## 5 Security Analysis
### Informal Security Analysis  
We evaluate the protocol against the security requirements outlined in Section 3.3. * **Mutual** authentication: Achieved. The OD (on behalf of \(U_{O}\)) authenticates to the GCS by demonstrating knowledge of \(P_{ID_{O}}\) and \(RP_{ID_{O}}\) (via the encrypted 'OTAC'). The GCS authenticates to the OD by correctly returning the 'PIN/' from the decrypted 'OTAC', confirming it possesses the correct session key \(KS\). This effectively prevents impersonation by either party and robustly meets requirement 1. This mechanism is similar to Khedr [8] but specifically adapted for biometric integration. * **Keylogging** and shoulder-surfing resistance: Primary authentication relies on the operator's biometric input. Any secondary PIN (\(P_{ID_{O}}\)) entry on the OD can be secured using an SVOSK-like interface [8], which effectively mitigates direct observation or software keylogging. This significantly enhances resistance compared to traditional password entry and clearly meets requirement 2. * attack resistance:
* _Operator/OD impersonation_: An adversary attempting to impersonate the operator or OD would need to correctly generate the 'OTAC'. This necessitates knowledge of the biometric key \(K_{\beta O}\) (to decrypt \(C_{RP}\) and obtain \(RP_{ID_{O}}\)), the local password \(P_{ID_{O}}\) (to derive \(K_{O}\) and \(KS\)), and the correct current timestamp \(T_{ID}\). Without these crucial secrets, forming a valid 'OTAC' and deriving the correct PIN is computationally infeasible. * _GCS_ impersonation: An adversary attempting to impersonate the GCS would be required to return the correct 'PIN/' in message \(M_{2}\). This 'PIN/' is the same 'PIN' generated by the OD and encrypted within the 'OTAC' using the session key \(KS\). An adversary cannot derive \(PIN^{\prime}\) without first deriving \(KS\), which in turn requires knowledge of \(P_{ID_{O}}\) and the fresh \(T_{ID}\). This makes GCS impersonation impossible for an adversary lacking the operator's secrets. This dual protection fulfills requirement 4, consistent with the strong impersonation resistance goals of IoD protocols like HCALA [2] and [PERSON] et al. [1]. * **Drone** capture resilience: A critical and distinct advantage of Bio-2 FA-IoD is its robust resilience to drone capture. The sensitive long-term secrets, specifically the operator's local password \(P_{ID_{O}}\), the encrypted random password \(C_{RP}\), and the biometric helper data \(HD_{O}\), are securely stored exclusively on the operator's device (OD), not on the drone \(D_{i}\). Consequently, even if a drone is physically captured and its stored data extracted, it will not compromise the operator's long-term credentials or the security of other operators or drones. This critically meets requirement 5, a vital aspect extensively discussed in [5]. * key (\(KS\)) security: The session key \(KS=KDF(P_{ID_{O}},T_{ID})\) is derived using the operator's local password \(P_{ID_{O}}\) (which is protected by biometric authentication on the OD) and a fresh, unique timestamp \(T_{ID}\) for each session. This ensures that KS isunique in each session and computationally difficult for an adversary to predict or derive without knowledge of \(P_{ID_{O}}\). This unequivocally meets requirement 6. * of OTAC payload: The sensitive components of the 'OTAC' payload \((PIN,T_{ID},RP_{ID_{O}})\) are securely encrypted using the session key \(KS\). This ensures that eavesdroppers cannot directly read these values from the intercepted 'M1' message, thereby rigorously maintaining their confidentiality. This directly meets requirement 7. * of authentication messages: Message integrity is implicitly and effectively provided through the successful decryption of the 'OTAC' and subsequent verification of its contents. If an adversary tampers with 'OTAC' in transit, the GCS's decryption will highly likely fail or yield incorrect values for \(PIN^{\prime}\), \(T^{\prime}_{ID}\), or \(RP^{\prime}_{ID_{O}}\).