pqRID: Compact, Anonymous Remote Identification, and Post-Quantum Authentication for Drones

Abstract

Since the Federal Aviation Administration (FAA) announced the Remote ID rule in 2021, ensuring drone privacy has become critical. Although the rule aims to increase accountability, it raises privacy concerns by exposing flight paths. Previous privacy-preserving protocols for drones rely on trusted third parties (TTPs) for drone authentication, which is unacceptable in critical infrastructure (CI) settings, where flight data is sensitive, and the ground control server (GCS) must authenticate drones in real time. Furthermore, since existing studies rely on traditional public-key cryptographic algorithms, such as ECC or RSA, they should migrate to post-quantum cryptography (PQC) to ensure security against future quantum threats. However, applying PQC to existing protocols dramatically enlarges signatures and ciphertexts, causing them to exceed the 255-B payload limit of Bluetooth/Wi-Fi Remote ID broadcasts. To address these challenges, we propose pqRID, the first method that supports both privacy and quantum-safe authentication under Remote ID constraints. The pqRID uses pseudonym certificates for identification while preserving privacy and decouples identification from PQC-based authentication to satisfy broadcast size constraints. In pqRID, drones are provisioned with pseudonym certificates and IDs before flight. During flight, they broadcast their pseudonym IDs and use the corresponding certificate to authenticate themselves when prompted by the GCS without involving a TTP. We formally verified pqRID using ProVerif, ensuring authentication and unique ID nondisclosure. We implemented pqRID on a real autonomous aerial vehicle (AAV): a Raspberry Pi 4 B mounted on a DJI-F450 drone. Our experimental results show that generating a PQC-based authentication message takes only 9 ms and consumes 0.8 J of energy on average.