# SENTINEL: A Secure and Efficient Authentication Framework for Unmanned Aerial Vehicles
## 1 Introduction  
Unmanned aerial vehicles (UAVs), also referred to as drones, have been primarily used for military purposes such as observing the enemy. Recently, they have used in civilian such as delivery services and entertainment [1, 2]. Due to the increase in the use of drones, the threats caused by the drones might also arise. Indeed, there are several security and safety issues raised by drones in the real world. In 2015, a drone crashed on the grounds of the White House [3]. That drone, DJI Phantom FC40, was too small and flying too low to be detected by radar. Although this incident was the result of an unintentional and inadvertent mistake, this happening demonstrates that drones can be used for military operations (e.g., delivering explosives and spying on people and buildings). To mitigate security risks caused by such (unknown) drones, we need to verify the identities of flying drones in real-time and prevent the flights of unauthorized drones. Recently, the concept of the Internet of Drones (IoD) was introduced as a network architecture to coordinate the access of drones in the airspace. In the IoD environment, each drone is always connected to a _ground station_ associated with a fly zone using the Internet connection based on a cellular network such as LTE and5G network. Figure 1 shows the communication channels between drones and ground stations in the IoD environment. Whenever a drone enters a new fly zone (Fly Zone \(j\) in Figure 1), the ground station in the fly zone checks whether the drone is authorized to fly in that zone using a security protocol. We assume that a 5G network connection is provided for the communication between the drone and the ground station. Based on the 5G network, a secure communication channel can be established between them. However, such a secure communication channel alone is not sufficient to detect flights of unauthorized drones that are capable of using the 5G network. To detect them, we need to additionally check whether a detected drone in a fly zone is authorized or not. That is, an authentication protocol for drones is required. Unlike typical IoT protocols, the protocol in IoD is required to satisfy several requirements, such as real-time authentication and scalability. In IoD, numerous drones would be operated simultaneously. Therefore, the authentication protocol for IoD should be scalable to be able to cope with the increasing number of drones. However, in several existing IoT protocols (e.g., [4; 5; 6]), a trusted third party is required while performing the authentication process. In this paper, we aim to design a highly scalable protocol to process a massive number of drones concurrently without relying on a single server. Moreover, the ground station should authenticate drones as fast as possible by using a short message and reducing the number of communications for real-time authentication. Therefore, we aim to develop a lightweight authentication protocol using a MAC (message authentication code) scheme with the new concept of the flight session key. Many security protocols (e.g., [7; 8; 9]) have been developed for authentication. Among them, digital certificate-based authentication mechanisms are more preferably used to authenticate devices and hosts on public communication channels such as the Internet. Notably, many Internet of Things (IoT) standards such as OCF (Open Connectivity Foundation) [10] and IoTivity [11] adopt a certificate-based scheme to authenticate IoT devices and establish secure sessions between them without user intervention. In theory, certificate-based authentication seems a neat solution for unmanned aerial vehicles (i.e., drones). However, to deploy such an existing certificate-based framework in the IoD environment, we need to address a challenging issue - certificate-based schemes are too expensive in resource-constrained drones with respect to communication overhead, power consumption, and memory footprint. First, it takes much time to exchange certificates between devices [12].