## 2 Related Work  
The quest for secure and efficient authentication in the Internet of Drones (IoD) has spurred significant research, moving beyond traditional password-based systems. While [PERSON]'s work on visual two-factor authentication [8] effectively tackled keylogging and shoulder surfing using QR codes and smartphones in general computing environments, its direct applicability to the IoD is limited due to the impracticality of QR code scanning in typical drone operational scenarios. Recent IoD authentication research has increasingly focused on integrating stronger, user-bound factors and lightweight cryptographic primitives suitable for resource-constrained UAVs. Biometrics, as a \"something you are\" factor, has emerged as a key technology. [PERSON] et al. [5] proposed an IoD protocol combining biometrics with physically unclonable functions (PUFs), emphasizing resistance to drone capture and utilizing the RoR model for formal security. This work underscores the value of hardware-based security and biometrics in mitigating physical threats. [PERSON] et al. [9] designed an ECC-based mutual authentication scheme for smart grids that incorporates biometrics with fuzzy extractors, demonstrating the feasibility of such an approach in related distributed systems. The use of fuzzy extractors to manage the inherent noise in biometric data is a common theme in robust biometric authentication [9; 10; 12; 13]. Lightweight design is paramount in the IoD. [PERSON] et al. [1] developed a protocol based on HMAC-SHA1, focusing on minimal computational and communication overhead, and formally verified its security using ROM and ProVerif. Their approach highlights the preference for symmetric key cryptography and hash functions in resource-sensitive environments. Similarly, [PERSON] et al. [11] explored DRAM PUFs with entropy-derived features for lightweight authentication in the general IoT, which has similar constraints to the IoD. Several other protocols address specific IoD challenges. [PERSON] et al. [6] presented HOOPOE, an anonymous handover authentication protocol using AES-RSA, formally verified with the RoR model and ProVerif, addressing security during drone mobility between zones. [PERSON] et al. [2] introduced HCALA, which employs hyperelliptic curve cryptography (HECC) and blockchain for anonymous authentication in IoD, also verified using ROM and AVISPA. Blockchain has also been explored by [PERSON] et al. for privacy-preserving authentication [13] and for general IoDT authentication frameworks [18]. These blockchain-based approaches aim to provide decentralization and tamper resistance, though often at the cost of increased overhead compared to non-blockchain solutions. The security of IoD protocols is continuously scrutinized. For instance, [PERSON] [19] provided a cryptanalysis of [PERSON] et al. 's lightweight IoD authentication scheme [20],identifying vulnerabilities such as user tracking and stolen verifier attacks. This emphasizes the need for rigorous security analysis, including both formal proofs and informal assessments against a broad range of attack vectors. Other relevant works include efficient three-factor authentication for the IoD by [PERSON] et al. (2018) and various ECC-based schemes ([PERSON] et al., 2018; [PERSON] et al., 2018). [PERSON] et al. (2018) proposed CoMAD, a context-aware mutual authentication protocol for drone networks. Our proposed Bio-2 FA-IoD protocol draws inspiration from the need for strong, two-factor authentication that is resilient to observational attacks, as emphasized by [PERSON] (2018). However, it diverges by replacing the visual QR-code component with a biometric factor managed by the operator's device, making it more aligned with IoD practicalities.