Crowding usually occurs in major occasions, such as international games and sports competitions, cultural festivals, concerts, religious gatherings, etc. We cannot ignore the possibility of accidents in large gatherings, such as the Hajj 2006 or Love Parade 2010 in Germany, and the Kumbh Mela stampede reported in 2013 in the past few years [1,2]. The demand for crowd management solutions in urban metropolises is also becoming more and more common. Such gatherings always have risks, so precautions need to be taken in advance to ensure public safety. In addition, it is also important to use technology to identify anti-social and atypical behaviors in the population, and to distinguish these factors in order to take preventive measures to enhance public safety and security. Recently, the pandemic riot phenomenon needs to perceive crowd behavior without involving human factors, and further requires technological innovation to deal with it. In order to ensure public safety, the administrator or event manager must foresee and check the indicators of real-time data captured from the crowded terrain, and finally make timely decisions to curb unforeseen situations.

In the follow-up of major catastrophic situations such as floods, earthquakes, fire outbreaks, and rescue operations, Unmanned Aerial Vehicles (UAVs) are the first responders. According to observations, surveillance is one of the emerging fields, which has expanded the application range of UAVs (or drones). The sensors in drones help these devices effortlessly expand the scope of mission execution, so they are very suitable for surveillance-based rescue and monitoring operations [3,4]. The drone can focus on their target location and can easily provide the control team with key information about what is happening at that location. The economy of its use and the technological improvement of drones make these devices a strong competitor to improve the safety of surveillance and crowd monitoring operations.

UAVs can help police officers ensure the security and safety of large cities, because these devices can be introduced in real time to collect real-time updates on various actions on the spot. For example, police officers in the United Kingdom use drones to catch suspected robbers [5]. However, it becomes very challenging to manage the efficiency and effectiveness of such monitoring systems in cities. Other agencies such as the US Congress and the US Department of Justice have allowed the use of drones to manage large-scale events in large cities [6]. The combination of drones with multimedia streaming, safe wireless interaction, forensic applications, video detection technology for abnormal motion [7], and video recognition of human abnormal behavior [8] may help to achieve a peaceful living place.

Nevertheless, this development of drone network technology exposes new ways of cyber threats, such as eavesdropping, privacy, forgery, and data reconciliation issues, which makes crowd management very challenging. If any malicious adversary accesses surveillance-related data, it may disrupt the entire surveillance activity. If any legal mobile user wants to access the data collected by a specific drone introduced in the flight area, this must be possible in the follow-up process of the mutual authentication process, leading to an agreed session key. The gateway is a trusted entity that cannot be hacked by opponents, and the mobile user's equipment and drones may be physically compromised. Therefore, designing a secure and lightweight authentication key agreement is essential for the Internet of Drones (IoD) architecture to overcome the above shortcomings.

The salient features of the contribution are as follows:

We propose a secure key agreement scheme for UAVs-based crowd sensing system. In the proposed scheme, police or intelligence personnel can safely obtain the real-time status of crowd dynamics with mobile devices by using crowd-sensing drones. These drones are used to report the perceived crowd information to the mobile user/police officer (CMD_i) through the reliable registration agency GRS_j after adopting an appropriate authentication process and using a mutually shared session key. However, this communication must be carried out between legitimate members after using a successful authentication procedure and establishing a mutually agreed session key

The rest of this article is organized as follows. Section 2 describes the related work. Section 3 explains the system model and adversary model. Section 4 demonstrates the proposed model. Section 5 analyzes the methods proposed on the formal and informal routes. Section 6 introduces the performance evaluation and comparative study of the proposed models. The conclusion is drawn in the last section.

We can find some research articles on protecting drone-based surveillance [10]. In [11], for example, the authors proposed a UAV communication scheme for rescue operations. In [12], the authors demonstrated the advantages and disadvantages of using drones to monitor the US border. In [13], the authors proposed a security method based on multi-UAV architecture to manage catastrophic scenarios. In [14], the authors discussed equipment for monitoring crowds. In [15], the hierarchical intrusion detection is designed as a lightweight detection and response method to protect drone-based networks from known attacks. Since then, the Time Credential-based Anonymous Lightweight Authentication Scheme (TCALAS) has tried to solve the problems in key protocols related to drone networks. In [16], a certificate-less group key authentication protocol for untrusted drone architecture is proposed. In [17], the authors proposed another lightweight authentication protocol for drone Internet. However, this scheme does not support mutual authentication and so lacks a secure key agreement. In [18], the authors proposed a mobile user authentication protocol for wireless sensor networks related to the Internet-of-Things (IoTs) framework, which establishes an agreed session key with sensor nodes. However, this protocol is particularly suitable for sensor nodes with insufficient resources only and so it uses minimal hash-based operations and XOR operations to support mutual authentication among sensor nodes, mobile users, and gateway server nodes. In [19], authors proved that the scheme in [18] is vulnerable because it does not support anonymity and untraceability. In addition, this solution is susceptible to forgery attacks, stolen card attacks, and man-in-the-middle attacks. In [20], authors proposed a novel and efficient signature-based authentication protocol for IoT-based architecture, in which data is accessed from IoT sensors in real time after a mutual authentication process. However, no solution can meet the goals of real-world online application scenarios to make full use of a secure drone-based crowd sensing system.

There is always a communication security threat between entities in the IoD environment. This requires the development of effective and efficient authentication protocols. The network model of the proposed framework is shown in Fig. 1, including three participating roles, such as control room (CR), ground registration station (GRS_j), mobile user (MU_i), and crowd monitoring drone (CMD_i). The IoD network consists of multiple flight zones with specific identifiers (FZ_i), and a specific UAV is deployed to any specific FZ_i, and at the same time it can fly and communicate with other GRS_j and drones of the same FZ_i. GRS_j acts as a trusted entity and is connected to the CR endpoint. GRS_j registers all mobile users and remote drones by providing long-term keys based on their identity. Mobile user MU_i or police officer with smart device obtain is/her own long-term key through GRS_j. The drone CMD_i introduced in a specific FZ_i can report to GRS_j in real time after scanning and monitoring crowd-based information.

We use the Dolev-Yao (DY) threat model to assume the capabilities of malicious adversaries. Under the DY threat model, adversaryA can intercept, delete, modify, append or replay any eavesdropping messages exchanged on public channels. The adversary can physically capture the deployed drone in any FZ_i, steal the information stored in its memory and manipulate it to achieve its malicious objectives. It may also attempt to use this information to expose secret network communications by disrupting the data exchanged between the hijacked drone and other un-compromised drones. In addition, the A can also obtain smart card credentials such as identity, password, and biometric secrets by using power differential analysis attacks [21]. For the current solution, compared with the DY model, we assume another powerful threat model, namely the adversary model of Canetti and Krawczyk (also known as the CK-adversary model). Under the CK model, A can physically access the credentials of a single entity by recovering its content and calculating its corresponding session key and its session state.However, a sound agreement must retain the forward and backward secrecy under the CK model in the follow-up actions of the exposed credentials. In addition, assume that GRS_j is deployed in a physically protected lock system as a trusted entity in our IoD-based architecture, which is reliably protected from malicious attackers.

Our proposed scheme consists of three sub-phases, namely the network establishment phase, the MU_i registration phase, the CMD_i registration phase and the mutual authentication procedure. Before we proceed, we have listed a summary of the symbols used in Tab. 1.

We here formally prove that our scheme can resist the known attacks under the random oracle model. In addition, we informally stated that our plan is protected from contemporary threats. The following subsections consider both formal and informal security analysis.

This section evaluates the performance of contributed protocol against the comparative studies including Wazid et al., Singh et al., Challa et al., and Turkanovic et al. on the basis of computational and communicational costs. The execution latency for the crypto-primitives employed by the comparative schemes [17,18,20,22] is depicted as T_fe to execute fuzzy extractor operation, T_h to execute one-way hash operation, T_ex to execute modular exponentiation operation, T_m to execute modular multiplication operation, T_ecm to execute (Elliptic Curve Cryptography) ECC-based point multiplication [31]. These crypto-primitive operations have been implemented for mobile user device as client and desktop computer as server. The mobile drones or user devices are equipped with biochemical detectors, infrared, microphone and camera-based sensors. We calculate the cost of computations with the help of MIRACL library [23] and Android-enabled MU_i/CMD_i client (Lenovo Zuk Z1 having 2.5Ghz Quad-core microprocessor, Android V5.1.2 OS, and 4GB RAM). To simulate the GRS_j environment we used desktop computer (HP E8300 Core i5 2.96Ghz, Ubuntu 16.12 OS and 8GB RAM). The experiments were conducted on the discussed client and server hardware platform that provides varying execution costs for various primitives. We select a multiplicative cyclic group G with order n having 160-bit prime integer.

This group G helps to achieve the 1024-bit RSA level of security. Using the above simulation, the execution timing of various crypto-primitives such as T_fe ≈ T_ecm, T_h, T_ex, T_m and T_ecm is computed as 16.403, 0.078, 3.943, 0.012 and 0.012 ms for MU_i/CMD_i, and 6.276, 0.013, 0.438, 0.003 and 0.003 ms, respectively. In [17], the mobile user takes 1T_fe + 16T_h computational cost with 17.6 ms of execution latency. The CMD_i takes seven T_h operations and GRS_j incurs eight T_h operations with computational cost 0.54 ms and 0.104 ms respectively. In [22], the GRS_j does not participate in the mutual authentication process. Therefore, in this phase the MU_i and CMD_i require 2T_ex + 5T_m and 2T_ex + 7T_m, i.e., 7.946 ms and 7.97 ms of computational cost, respectively. In [20], the MU_i and CMD_i entities bear 98.8 ms and 65.8 ms computational cost with given primitives 1T_fe + 5T_ecm + 5T_h and 3T_h + 4T_ecm respectively. On the server's end, it bears 31.43 ms of computational latency with 4T_h + 5T_ecm computations [18] bears 0.54 ms latency for both MU_i and CMD_i with 7 hash operations (7T_h) each, while on the GRS_j's end it incurs 19 hash operations with 1.482 ms computational latency. The proposed scheme employs 10T_h, 7T_h, 7T_h operations with 0.78 ms, 0.54 ms, and 0.54 ms of computational costs for MU_i, CMD_i and GRS_j, respectively. Tab. 2 describes the computational costs of [17,18,20,22] that are compared with the proposed schemes. For being lightweight symmetric crypto-operation, the hash function h(.) with T_h is suitable for crowd sensing drone-based ecosystem to save the energy of mobile devices and ultimately improve their uptime.

In order to compare communication costs, we assume that |G| characterize 1024-bit element size, while |Z_n| represents the 160-bit of each element in Z_n. Similarly, the |ID| depict the 32-bit size of timestamp as well as MUi's identity. We make the functionality comparison of our scheme against Wazid, Singh, Challa and Turkanovic et al. schemes in Tab. 4. The incurred communication cost of protocols [17,18,20,22] is compared against the proposed scheme as shown in Tab. 3. The Wazid et al. [17] bears the communication cost of 1696-bits which is calculated as 10|Z_n| + 3|ID| having 10 Z_n operations and 3 ID operations. Similarly, the [22,20,18] bear 4256-bits, 2528-bits, 2720-bits against 4|G| + 4|ID|, 10|Z_n| + 3|ID| and 10|Z_n| + 3|ID| crypto-operations, respectively. In comparison with other schemes, the proposed scheme has remarkably less communication cost of 1472-bits against 9|Z_n| + |ID| operations.

We now discuss the simulation details of the proposed model based on NS2 and the simulation details of the comparison schemes in [17,18,20,22]. We performed the simulation by using Ubuntu 14.04 long-term support (LTS platform) on the NS2 2.35 simulator [27]. We discussed the simulation parameters in Tab. 5. The total time taken by simulation is set as 2400 s (40 min). The entities CMDi, MUi, and Sj symbolize for i^th drone, i^th mobile user device, and j^th IoT sensor in the compared schemes. We consider the various mobility parameters as 20, 30 and 40 mps for CMDi, MUi and Sj. We also assume a fixed server gateway across all of these schemes. The communication messages as exchanged among these participants are shown in Tab. 3. In the simulated experiment, three network performance-based benchmarks are evaluated, i.e., packet loss rate (number of packets), EED (sec) and throughput (bps). We now discuss the impact on these factors in the experiment in the following.

The security and privacy requirements for reliable distribution of aerial monitoring and surveillance-based services have received increasing attention due to the vulnerability of the drone terrain. If the underlying authentication key agreement between the participating entities is not secure, the attacker may launch various attacks to disrupt the communication. In order to solve the security and privacy issues in such networks, we demonstrated a new identity verification protocol based on crowd monitoring drones, which enables participants to establish an agreed session key between them, and secure communication afterwards. Formal analysis under the Random Oracle Model (ROM) proved the proposed scheme. In addition, we used NS2 simulation to compare the proposed scheme with the existing scheme. Our analysis proves that the proposed scheme outperforms other schemes in terms of throughput, end-to-end delay and packet loss rate. Performance evaluation and benchmark factors show that the proposed scheme is secure compared with other contemporary studies in the same field. In the future, we can explore the prospect of using distributed systems based on blockchain to protect air surveillance.