pqRID: Compact, Anonymous Remote Identification, and Post-Quantum Authentication for Drones

Since the Federal Aviation Administration (FAA) announced the Remote ID rule in 2021, ensuring drone privacy has become critical. Although the rule aims to increase accountability, it raises privacy concerns by exposing flight paths. Previous privacy-preserving protocols for drones rely on trusted third parties (TTPs) for drone authentication, which is unacceptable in critical infrastructure settings where flight data is sensitive and the ground control server (GCS) must authenticate drones in real-time. Furthermore, since existing studies rely on traditional public-key cryptographic algorithms, such as ECC or RSA, they should migrate to post-quantum cryptography (PQC) to ensure security against future quantum threats. However, applying PQC to existing protocols dramatically enlarges signatures and ciphertexts, causing them to exceed the 255-byte payload limit of Bluetooth/Wi-Fi Remote ID broadcasts. To address these challenges, we propose pqRID, the first method that supports both privacy and quantum-safe authentication under Remote ID constraints. pqRID uses pseudonym certificates for identification while preserving privacy and decouples identification from PQC-based authentication to satisfy broadcast size constraints. In pqRID, drones are provisioned with pseudonym certificates and IDs before flight. During flight, they broadcast their pseudonym IDs and use the corresponding certificate to authenticate themselves when prompted by the GCS without involving a TTP. We formally verified pqRID using ProVerif, ensuring authentication and unique ID non-disclosure. We implemented pqRID on a real UAV: a Raspberry Pi 4B mounted on a DJI-F450 drone. Our experimental results show that generating a PQC-based authentication message takes only 9ms and consumes 0.8J of energy on average.