LAPWF-IoD: Lightweight Authentication Protocol Combining Passwords and Wireless Fingerprints for Internet of Drones in Smart City Environments

With the growing adoption of drones in smart city services, mobile users frequently interact with the Internet of Drones (IoD) networks for real-time data exchange and control. However, the open nature of wireless channels and the resource constraints of mobile devices introduce authentication challenges in such dynamic environments. Existing authentication schemes often entail high computational and communication costs, limiting their applicability in mobile-enabled IoD systems. To address these limitations, this paper proposes a lightweight two-factor authentication protocol that integrates wireless fingerprints with passwords. The scheme enables secure mutual authentication between mobile users, drones, and ground stations, and supports the establishment of a shared session key. Security properties of the protocol are thoroughly evaluated through informal analysis, the Real-Or-Random (ROR) formal model, and ProVerif simulation. The results demonstrate that the protocol resists replay, man-in-the-middle, impersonation, cloning, denial-of-service, and offline password-guessing attacks. In addition, the ROR proof confirms the semantic security of the established session key, and ProVerif validates the confidentiality and authentication properties of the protocol. Performance comparison further shows that LAPWF-IoD reduces the average computational and communication costs by 49.17% and 14.16%, respectively, compared with existing authentication schemes, demonstrating its suitability for resource-constrained IoD deployments.