Earlier, drones were mainly used for military mission delivery. However, with the invention of small unmanned aerial vehicles (UAVs or drones) becoming opened new possibilities to be applied in incident monitoring, search and rescue operations, disaster relief, and packages’ delivery. A popular Mobile Ad hoc Network (MANET) paradigm is Flying Ad hoc Networks (FANETs) are used for data transmission in the IoD environment. In contrast to other ad hoc network types, FANETs are distinguished by many unique features because it changes their topology dynamically [1]. Due to which it presents the research community with security challenges. The only solution to these security challenges is to design a robust authentication protocol for FANET to establish an efficient data transmission with the control station server. Besides security, energy consumption is also a big issue in UAVs (drones). As some tasks assigned to a drone need maximum flight time, while the electric power is not too to accomplish it, if the internal processing capabilities become modified without affecting its external functionalities, it can guarantee a complex operation with minimum power consumption. In this regard, the computation process to generate shared session key also needs to be adequate to transmit information among all the participants of IoD efficiently. This challenge is also possible by designing a protocol with fast and secure computation and communication features for data broadcasting [2].

In the Information society, cryptographic algorithms play a crucial role, and they secure us when we use debit cards or credit cards, call someone on a cell phone, get access to health care services, or buy something on the internet. These algorithms ensure that our transactions and bank accounts are secure, our telephone, voice-over-internet protocol (VoIP), or instant messaging cannot be listened to by anyone, and that confidential health information is protected from unauthorized access. Cryptographic protocols support digital signatures, user and data authentication, and more advanced functionalities such as electronic money or electronic voting, e-government, and e-commerce in the near term [3]. Moreover, a cryptographic hash function is a technique for verifying data validity, can run on data for checksum purposes, and cryptographically encompasses algorithms for cyclic redundancy checks. It translates data of arbitrary size into a fixed valued numerical string called a hash [4]. In the same way, the researchers in this paper have used cryptographic algorithms to design a security mechanism for working in the IoD environment.

Furthermore, the already available cryptographic algorithms can also be used to secure the transmission path of drones with the control station server or external user to perform a tactical task. However, due to the existence of a strong adversary, only cryptographic-based protocols cannot achieve the goal of sensitive transmission security in IoD. It must need to be appropriately formalized; so that one must determine what the opponent/adversary is permitted to do and when the attack is successful. Under any complexity assumption, a cryptosystem would be “secure” if it demonstrates that the security principle is fulfilling, and the attacker could not crack the protocol [5]. However, a cryptographic system’s security is most often proximate: its security is based on an assumption of complexity which is commonly believed in confidentiality. In the cryptographic research community, these methodologies are now the standard [6]. We, too, will first identify all possible threats to the system, design a cryptographic-based security mechanism, then evaluate its security as stated above and pragmatically illustrate them in the informal security analysis section of the paper to make it trustworthy in drone information transmission security for IoD.

Although, the increasing use of drones is raising security issues. Without incorporating the issue of security in the IoD, we cannot mitigate all other associated issues and challenges like power and navigation, product and traffic, privacy and obstacle detection, etc. Therefore, this research focuses on designing cryptographic hash functions, XOR operations, and public key infrastructure (PKI) based authentication protocol for IoD using FANET. Because the security of exchanged information among all the IoD’s participants is a challenging issue, it needs a robust, lightweight authentication protocol. The authentication protocol presented in this paper can extract dynamic identities and random numbers to ensure the dynamism feature in the protocol. The cryptographic hash-based function assimilates different security features like untraceability and anonymity and caters to the flaw of outdated data broadcasting. All these cryptographic algorithms (PKI, hash, XOR, SHA-1, MD5, AES, etc.) collaboratively used for the protocol design can guarantee to mitigate forgery, side channel, privileged insider, and stolen verifier attacks often seen in prior authentication protocols. Furthermore, it can show resistance to known attacks such as denial of service (DoS), man-in-the-middle, replay, drone capture attacks, and spoofing with other drones.

According to this model, a valid user must first register with the control station registry, and then a drone must also register with CSS. It is worth noting that the control station server has been designated as a wholly trusted individual. Their confidence must be consistent as a lack of trust could jeopardize the system’s reliability. The proposed scheme means that the user and the remote server will fully trust the registration center, while any other entity alone cannot be fully trusted. Gharibi et al. [1] defined the flying zone strategy for a large geographical region in detail. We also consider their zone strategy for achieving impartiality, modularity, and standardization so that a drone can securely communicate with the ground station and external users. According to Gharibi et al. [1], for each drone, the Zone Service Provider (ZSP) is responsible to facilitate a drone for navigation services and designate zone on the request of a drone. Also, ZSP has the authority to put orders for landing drone, hold the drone in the current flying zone, or switch drones from one flying zone to another. ZSP planned collision-free navigation services to a drone, route maintenance between two drones, along many performance characteristics.

Furthermore, to cover a larger area, such as an entire country, the ground stations must communicate logically with one another. This technique would track drones in a cluster at various flying zones, traffic, and drone switching from one flying zone to another and provide mandatory statistics. [1] also clarified handover strategies when a drone moves from one flying zone to another, as shown in Fig. 1.

In Fig. 1, the certification for all drones is considered from a specialized framework installed within CSS, providing networking, information management support, and real-time problem-solving capabilities. The CSS is in charge of controlling, monitoring, and supervising drone navigation services. Network services and a wireless communication interface are also needed on all drones and are closely supervised by the CSS. The flight zones are another challenge for the CSS, and the drone must be operationalized in pre-determined flight zones/clusters. An external user can access a designated drone from a specific zone is also monitored by the CSS. CSS controls its flight and verifies its existence when a drone enters the IoD environment. The confirmation authenticity of a legitimate drone or the identification of an unauthorized drone in the flying zone can also easily be detected by the CSS due to its services agent capabilities.

The drone’s computing resources are severely limited, making it vulnerable to various security threats such as replay attacks, forgery attacks, and man-in-the-middle attacks. Seriously, a drone’s surveillance work in smart cities could cause serious harm at any moment. He et al. [5] suggested an elliptic curve cryptography-based lightweight identity authentication scheme. However, they neglect to mention drone addition, revocation, and password update phases. According to [9], malicious drone in contact between ground stations and drone causes data transmission and instruction data leakage. The identity authentication, validity, reliability, and privacy of a drone with the ground station have been addressed by [10] but do not offer perfect forward secrecy.

According to [11], low latency authentication plays a fundamental role on the internet of drones in a disaster environment where latency is between life and death. Furthermore, unauthorized access, energy consumption, and latency concern the internet of the drone’s network [3]. The author [12] proposed a lightweight protocol that achieved performance but compromised security and could not resist most attacks. Another mutual authentication protocol was proposed in [13], and the scheme is based on PUF but failed to provide comprehensive security. The protocol proposed in [14] provides poor performance, leading to a fatal accident in IoD networks.

Furthermore, the author [15] cryptanalysis the scheme [16] and finds out that they cannot resist stolen authentication and traceability issues. According to [17], the scheme used in [18] suffers from session key leakage, inability to provide user anonymity, and scalability issues. Moreover, the scheme [19] used the same certificate in the authentication phase; thus, it does not provide anonymity.

In recent years, the idea of the Internet of Things (IoT) has been implemented for the IoD environment. The data, communication, and network technology are incorporated for drones in IoD because it is used for consumer conveniences like entertainment, toys, agricultural-land monitoring, high-value industries, and wide applications in the defence field shooter product [10]. Suppose improved battery power, sensing systems, communication security, and other technologies and incorporating them into drone technologies can become a top-rated product in recent years, advancing various fields and activities. In that case, small UAVs have enormous potential and have significant application versatility. In addition to personal aerial photography, entertainment, and commercial markets, they can be used in a range of surveillance activities, such as disaster relief, in diverse environments involving animals and plants, coasts and borders, in the transport of goods, military, and police enforcement tasks, and also in agricultural and industrial applications. Also, the smart city features like traffic monitoring and management, merchandise distribution, health and emergency services, and air taxi services, for example, will increase the efficiency, effectiveness, timeliness, reliability, and performance of these services and may help reduce the cost of delivering these services [20].

Small UAVs, however, can also pose many security threats when misused. Different researchers made several attempts to secure its data transmission. For example, Hussain et al. [21] proposed an elliptic curve cryptographic-based authentication scheme to secure the communication of external users and drones in the pre-defined flying zone. After successful information broadcasting, the drones can then be deployed for different applications like broadening IoT base IoD, smart cities surveillances, sidewalk monitoring, and stealth purposes. Yahuza et al. [22] identified flaws in some prior IoD-based protocols like switching drones from one flying zone to another needed a robust mechanism for self-organizing its previous secure transmission path. They mitigated the flying zone flaw and proposed a provably secure protocol, and named it SLPAKA. Gope et al. [23] claimed that robust information authentication is necessary to successfully deploy UAVs in crop spraying, public safety, and critical infrastructure surveillance. For this, they proposed a privacy-aware edge-assisted UAVs protocol by taking into account the procedure for resistance of UAVs from physical capturing. Tian et al. [24] also proposed a security framework for edge-assisted IoD using the securely computed authenticated key in online and offline mode for efficient open-access communication. However, due to batch verification of the signature, the computation tie complexity of their framework is not good. Ever [25] demonstrated that the key features of drone-like mobility, energy consumption, reliability, and efficiency for an open network are fundamental because all the IoD participants are not designed with an integrated security phenomenon. Therefore, they proposed a security framework for IoD using WSN. They used the elliptic curve discrete logarithmic function to secure participants’ computing keys. However, it still suffered from a key-escrow problem; [26] provision of secure and efficient communication between drone & ground station for smart city surveillance, [27] secured the confidential data transmission between drones in IoD environment, [28] presented protocol for public cloud data security in IoT enabled equipment using MANET, and [29] presented three-factor key-agreement protocol for network-enabled devices using WSN. Similarly, [30] demonstrated an authentication scheme for an e-health-care system using WMSN, and [31] published a homomorphic encryption-based authentication scheme for IoD environment in which innovative knowledge for the different environments has been presented. Also, [32] proposed a privacy protection protocol for grid computing has been presented in which guarantees secure communication between service providers and smart objects, and [33] presented a three-factor (password, smart-card and biometric) based authentication scheme, which works for Unmanned Aerial Vehicular Networks.

Zhang et al. [14] designed a one-way hash function based on authentication and key agreement scheme for the Internet of Drone in which they claim that their scheme can guarantee for cross verification of each participant during communication. They presented the scheme in three phases: setup, registration, and mutual authentication. After the extensive analysis, it has been noted that their scheme is suffering from the following drawbacks:

An attacker can intercept the first message sent between the user and the control server, which leads to forgery attacks. The intruder may then modify the timestamp ST1, but the CS would not detect this. Furthermore, if an intruder physically captures the drone [14], store security credentials in its memory to participate in the authentication protocol; as a result, an attacker can gain access to the memory or use side-channel attacks to obtain the stored credentials. It means the scheme is suffering from side-channel attacks.

To solve the weaknesses mentioned in Zhang et al. [14] scheme above, we, as a result of this, have proposed the following improved scheme consisting of 1) setup phase, 2) registration phase, 3) mutual authentication and cross-verification phase, 4) user’s biometric/password update Phase, 5) dynamic drone addition phase, and 6) drone revocation/reissue phases, each of these are described one by one as under, while the different notations used for designing the scheme are shown in Tab. 1.

Security analysis for any protocol is considered an essential task. Because security analysis uses system engineering ideas and trust to scrutinize and examine the strength of a cryptographic-based designed protocol, this section identifies the protocol’s credibility, authenticates the IoD environment protocol’s stability, shared authentication, and integrity. The protocol mentioned above analyzed formally using BAN Logic [34] and, ProVerif2.02 [35], which are as under:

In this section, the performance analysis/evaluation of the proposed authentication protocol can be performed from the perspective of storage overheads, computation, and communication costs by keeping the already experiment conducted by [37], which are as under:

The widespread usage of IoD technology and the non-availability of foolproof secure authentication protocols for the IoD environment motivates us to design a mutual authentication and cross-verification protocol. The current research work deeply examined different protocols available in the literature and highlighted the various flaws in Zhang et al. protocol. We then presented a PKI, XOR, and simple hash function-based protocol used for checksum at both ends. This cyclic checksum of hash functions has the capability of less storage and high security. Its performance is better than any other method because it allows mutual processing of public network channels between Drone-CSS, CSS-Drones, User-Drone, and CSS-Drone without loss of security. The proposed scenario’s security has been verified formally using BAN logic of authentication. While the key secrecy, confidentiality, and reachability have been verified using the ProVerif2.02 toolkit. Moreover, the strength of the scheme has been discussed pragmatically in the informal analysis section of the paper. At the end of the article, the performance analysis section has been completed by considering three metrics storage, communication, and computation costs. Upon comparing the proposed scheme with state-of-the-art protocol, it has been shown that it is efficient and effective and can be recommended for practical implementation in the IoD environment.