Seamless Cross Domain Handover Authentication for Multi Operator UAV Networks Using Consortium Blockchain and PUFs

Abstract

Large-scale Unmanned Aerial Vehicle (UAV) missions increasingly span the coverage areas of several independent operators, forcing a drone to re-authenticate every time it crosses an administrative boundary. Existing handover schemes either contact the home domain over a high-latency inter-operator backhaul, rely on cross-certified public-key infrastructures, or store long-term roaming credentials in flash memory that a captured drone readily surrenders. This paper proposes BCHA-UAV, a Blockchain-anchored Cross-domain Handover Authentication framework for multi-operator Flying Ad-Hoc Networks. During its initial attachment the home edge server issues the UAV a Lamport hash-chain seed and a domain-independent handover key, both sealed on the drone with a Physical Unclonable Function (PUF). The chain head and per-domain ECIES-wrapped handover keys are anchored on a consortium blockchain shared by all operators under PBFT consensus. A foreign edge server can then admit a roaming UAV with a single two-message exchange, verifying a one-time hash-chain token against its local ledger replica—without contacting the home domain, verifying a signature, or holding any prior relationship with the drone. Tokens are consumed on-chain, giving every operator an immutable, ordered handover audit trail and instant network-wide revocation. The protocol is proven secure in the Real-Or-Random model, verified with BAN logic, and modelled in HLPSL for AVISPA. Using an analytical cost model calibrated with micro-benchmarks on a low-power ARM platform, a handover costs the UAV only 0.324 ms of computation (one PUF evaluation, two scalar multiplications, and six hashes) and 202 bytes over the air in two rounds, achieves perfect forward secrecy, and reduces handover latency by up to 83% against schemes that must traverse the inter-operator backhaul.

Introduction

The text proposes BCHA-UAV (Blockchain-anchored Cross-domain Handover Authentication), a lightweight and secure authentication framework designed for Unmanned Aerial Vehicles (UAVs) moving between different network operators or administrative domains.

Traditional UAV authentication methods often depend on communication with the home network, complex certificate verification, or pre-shared credentials, resulting in increased handover delays, computational overhead, and security risks if a drone is physically captured. These limitations make secure and uninterrupted communication challenging, particularly for resource-constrained UAVs.

To overcome these challenges, BCHA-UAV integrates blockchain technology, Physical Unclonable Functions (PUFs), Elliptic Curve Cryptography (ECC), and Lamport hash chains. The proposed framework enables a UAV to authenticate with a foreign edge server without contacting its home server during handover. A consortium blockchain maintains shared authentication records, one-time handover tokens, and revocation information, ensuring transparency, replay protection, and secure cross-domain trust.

The framework uses PUF-based credential protection to prevent attackers from extracting usable secrets from captured drones. It also employs ephemeral Elliptic Curve Diffie–Hellman (ECDH) key exchange to establish fresh session keys and provide Perfect Forward Secrecy (PFS). The authentication process requires only two communication messages, reducing network overhead and handover latency.

The proposed system is evaluated using formal security analysis, including the Real-Or-Random (ROR) model, BAN logic, and AVISPA, along with analytical performance and energy-cost evaluations. The reported results indicate that each handover requires approximately 0.324 ms of UAV computation and 202 bytes of communication.

Conclusion

We presented BCHA-UAV, a cross-domain handover authentication framework that lets a roaming UAV be admitted by a previously unknown operator\'s edge server with a two-message, signature-free exchange. Ledger-anchored Lamport hash-chain tokens provide one-time proofs that are verified with a single hash and consumed on a multi-operator PBFT blockchain, giving replay protection, ordered auditing, and instant revocation; ECIES-wrapped per-domain handover keys remove the home-domain round trip from the critical path; PUF sealing protects roaming credentials against physical capture; and an ephemeral ECDH contribution guarantees perfect forward secrecy. The UAV spends 0.324 ms and 202 bytes per handover, and handover latency is independent of inter-operator backhaul quality. Future work will implement the scheme on a hardware testbed with commercial PUF-equipped microcontrollers, extend the token construction to post-quantum hash-based signatures, and study zero-knowledge handover auditing that hides even the consortium-visible linkage between successive domains.

References

[1] M. Wazid, A. K. Das, N. Kumar, M. Conti, and A. V. Vasilakos, \"A secure lightweight authentication scheme for IoT-based flying ad-hoc networks,\" IEEE Trans. Veh. Technol., vol. 69, no. 6, pp. 6653–6667, 2020. [2] G. Choudhary, V. Sharma, I. You, K. Yim, I.-R. Chen, and J.-H. Cho, \"A survey on cybersecurity for unmanned aerial vehicles: Attacks, vulnerabilities, and countermeasures,\" IEEE Commun. Surveys Tuts., vol. 25, no. 1, pp. 126–167, 2022. [3] V. Sharma, I. You, K. Andersson, K. Yim, and G. Pau, \"Secure and energy-efficient handover authentication scheme for flying ad-hoc networks,\" IEEE Trans. Aerosp. Electron. Syst., vol. 56, no. 5, pp. 3376–3391, 2020. [4] C. Lin, D. He, N. Kumar, X. Huang, and K.-K. R. Choo, \"A blockchain-based secure and efficient authentication scheme for mobile edge computing in flying ad-hoc networks,\" IEEE Trans. Services Comput., vol. 15, no. 6, pp. 3214–3226, 2021. [5] A. Mehmood, S. Khan, S. Lee, and J. Lloret, \"Lightweight blockchain-assisted authentication and key management for distributed flying ad-hoc networks,\" IEEE Syst. J., vol. 16, no. 4, pp. 6152–6163, 2022. [6] T. Alladi, V. Chamola, and M. Guizani, \"HARAuth: A physical unclonable function-based efficient authentication scheme for drones,\" IEEE Trans. Consum. Electron., vol. 66, no. 4, pp. 355–364, 2020. [7] U. Chatterjee, R. S. Chakraborty, and D. Mukhopadhyay, \"A physical unclonable function-based secure communication framework for unmanned aerial vehicles,\" IEEE Trans. Dependable Secure Comput., vol. 18, no. 5, pp. 2197–2209, 2021. [8] Z. Yan, P. Zhang, and A. V. Vasilakos, \"A survey on PUF-based authentication protocols for emerging IoT paradigms,\" IEEE Internet Things J., vol. 9, no. 17, pp. 15664–15682, 2022. [9] B. Bera, S. Saha, A. K. Das, N. Kumar, P. Lorenz, and S. Zeadally, \"Blockchain-envisioned secure data delivery and sharing scheme for internet of things-enabled flying ad-hoc networks,\" IEEE Internet Things J., vol. 8, no. 19, pp. 14498–14516, 2020. [10] R. Kushwaha, M. Wazid, A. K. Das, and S. Shetty, \"Secure and traceable authentication protocol for internet of drones with consortium blockchain,\" IEEE Trans. Intell. Veh., vol. 8, no. 5, pp. 3372–3384, 2023. [11] D. He, C. Chen, S. Chan, and J. Bu, \"Secure and efficient handover authentication based on bilinear pairing functions,\" IEEE Trans. Wireless Commun., vol. 11, no. 1, pp. 48–53, 2012. [12] D. He, S. Chan, C. Chen, and J. Bu, \"HandAuth: Efficient handover authentication with conditional privacy for wireless networks,\" IEEE Trans. Comput., vol. 62, no. 3, pp. 616–622, 2013. [13] X. Duan and X. Wang, \"Authentication handover and privacy protection in 5G HetNets using software-defined networking,\" IEEE Commun. Mag., vol. 53, no. 4, pp. 28–35, 2015. [14] Y. Zhang, R. H. Deng, E. Bertino, and D. Zheng, \"Robust and universal seamless handover authentication in 5G HetNets,\" IEEE Trans. Dependable Secure Comput., vol. 18, no. 2, pp. 858–874, 2021. [15] J. Cao, M. Ma, H. Li, R. Ma, Y. Sun, P. Yu, and L. Xiong, \"A survey on security aspects for 3GPP 5G networks,\" IEEE Commun. Surveys Tuts., vol. 22, no. 1, pp. 170–195, 2020. [16] A. Fu, Y. Zhang, Z. Zhu, Q. Jing, and J. Feng, \"An efficient handover authentication scheme with privacy preservation for IEEE 802.16m network,\" Comput. Security, vol. 31, no. 6, pp. 741–749, 2012. [17] IEEE Standard for Information Technology—Part 11: Wireless LAN MAC and PHY Specifications, Amendment 2: Fast Basic Service Set (BSS) Transition, IEEE Std 802.11r-2008. [18] L. Lamport, \"Password authentication with insecure communication,\" Commun. ACM, vol. 24, no. 11, pp. 770–772, 1981. [19] M. Castro and B. Liskov, \"Practical Byzantine fault tolerance,\" in Proc. 3rd USENIX Symp. Operating Systems Design and Implementation (OSDI), 1999, pp. 173–186. [20] D. Dolev and A. C. Yao, \"On the security of public key protocols,\" IEEE Trans. Inf. Theory, vol. 29, no. 2, pp. 198–208, 1983. [21] R. Canetti and H. Krawczyk, \"Analysis of key-exchange protocols and their use for building secure channels,\" in Proc. EUROCRYPT, Springer, 2001, pp. 453–474. [22] M. Burrows, M. Abadi, and R. Needham, \"A logic of authentication,\" ACM Trans. Comput. Syst., vol. 8, no. 1, pp. 18–36, 1990. [23] A. Armando et al., \"The AVISPA tool for the automated validation of internet security protocols and applications,\" in Proc. CAV, 2005, pp. 281–285. [24] V. Hassija, V. Chamola, A. Agrawal, A. Goyal, R. Lu, and M. Guizani, \"Fast, reliable, and secure drone communication: A blockchain-assisted 5G-connected approach,\" IEEE Commun. Mag., vol. 59, no. 9, pp. 70–76, 2021. [25] Y. Tan, J. Wang, J. Liu, and N. Kato, \"Blockchain-assisted distributed and lightweight authentication service for industrial unmanned aerial vehicles,\" IEEE Internet Things J., vol. 9, no. 18, pp. 16928–16940, 2022. [26] B. Gnanasankari and R. Padmanaban, \"PUF-anchored lightweight authentication and off-chain secure data sharing for consortium blockchain-enabled UAV networks,\" manuscript under review, 2026.

Copyright

Copyright © 2026 B. Gnanasankari, R. Padmanaban. This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.