheme.
6.1. Comparison of Communication Costs
In this section, we consider the bit size of messages exchanged between two devices when they authenticate each other. Here, we firstly set the bit value of each parameter, such as the identity of the device, random number, the output of hash function (if SHA-1 is used), and timestamp to be 160, 160, 160, and 32 bits, respectively. In addition, the size of the point on the elliptic curve (mod ) is 320 bits, where is a large prime number of 160 bits [30]. The element in has 160 bits. We also consider embedding the PUF proposed in [39] on the UAV used in our scheme. A 32-bit challenge serves as input to this PUF, which outputs a corresponding 320-bit response [6].
Table 2 shows the comparison of our scheme with other similar schemes in terms of communication cost. In the UAV-UAV authentication phase, our scheme requires three messages , , and , where the sizes of , , and are 800, 800, and 160 bits, respectively. Thus, the total communication overhead is bits. In addition, the scheme of Malani et al. [16], the scheme of Chaudhry et al. [18], and the scheme of Das et al. [19] demand the communication costs of 2144 bits, 1664 bits, and 1696 bits, respectively. It can be seen from the above description that the communication cost of our scheme is lower than that of Malani et al.’s scheme, 96 bits (=0.0000114 MB) more than that of Chaudhry et al.’s scheme ,and 64 bits (=0.00000763 MB) more than that of Das et al.’s scheme. The extra cost of our scheme is within 0.0001 MB. Therefore, even if our scheme is more than the schemes of Chaudhry et al. and Das et al., it has little effect on the performance of the UAV.
6.2. Comparison of Storage Costs
When an UAV is registered on the ground station server , it needs to store some secret parameters into memory for authentication with neighboring UAVs. This section provides a comparison of the amount of storage space required by a device in the device registration phase between our scheme and other related schemes.
In our scheme, stores the credentials , which require bits. The storage overhead of the device in Malani et al.’s scheme [16] is 1600 bits. The UAVs that complete the registration task in Chaudhry et al.’s scheme [18] and Das et al.’s scheme [19] both need to store 1280-bit secret parameters. Table 3 and Figure 6 provide a comparison of our scheme and other schemes in terms of storage cost. Obviously, our scheme requires less storage cost than these schemes [16, 18, 19].
6.3. Comparison of Computation Costs
This section describes how the proposed scheme compares with other related schemes [16, 18, 19] in terms of computation cost. To measure the computation time, we set up a simulation environment. We used a computer with an Intel i5-10300H processor and 16 gigabytes memory running Windows 10 operating system to represent an UAV or a smart (sensing) device. Moreover, we apply the MIRACL library to obtain the computation time of various operations. The following operations are performed on a computer representing an UAV or device. After the experiment, the specific time of each operation is shown as follows: (i)Point multiplication on elliptic curve: ms(ii)Point addition on elliptic curve: ms(iii)Hash function calculation: ms(iv)PUF calculation: ms [6](v)Modular multiplication in the finite field : ms(vi)A -degree univariate polynomial evaluation over the finite field : ms (suppose ) [19]
The comparison of computation costs between our scheme and other schemes is shown in Table 4 and Figure 7. In the mutual authentication phase between devices, the total computation costs required by Malani et al.’s scheme [16], Chaudhry et al.’s scheme [18], and Das et al.’s scheme [19] are ms, , and ms, respectively. However, the computation cost of our scheme in the UAV authentication phase is ms. It can be clearly seen that the computation cost of our scheme is smaller than that of the other three schemes, and the authentication efficiency is higher.
6.4. Comparison of Security and Functionality Features
In this section, our scheme compares with Malani et al.’s scheme [16], Chaudhry et al.’s scheme [18], and Das et al.’s scheme [19] in terms of security and functionality features. Table 5 provides the results of the comparison. As can be seen from the table, the schemes of Malani et al., Chaudhry et al., and Das et al. cannot resist man-in-the-middle attack, device impersonation, and capture attacks. Furthermore, Chaudhry et al.’s scheme and Das et al.’s scheme cannot successfully defend against privileged insider attack, and the private key of the control room in both schemes can be obtained by an adversary. However, our scheme achieves all the features mentioned in Table 5 and is more secure than the other three schemes.
Combining the above descriptions, it can be concluded that our scheme has greater advantages than the other three schemes [16, 18, 19] in terms of storage cost, computation cost, security, and functionality features.
7. Conclusion
The mode of multiple UAVs working together and sharing information has been widely used in various fields, so ensuring the communication security between UAVs is the top priority. In order to achieve this goal, this paper proposes a novel and lightweight authentication and key agreement scheme, which is suitable for the scenario of authentication between two UAVs. The scheme also applies PUF to defend against physical capture attack against UAVs. Our scheme has undergone formal security analysis (using the ROR model), formal security verification (using the AVISPA tool), and informal security analysis, which concluded that the scheme is well protected against some attacks such as replay attack and device impersonation attack. Moreover, compared with existing similar schemes, our scheme requires lower storage and computation costs and higher security. Therefore, the proposed scheme is very suitable in the environment of mutual authentication between UAVs.
In the future, we hope to evaluate the performance of our scheme in a real-world environment. This evaluation will help us adapt the proposed scheme to provide better security and performance when deploying UAVs in the environment. However, it is important to note that technical issues of communication between UAVs need to be solved when running our scheme in a real environment. The first is to solve the power supply of the communication module, the second is to complete the hardware and software configuration of the UAV and communication module, and the last difficulty is the shortage of spectrum resources.
Data Availability
The data used to support the findings of this study are included within the article
Conflicts of Interest
The authors declare that they have no conflicts of interest.
Acknowledgments
This work is partially supported by the National Natural Science Foundation of China under grant nos. 61701173, 61802445, 62072134, and U2001205 and the Key Research and Development Program of Hubei Province under grant no. 2021BEA163.