## 1 Introduction  
The proliferation of unmanned aerial vehicles (UAVs), or drones, within the Internet of Drones (IoD) paradigm has significantly expanded their application scope, from civilian tasks like surveillance and logistics to critical military operations [1, 2, 3, 4]. This expansion, however, brings substantial security challenges, particularly for authentication [1]. IoD systems predominantly rely on open wireless channels for communication, making them susceptible to a multitude of threats such as eavesdropping, impersonation, man-in-the-middle (MitM) attacks, and replay attacks [5; 6]. Furthermore, the physical nature of drones means they can be deployed in hostile or unattended areas, increasing the risk of physical capture and subsequent compromise of any stored sensitive information, a vulnerability distinct from typical IoT devices [5; 6; 7]. Traditional password-based authentication, while common, often falls short in such environments due to vulnerabilities like keylogging and shoulder surfing, especially when operators interact with ground control systems through potentially insecure terminals. To address these evolving security needs, particularly in resource-constrained IoT environments, there is a compelling need for authentication protocols that are both robust and efficient [1]. Two-factor authentication (2 FA) principles, combining different types of credentials (e.g., something you know, something you have, something you are), offer a significant security enhancement over single-factor methods [8]. Biometric authentication, which utilizes unique physiological or behavioral characteristics of an individual, stands out as a strong candidate for the \"something you are\" factor, providing inherent user verification and resistance to observational attacks [9; 10]. Recent research in IoT and related fields has explored various methods to integrate biometrics, often with fuzzy extractors to handle the inherent variability of biometric data, and lightweight cryptographic primitives to ensure efficiency [5; 9; 11]. While existing protocols address some IoT security aspects, they often fall short in combining strong operator authentication (resistant to observational attacks) with lightweight design, or rely on mechanisms impractical for dynamic drone environments. This paper introduces Bio-2 FA-IoD, a novel biometric-enhanced two-factor authentication protocol designed specifically for the IoT ecosystem. Instead of relying on visual mechanisms like QR codes, which can be impractical for direct drone or operator-to-drone interactions in dynamic field conditions, Bio-2 FA-IoD leverages secure biometric verification managed through a dedicated operator's device (OD) [8]. This approach aims to provide strong user authentication while mitigating risks associated with traditional password entry and physical observation. The protocol architecture involves an operator (\(U_{O}\)), their personal OD, a drone (\(D_{i}\)) primarily acting as a communication relay, a ground control station (GCS), and a trusted authority (TA) for initial registration and trust establishment. The design prioritizes the security of operator credentials and the efficiency of the authentication process, making it suitable for the often-resource-limited nature of IoT components [1; 11]. The contributions of this paper include the following:  
1. **Novel biometric-enhanced 2 FA protocol:** The design of Bio-2 FA-IoD, a novel two-factor authentication protocol for IoT environments that integrates biometrics (via fuzzy extractors) as a primary operator verification factor, managed through a trusted operator's device, to provide strong, user-bound authentication resilient to observational attacks [5; 12; 13]. This includes detailed descriptions of the registration and authentication phases, incorporating fuzzy extractors for robust and reliable biometric key generation. 2.