Building Trust in Autonomous Aerial Systems: A Review of Hardware-Rooted Trust Mechanisms

Abstract

Unmanned aerial vehicles (UAVs) are redefining both civilian and defense operations, with swarm-based architectures unlocking unprecedented scalability and autonomy. However, these advancements introduce critical security challenges, particularly in location verification and authentication. This review provides a comprehensive synthesis of hardware security primitives (HSPs)—including Physical Unclonable Functions (PUFs), Trusted Platform Modules (TPMs), and blockchain-integrated frameworks—as foundational enablers of trust in UAV ecosystems. We systematically analyze communication architectures, cybersecurity vulnerabilities, and deployment constraints, followed by a comparative evaluation of HSP-based techniques in terms of energy efficiency, scalability, and operational resilience. The review further identifies unresolved research gaps and highlights transformative trends such as AI-augmented environmental PUFs, post-quantum secure primitives, and RISC-V-based secure control systems. By bridging current limitations with emerging innovations, this work underscores the pivotal role of hardware-rooted security in shaping the next generation of autonomous aerial networks.

1. Introduction

UAVs, often referred to as drones, have transitioned from being tactical military tools to essential resources in a variety of civilian fields, such as infrastructure surveillance, precision farming, and emergency response [1,2,3]. Their capability to operate in dangerous or isolated locations makes them especially valuable for assessing critical infrastructure more effectively than conventional techniques [4,5]. The advent of swarm-based UAV systems represents a notable progress in drone technology [6]. These systems facilitate scalable, fault-tolerant, and cooperative multi-agent operations, providing improved coverage, adaptability, and efficiency for dynamic missions such as inspecting power lines, pipelines, precision agriculture, and bridges [7,8,9]. As shown in Figure 1, swarms of intelligent, collaborative drones are increasingly utilized in industrial and emergencies situations, where they can sustain real-time communication and data transfer even in regions without ground-based infrastructure [10,11].

However, these advancements present complex security challenges with the rise in autonomous and interconnected UAV swarms [13]. Ensuring secure communication, strong authentication, and reliable location verification is crucial, particularly in adversarial or resource-limited environments [11]. UAVs are vulnerable to cyber threats, such as data breaches, unauthorized access, and hostile interference, which can jeopardize both the drones and the sensitive information they gather [12,14]. Erroneous or manipulated data can result in misguided evaluations and potentially disastrous failures, especially when assessing safety-critical infrastructure [9,15]. To address these issues, this review emphasizes hardware-based security solutions that provide tamper resistance and energy efficiency, essential requirements for UAV swarm operations [16]. It specifically analyzes three types of HSPs: PUFs, TPMs, and Secure Enclaves, including Blockchain-integrated systems [17,18,19]. The literature examined spans from 2016 to 2024 and includes peer-reviewed articles from IEEE, Springer, and Elsevier, selected for their relevance to UAV swarm security and their contributions to authentication and location verification at the hardware level.

This review is structured to provide a comprehensive understanding of hardware-based security mechanisms in UAV systems, with a focus on their applicability across diverse operational environments. The paper is organized as follows: Section 2 summarizes related work based on secure communication and data integrity. The broad spectrum of UAV applications, including disaster response, military reconnaissance, urban logistics, infrastructure inspection, and environmental monitoring, are discussed in Section 3 as drone applications. Section 4 describes the typical communication stack in UAV systems, including ground control links, inter-drone communication, flying ad-hoc networks (FANETs), and satellite backhaul. Cybersecurity Challenges in UAVs reviews the main cybersecurity threats facing UAVs, such as GPS spoofing, signal jamming, relay attacks, malware injection, unauthorized access, and the need for hardware-based solutions detailed in Section 5. HSPs Provides an in-depth review of key hardware security primitives, including PUFs, True Random Number Generators (TRNGs), TPMs, and tamper-resistant hardware. Their mechanisms, strengths, and limitations are discussed in Section 6. Section 7 covers emerging methods for enforcing location-aware policies and compliance, including distance-bounding, delay-based decryption, AI-driven PUFs, and blockchain-based attestation. Real-world challenges in securing UAVs across military, disaster, and urban environments, assessing HSP suitability and current limitations are examined in Section 8. Key findings and open research challenges, such as robust PUF design, scalable distance-bounding, and lightweight blockchain consensus, are discussed along with future directions in post-quantum security and AI-integrated hardware primitives, as summarized in Section 9. The key contributions of this review are summarized as follows:

• Reviews HSPs (PUFs, TPMs, TRNGs, tamper-resistant modules) for UAV swarm security.
• Provides a comparative evaluation of HSP-based techniques in terms of energy efficiency, scalability, and operational resilience.
• Analyzes hardware–software trade-offs and advocates hybrid security architectures.
• Links UAV applications to context-sensitive security needs in urban, rural, and military environments.
• Highlights emerging technologies: AI-augmented PUFs, blockchain-based attestation, and RISC-V secure architectures.
• Summarizes attack surfaces and maps them to hardware/software countermeasures.
• Identifies open research challenges and outlines future directions, including post-quantum security and AI-integrated primitives.

2. Related Work

Drone security is becoming an increasingly vital aspect of drone operations. Many drones were developed without considering security features, functioning in open connections and variable environments [20,21]. Consequently, safeguarding privacy and security is crucial in UAV-assisted networks, as these UAVs are susceptible to attacks and can be easily compromised by intruders [22]. Figure 2 shows a UAV-assisted communication system across space, air, and ground layers. Designed for emergency coordination, it highlights vulnerabilities in data links that are exposed to interception or disruption. The use of low Earth orbit (LEO) satellites, UAVs, and ground stations underscores the need for strong security protocols [23]. These structural features also apply to the broader Internet of Drones (IoD), which faces similar challenges due to the lack of standardized security frameworks [22].

Furthermore, the emerging Internet of Drones (IoD) ecosystem lacks established security protocols, resulting in inconsistent practices and difficulties in ensuring robust security measures [24]. The swift advancement of drone technology has led to various security strategies aimed at protecting drones and their operations; drone security encompasses the use of Radio Frequency (RF) signals emitted by drones during their communication with ground controllers [25]. Nevertheless, there remains considerable ambiguity regarding the relationship between security measures in drone technology, such as encryption, authentication, intrusion detection, and secure communication protocols [26,27,28]. Bansal et al. discuss the security approach concerning the limited resources of drones, emphasizing that as drones increasingly depend on software and communication networks, cybersecurity becomes critical [29]. Techniques such as intrusion detection systems (IDS) and firewalls are employed to monitor and protect against cyber threats [30]. Drone security is a crucial area in UAV operations, as drones frequently operate in open networks with fluctuating topologies, rendering them susceptible to intrusions and attacks [22]. The IoD ecosystem complicates security initiatives due to the lack of standardized protocols, which results in inconsistent practices and challenges in achieving thorough security [31]. Several strategies have been suggested to mitigate these vulnerabilities, including the application of RF signals for intrusion detection [32], encryption [33,34], authentication schemes [35], and secure communication protocols [36,37]. However, as pointed out by [15], significant uncertainty persists regarding the integration of encryption, authentication, and secure communication protocols. Ref. [30] highlights the necessity of cybersecurity measures such as IDS and algorithms to combat cyber threats. Additionally, optimizing energy consumption is vital for prolonging UAV operational time, as illustrated by [38], who proposed a methodology for calculating UAV energy levels based on path length and operational parameters. As drones become increasingly efficient and prevalent across various applications, including data collection, concerns about privacy and adherence to regulations are gaining importance [39,40]. Ensuring accurate and reliable data collection remains a significant focus in the literature. High-resolution drone cameras, as noted by [41], facilitate precise measurements of pedestrian and bicycle traffic, thereby enhancing data integrity. Gillan et al. further illustrates how innovative drone workflows can markedly boost efficiency, cutting down manual labor by an estimated 111 workdays in rangeland monitoring. These advancements not only streamline large-scale data collection but also illustrate drones’ potential to link environmental data with management decisions [42]. However, while these technologies enhance efficiency and accuracy, challenges such as data storage, processing complexity, and regulatory compliance remain areas for further exploration. Beyond data collection, privacy concerns remain a significant challenge in drone-based data collection, particularly regarding the inadvertent capture or disclosour [43]. Tu et al. emphasize the need for clear regulatory guidelines to govern the types of information drones can collect and share, ensuring compliance with privacy and security standards [43]. Similarly, Kim underscores the importance of adhering to local regulations when drones operate in public spaces, as failing to mitigate privacy risks—especially concerning identifiable information—can undermine public trust and ethical integrity [41]. Several surveys have addressed UAV security from a general perspective, often focusing on software-based solutions such as encryption, IDS, and anomaly detection [44]. For instance, some works have reviewed lightweight cryptographic protocols for UAVs, while others have explored secure routing in FANETs [45,46]. However, these approaches often fall short in disconnected or adversarial environments where software defenses can be bypassed or disabled.

Bibliometric Assessment of Secure Drone Communication

To assess evolving research trends in drone security, a bibliometric analysis was performed using Scopus-indexed journal articles. The search included the keywords ‘drone’, ‘security’, ‘communication’, and ‘integrity’, yielding 578 documents. Keyword co-occurrence mapping was performed using VOSviewer 1.6.20.0, with the resulting visualization shown in Figure 3.

The co-occurrence map reveals four primary clusters representing distinct research trajectories as follows:

• The red cluster, centered on terms such as ‘machine learning’, ‘computer vision’ and ‘drone technology’, suggests extensive integration of AI into UAV applications.
• The blue group highlights terms such as ‘data collection’, ‘Internet of Things’ and ‘emergency communications’, indicating a focus on real-time data dissemination and telemetry.
• Green clusters ‘mutual authentication’, ‘security attacks’, ‘control station’ and ‘ground control station’, pointing toward security-centric research in swarm coordination and secure routing.
• The yellow group, which includes ‘energy consumption’ and ‘use of unmanned aerial vehicles’, emphasizes the challenge of balancing computational security overhead with resource constraints in real-world deployments.

Notably, the co-occurrence of “data analysis” with “mutual authentication”—and the relative underrepresentation of “use of drones”—indicates that modern research emphasizes data-centric integrity techniques over basic drone operations. Blockchain-based solutions continue to gain traction due to their tamper-resistance and decentralized ledger characteristics [47]. For instance, the Anonymous Secure Messaging Token Protocol (ASMTP) [48] introduces token-based authentication mechanisms and integrity-preserving communication within UAV swarms, combining formal verification with lightweight encryption. In summary, the literature reflects an increasing convergence between machine learning, energy-efficient cryptographic techniques, and protocol-based authentication, with emerging attention to scalable trust frameworks such as blockchain and PUF-based identity verification [49,50]. In contrast, this review emphasizes hardware-assisted security, which provides stronger guarantees through physical tamper resistance and device-level uniqueness [17]. While a few recent studies have touched on PUFs or TPMs in UAVs, they often do so in isolation or without a comparative framework [16,51,52,53].

Our contribution is to synthesize these developments, compare their trade-offs, and highlight their applicability to location verification, a critical but underexplored aspect of UAV swarm security.

3. Application of Swarm Drones

The swift advancement of drone technology has considerably broadened the range of UAVs, especially swarm drones, across numerous mission-critical and commercial uses [54,55,56]. Swarm drones are increasingly utilized in situations such as search and rescue operations, autonomous deliveries, precision farming, and environmental observation [57,58,59]. UAVs are now embedded in a wide spectrum of applications—including security and surveillance, mapping and farming, filming and inspection, and logistical tasks such as delivery and crop spraying—highlighting their versatility and growing significance across industries [60]. These applications take advantage of swarm intelligence, allowing for distributed decision-making, adaptive control, and collaborative task execution [61,62]. Nevertheless, their use in regulated settings requires strict assurances regarding device authenticity, data origin, and spatial integrity [3].

3.1. Functional Role of the Application Layer

The application layer is vital for the operations of drone swarms, serving as the foundation for reasoning, decision-makingking, and task coordination [5,13]. It encompasses a mission decision component that assigns tasks and formulates collaborative directives to achieve the overarching objectives [18,63]. This layer guarantees that swarm drones can flexibly adjust to mission demands and environmental changes, making them suitable for intricate tasks in real time [30,64].

3.2. Sector-Specific Applications

3.2.1. Agriculture and Environmental Monitoring

In the realm of agriculture, drones have become essential instruments for precision farming [65,66]. They facilitate real-time crop observation, targeted pesticide distribution, and soil health evaluations through multispectral imaging [67,68]. These functionalities not only improve yield optimization, but also encourage sustainable practices by reducing resource waste [65]. In environmental monitoring, sensor-equipped drones are used to evaluate air quality, identify water contamination, and assist in conservation initiatives [69].

3.2.2. Construction and Infrastructure

Drones are extensively utilized in construction and infrastructure for surveying, mapping, and monitoring [70,71]. UAVs equipped with high-resolution cameras and LiDAR sensors offer precise 3D models and real-time updates, boosting safety and operational efficiency [72,73]. Their capability to access difficult or dangerous locations makes them well-suited for inspecting bridges, tunnels, and other vital structures [74].

3.2.3. Logistics and Urban Mobility

In logistics, drones are transforming last-mile deliveries by reaching isolated or congested regions, thereby shortening delivery times and reducing operational costs [43]. This trend is especially prominent in the delivery and logistics sector, which is anticipated to grow at a CAGR of 14.3% from 2025 to 2030 [75]. As the reliability of swarms enhances, drones are expected to be pivotal in urban air mobility and coordinated delivery systems [7].

3.2.4. Disaster Response and Humanitarian Aid

Drones have demonstrated their immense value in humanitarian efforts and disaster relief operations [76,77]. Their ability to quickly assess damage, find survivors, and transport crucial supplies to locations difficult to reach has been evidenced in various emergency situations [78,79]. Throughout the COVID-19 crisis, drones were deployed in more than 18 nations to carry medical supplies and testing samples, underscoring their effectiveness in managing crises [80,81].

3.2.5. Entertainment and Media

The world of entertainment has adopted drones for aerial photography, allowing for the capture of distinctive viewpoints and vibrant visuals [82]. Their nimbleness and accuracy render them perfect for live performances, film production, and engaging media experiences [83].

3.3. Environmental Context and Operational Considerations

The operational environment significantly influences UAV swarm security strategies, with urban, rural, and military settings presenting distinct challenges [84]. Urban airspaces, characterized by dense wireless networks and strict privacy regulations, face risks such as GPS spoofing, WiFi hijacking, and data interception; these can be mitigated through blockchain-based attestation for decentralized trust, AI-driven intrusion detection, and strong encryption for privacy compliance [41,85,86]. In rural and remote areas, where connectivity is sparse and energy efficiency is critical, lightweight primitives like PUF-based authentication and optimized TRNGs enable secure key generation without persistent storage, reducing computational overhead [87,88,89]. Military and high-assurance contexts demand resilience against jamming, spoofing, and physical tampering, requiring tamper-resistant hardware, TPM-based secure boot and attestation, distance-bounding protocols for location verification, and integration with encrypted channels and anti-jamming techniques to ensure mission continuity under adversarial conditions [90,91,92].

3.4. Market Trends and Economic Outlook

The international drone market is witnessing swift expansion, propelled by technological advancements and growing business utilization [93]. As per [94], the commercial drone segment is anticipated to reach $51.32 billion by 2030, with a compound annual growth rate (CAGR) of 17.9%. Similarly, refs. [95,96] forecasts an increase in the overall UAV market from $26.12 billion in 2025 to $40.56 billion by 2030. National estimates, such as those from the Indian Ministry of Civil Aviation, predict the domestic drone sector will achieve INR 120–150 billion ($1.5–1.9 billion) by 2026 [97].

3.5. Technological Advancements and Future Directions

The incorporation of artificial intelligence (AI) and machine learning (ML) is further advancing drone functionalities [1,98]. Drones equipped with AI can independently traverse intricate environments, identify irregularities, and process extensive data in real time [99,100]. This evolution is exemplified in Figure 4, which illustrates a UAV mobile edge computing (MEC) network architecture where AI-enabled drones interact with ground users, collaborate with one another, and offload data to edge and cloud infrastructures. Such architectures highlight the growing role of distributed intelligence and real-time analytics in aerial networks [101].

These developments are paving the way for novel applications in infrastructure assessment, environmental surveillance, and smart city initiatives [102,103]. As the reliability of drone swarms and their mission coordination enhances, their usage is anticipated to broaden into more intricate areas, such as urban air transportation, synchronized delivery systems, and extensive agricultural monitoring [104,105]. For instance, in intelligent seaports, drones assist in reducing fuel usage and decreasing vessel navigation time, leading to significant cost reductions and enhanced sustainability [69]. Beyond the integration of AI and MEC, recent studies demonstrate the practical application of UAV technologies in advanced communication and security frameworks. For example, He et al. illustrates how aerial autonomous vehicles can enhance vehicular platooning in the Internet of Vehicles (IoV) enhanced by non-Orthogonal Multiple Access (NOMA) through optimized resource allocation and low-latency communication, highlighting the role of UAVs in intelligent transportation systems [106]. Similarly, Ahmed et al. explores the use of reconfigurable intelligent surfaces (RIS) to strengthen the security of the physical layer, offering promising directions for secure and energy-efficient UAV communication. These examples underscore the growing convergence of UAVs with next-generation wireless technologies and the need for hardware-based trust mechanisms to complement such innovations [107].

4. Communication Architectures

Communication strategies within drone swarms can be divided into autonomous and managed systems. Autonomous systems depend on local interactions among drones, reducing the necessity for centralized communication [108]. This decentralized model is beneficial in expansive or fluid environments with restricted connectivity [78]. In contrast, managed systems rely on a central unit where a leading drone directs commands to the swarm [109]. Although effective for orchestrated actions, this approach is susceptible to delays and interruptions, especially in large-scale operations [18]. Architectures of drone swarm networks are categorized into infrastructure-supported and FANET frameworks [110]. Figure 5 illustrates a hybrid architecture where clustered UAVs communicate via Bluetooth and relay data to a ground station using WiFi, exemplifying both infrastructure-supported and FANET characteristics [46].

As depicted in Figure 6, drones communicated with the ground station and satellites. Infrastructure-based systems rely on a central control unit for communication and task management, making them ideal for inspections and similar tasks [93,111]. However, their scalability is limited by the processing power and bandwidth of the central unit [21]. In contrast, FANETs discard the necessity for a central unit, allowing for direct communication between drones. In contrast, FANETs discard the necessity for a central unit, allowing for direct communication between drones.

This decentralized framework provides enhanced scalability and resilience, as the swarm can dynamically adapt to node failures [110]. Nonetheless, FANETs encounter notable obstacles, such as managing dynamic topologies, varying speeds, and three-dimensional movement, which complicate the design of protocols and network management [13]. Despite the advantages of scalability and resilience in FANETs, ensuring robust connectivity in challenging or dynamic environments remains a considerable hurdle (trust establishment) [108]. Drones are susceptible to failures, and their reliance on wireless communication makes the swarm vulnerable to security threats, such as packet loss attacks and weaknesses in routing protocols [21].

To tackle these challenges, simulation is crucial in the development and evaluation of drone communication systems [112]. Simulation environments offer a controlled space for designing and validating communication protocols, facilitating quick prototyping and minimizing the risk of errors in real-world applications [113,114]. These tools are vital for modeling network behavior, assessing fault tolerance, and optimizing routing methods prior to physical implementation [115,116,117]. Additionally, the incorporation of AI into drone technology has greatly improved swarm communication capabilities [103]. AI-driven autonomy enables drones to function more efficiently in dangerous or unpredictable situations, while real-time analysis enhances decision-making and coordination within the swarm [104,118]. AI also facilitates adaptive communication methods, such as dynamic routing and load balancing, which are essential in decentralized networks like FANETs [117]. However, the integration of AI brings forth new challenges, including substantial computational requirements and ethical issues surrounding autonomous decision-making [119].

4.1. Communication Protocols

Communication Protocols In drone swarm operations, secure and effective communication is crucial for coordination and resilience against cyber and physical threats [120]. The ever-changing characteristics of FANETs, marked by frequent topology alterations and limited communication range, pose unique challenges [30]. Considering the energy limitations of UAVs—balancing wireless communication, data processing, and flight control—energy-efficient algorithms are essential. For instance, the Resilient UAV Path Optimization Algorithm (RUPOA) reduces energy usage by optimizing communication distances [38]. To facilitate these operations, various communication protocols have been established. Figure 7 presents a secure communication protocol for drone swarm operations, highlighting the interactions among the Certificate Authority (CA), Ground Control Station (GCS), user, master drone, and other drones. It shows how certificates, keys, and mission credentials are exchanged over secure and insecure channels to ensure authentication and mission integrity [90].

Among the most widely utilized are message queuing telemetry transport (MQTT), constrained application protocol (CoAP), and long range wide area network (LoRaWAN), each presenting specific advantages and drawbacks [100]. For example, the Reputation-based Announcement (RA) scheme improves message reliability but lacks encryption and adaptability [36]. Conversely, the ASMTP improves confidentiality and prevents replay attacks, though it faces scalability and latency challenges [48]. These developments underscore the need for continued innovation in communication protocols that balance security, efficiency, and scalability in UAV swarm environments.

4.1.1. Performance Evaluation of Communication Algorithms

As part of the assessment of communication protocols for UAV networks, execution time acts as a crucial performance metric, especially in latency-sensitive environments where quick reactions are vital [121]. In swarm-based UAV systems, where real-time coordination and data sharing are essential, the computational efficiency of security and communication algorithms greatly affects operational effectiveness [45]. Recent comparative analyses have examined the execution times of various algorithms utilized in UAV networks. Among these, the radio-frequency identification (RFID) with PUF method displayed the highest latency, with execution times nearing 16,000 microseconds [122]. While this technique provides strong security through hardware-based authentication, its considerable computational demands raise concerns regarding its practicality in resource-limited or time-sensitive situations [74]. To provide additional context, these execution times were derived from benchmark studies using embedded platforms such as Raspberry Pi 4 (1.5 GHz CPU, 4 GB RAM) and simulated environments (MATLAB 2018a Simulink and NS-3) for protocols like ASMTP, RFID + PUF, and blockchain-based schemes. The reported values represent average execution times under standard cryptographic libraries and default parameter settings as documented in [122,123,124]. This clarification ensures transparency regarding the experimental conditions and supports the validity of the performance metrics presented. In contrast to the high-latency RFID with PUF, algorithms such as Salsa, ASMTP, and derived blockchain (DB) showed significantly reduced execution times [33,48]. Their lightweight characteristics and quick processing make them ideal for embedded systems and internet of things (IoT) driven UAV applications, where energy efficiency and real-time reactivity are crucial [102]. These algorithms manage to achieve a favorable balance between security and performance, making them suitable for swarm coordination and dynamic data interchange. Other methods, including identity and aggregate signature (IAS), drone-to-drone (D2D) PUF, grouped authentication (GA), bio-inspired optimized leader election (BOLD), RUPOA, hyperelliptic curve cryptography (HECC) and random oracle model (ROM), and MECC, fall into a moderate execution time range [35,38,87,123,124,125,126]. These approaches may serve as effective alternatives for general UAV applications, providing a compromise between computational efficiency and cryptographic strength. For example, RUPOA incorporates routing optimization, while D2D PUF combines device-level authentication with moderate latency. As illustrated in Figure 8, the comparative execution times highlight the necessity of choosing algorithms not solely based on their security capabilities but also on their computational efficiency. In UAV swarm networks, where timing, energy, and processing limitations are crucial, this dual focus ensures that communication protocols are both secure and operationally feasible [10]. These insights guide protocol selection in UAV swarm design, where the need for mission-critical responsiveness must be balanced with secure communication.

4.1.2. Authentication and Security Mechanism

As UAV networks continue to grow in complexity and scale, the demand for robust, lightweight, and scalable authentication protocols becomes increasingly important [87]. These protocols safeguard communication between drones and ground stations while facilitating autonomous coordination in swarm- and edge-based scenarios [84]. A variety of authentication methods have been suggested, many of which utilize lightweight cryptographic approaches such as Elliptic Curve Cryptography (ECC) and PUFs [127,128]. These methods are particularly apt for drones with limited computational and energy capabilities, allowing for mutual authentication, session key generation, and data confidentiality with minimal overhead [129]. Blockchain-based systems have also been proposed to provide decentralized trust and integrity in IoD ecosystems, although they may introduce latency and scalability issues as drone density increases [130].

Certain protocols are designed specifically for situations involving post-disaster recovery or compromised infrastructure [93]. Proxy delegation methods enable drones to verify one another within mesh networks without needing centralized oversight, while collective authentication techniques allocate roles (such as guard, network, and operational units) to facilitate scalable, role-based access control [87,131]. Recent protocols in drone detection leveraging RF signal analysis and ML report authentication times in the microsecond range and exhibit high detection accuracy [32]. Despite these promising performance metrics, many approaches have been validated solely through simulations or rely on static parameter configurations, which significantly limit their applicability in dynamic, real-world environments [132,133]. Furthermore, several protocols lack comprehensive threat modeling, leaving critical vulnerabilities unaddressed [114]. Others fail to account for energy consumption and communication overhead, particularly in large-scale or resource-constrained deployments, thereby raising concerns about scalability and operational efficiency [134].

Recent developments feature fog/edge-based mutual authentication protocols that do away with the necessity for ground station involvement. These systems provide efficient key management and automatic key revocation, though they might create single points of failure [135]. An overview of a UAV network architecture emphasizing authentication and security mechanisms, including the role of a Registration Authority (RA), Ground Station Servers (GSS), and UAVs, as well as the handover process for maintaining secure connectivity during mobility is provided in Figure 9 [26].

Another significant protocol [135], the Lightweight Trustworthy Message Exchange (LTME), facilitates secure communication between drones with minimal overhead and robust resistance to impersonation and replay attacks. However, its simplified version (sLTME) does not include encryption, rendering it susceptible to eavesdropping [36]. Overall, the field of UAV authentication protocols showcases a tension between advancement and ongoing challenges [136]. Future studies should aim at merging these protocols into cohesive, adaptive frameworks that cater to various UAV applications while upholding high standards of security, efficiency, and scalability [90,137].

Table 1. Record of surveyed papers based on authentication protocols.

Ref.	Approach	Solutions	Limitations	Performance
[34]	Sparse autoencoder + micro-Doppler	5G-based auth in urban setting	Needs LoS & training; costly	99% precision
[33]	Esalsa encryption for military ops	High error sensitivity results	Not integrated; pre-set params	1.0 ms cipher time
[124]	ECC in WSN with UAV sinks	Mutual auth & key agreement	Informal security analysis	Low energy & bandwidth use
[80]	Proxy signature delegation	Post-disaster mesh auth	Unclear threats & timing	Reduced auth time
[122]	RFID + PUF for military auth	Resists MITM & eavesdropping	High exec time	14.58 ms (server), 1.48 ms (UAV)
[35]	ID & aggregate signature (CDHP)	Fast & secure framework	Informal task synergy eval	Enc/Dec: 194/167 ms; Key: 40/35 ms
[123]	PUF-based inter-drone auth	Lightweight & attack-resilient	Single CRP; SRAM variation	340 $\mathsf{\mu }$s auth time
[22]	ID-based auth in HetNets	Confidential & trusted network	Energy use not addressed	Robust & secure
[87]	Grouped auth for new drones	Scalable drone classification	Threshold limits apply	1.2 ms auth; 10 ms data share
[24]	Blockchain for edge IoD	Lightweight & secure ops	Simulated; delay with scale	Low cost & overhead
[125]	Bio-inspired leader election	Efficient cluster formation	No freq/security analysis	Effective multi-drone comms
[138]	LTE-based control system	Real-time GPS & data link	Limited aerial coverage	20 dBm signal; 94 ms latency
[126]	HECC signcryption with ROM	Low cost & privacy-preserving	Threat robustness unclear	3.36 comp cost; 1184-bit comm
[134]	FL-based swarm offloading	Real-time field detection	No collision coordination	0.26–0.28 ms latency; 92–98% fairness
[32]	RF + ML for swarm detection	Unsupervised drone ID	External data; unclear countermeasures	95% accuracy (AWGN)
[27]	Mutual auth between fog and edge drones	Key revocation post-mission	Fog drone is single point of failure	14–20× faster than PKI; may degrade with scale
[36]	Lightweight drone-to-drone comm	Trust-based secure messaging	sLTME lacks encryption; trust mgmt complexity	Low overhead; robust but vulnerable to advanced attacks

outlines a selection of recent authentication and security protocols for UAV networks, emphasizing their fundamental approaches, advantages, drawbacks, and performance metrics.

5. Cybersecurity in UAV Communication Systems

UAVs are being increasingly utilized in critical mission applications, making them appealing targets for cyber threats [139]. The cybersecurity landscape for UAVs includes both hardware and software vulnerabilities that can be exploited remotely or physically, as shown in

Table 2. Taxonomy classification of Drone attacks with impacts and their execution tools and mechanisms. Z1: Drones, Z2: Communication Networks, Z3: Base Stations, Z4: Ground Control Stations, and Z5: Certification Authorities, Production and Manufacturing Units, and other involved devices [141].

Drone Attacks	Tools/Mechanisms	Impact	Security Requirements	Attack Surfaces
Traffic Analysis and Network Stalking	SNMP, Packet sniffer, NetFlow	Privacy	Anti-spyware and packet filters	Z2
Interception	Drone Monitoring Equipment, Acoustic Sensors	Privacy	Encryption technique	Z1, Z2, Z3, Z4
Data Capturing and Forensics	Using serial connection, ExtractDJI, Datcon, Prodiscover Basic	Privacy	Encryption technique	Z1, Z2, Z3, Z4
Location Tracing	Drone Monitoring Equipment, Acoustic Sensors, Radar	Integrity	Utilize counter-drone techniques	Z1, Z2
Data/Information Leakage	Substitution and alteration, Modification, Duplication	Integrity	Secure channel switching and encrypted data	Z1, Z2, Z3, Z4, Z5
ACL Modifications	Dronesploit, hacking tools	Integrity	Validate user-controllable input	Z1
Man-In-Middle Attacks	WiFi attack, Remote-AT-Commands, WiFi Pineapple Nano, Raspberry Pi 3, Maldrone, SkyJack	Integrity	Trusted CA-signed public key, encrypted link, mutual authentication, secure key exchange	Z2, Z3
Message Forgery	Dronesploit Remote-AT-Commands	Integrity	Secure channel switching and encrypted data	Z1, Z5
Identity Spoofing and Key Exploitations	Side-channel attacks, weak configuration, vulnerability exploitations	Confidentiality	Robust protocols with strong authentication	Z1, Z2, Z3, Z4, Z5
Unauthorized Access Controls	Drone Monitoring Equipment, Dronesploit, hacking tools, WiFi attack	Confidentiality	Strong passwords	Z1, Z2, Z3, Z4, Z5
Replay Attacks	Protocol manipulation	Confidentiality	Robust protocols, strong authentication, fresh message requests	Z2

[140,141].

5.1. Cybersecurity Threat Landscape in UAV Systems: Infographic-Based Analysis

5.1.1. Data Interception and Malware Injection

UAVs are becoming more susceptible to a variety of cyber threats due to their dependence on unsecured or poorly encrypted communication channels [142]. These vulnerabilities expose them to risks such as eavesdropping, packet manipulation, and malware injection through compromised control pathways, potentially corrupting mission data or hijacking drone operations [29,140,143]. Such threats are especially severe in reconnaissance and delivery missions, where data confidentiality and integrity are crucial [43,90]. As depicted in Figure 10, these threats range from data interception to physical interference, posing substantial risks to operational integrity and safety [144].

5.1.2. Drone Hijacking and Control Tampering

Beyond data interception, inadequate authentication protocols and open command channels render UAVs vulnerable to hijacking [148]. Attackers can exploit these flaws to take control of drones, redirect missions, or intentionally cause crashes [145]. Recent incidents, such as the 2022 breach involving an East Coast financial services firm in the US, illustrate how WiFi deauthentication and credential spoofing techniques can be exploited to bypass firmware-level protections and gain unauthorized access to sensitive corporate information [149,150].

5.1.3. GPS Spoofing and Jamming

Navigation systems are also at risk [151]. GPS spoofing and RF jamming represent some of the most disruptive threats to UAV operations [145]. Using low-cost software-defined radios (SDRs) such as HackRF One, attackers can mimic false global navigation satellite system (GNSS) signals, misleading drones to incorrect locations [147]. “A 2023–2024 investigation by Stanford University documented extensive GNSS spoofing activity in regions such as Smolensk and the Black Sea. The study observed multiple aircraft exhibiting anomalous flight behavior, including circular hold patterns and misdirected routes, attributed to spoof navigation signals, underscoring the operational viability of spoofing in uncontrolled environments” [152]. Meanwhile, RF jamming saturates communication frequencies, leading to loss of control or mission failure [114]. Figure 11 depicts a structured representation of spoofing attacks, outlining their operational mechanisms, targeted components.

5.1.4. Firmware Level Manipulation and Physical Tampering

In the hardware stage, alterations to the firmware and physical interference introduce additional risks [154]. Techniques such as laser fault injection (LFI) enable attackers to bypass secure boot processes and cryptographic validations [155]. Tools such as RayV Lite can create temporary faults in microcontrollers, jeopardizing the integrity of drones during operation. Wired Magazine (2024) noted that more than 75% attempts to circumvent embedded controller defenses using local file inclusion (LFI) were successful, highlighting the dangers of non-invasive physical breaches [156].

5.2. Intrusion Detection Systems (IDS) and Firewalls

Given the limited computational and energy resources of UAV platforms, cybersecurity solutions must be lightweight and efficient. Various approaches have been proposed to address these constraints, including the deployment of IDS, lightweight firewalls, and streamlined cryptographic protocols [154]. As summarized in [30], these methods aim to provide adequate protection without significantly impacting flight time or processing capacity. Furthermore, energy-aware security designs, such as those proposed by Manikandan [38], are essential to maintain erational longevity when security mechanisms introduce computational overhead. One fundamental approach to improving UAV security involves the monitoring of (RF) signals exchanged between drones and Ground Control Stations [32]. These signals can be analyzed for intrusion detection and anomaly recognition, offering a non-invasive method to identify malicious activity [25]. Despite the development of encryption schemes, authentication protocols, and secure communication frameworks, their integration into real-world UAV operations remains inconsistent and often unverified [86].

5.3. Encryption and Authentication Techniques

A major issue in drone communications is safeguarding the confidentiality of transmitted information [86]. Conventional encryption techniques are often unsuitable due to the limited computational power of drones, prompting a preference for lightweight cryptographic methods [15]. ASMTP, which delivers end-to-end encryption and token-based authentication, presents a secure option, yet it depends on trusted servers, creating the risk of a single point of vulnerability [48]. Figure 12 shows a communication workflow for UAV-based IoT systems, where plaintext data is encrypted using a public key before transmission to the cloud. Homomorphic computation enables processing on encrypted data without decryption, and results are returned in encrypted form for local decryption using a private key. This approach enhances confidentiality while supporting advanced analytics in resource-constrained drone environments [157].

To reduce unauthorized access, identity-based authentication approaches are gaining popularity, ensuring that only authenticated users can gain network access and thwarting unauthorized interference with communications [22]. Besides secure communication, data sharing and access control are vital components of the IoD, especially for sensitive applications, where it is crucial to facilitate authorized data sharing while preserving privacy [43]. To further enhance security, the Single-Use Token Methodology has been introduced, providing dynamic token generation for each transmission. This mechanism helps thwart replay attacks and guarantees confidentiality [48].

5.4. Blockchain and Lightweight Cryptography

Blockchain technology has surfaced as a promising approach to strengthening the security and reliability of UAV systems, particularly in infrastructure evaluation and healthcare logistics. Figure 13 demonstrates a blockchain-enabled UAV architecture that combines decentralized ledger technology with UAV control and cloud services. This design ensures secure registration, encrypted communication, and immutable data storage, while enabling auditing and path navigation through blockchain-based verification [158].

Its decentralized and immutable characteristics ensure that recorded information cannot be modified without consensus from the network, thus bolstering data integrity and operational trust [143,159]. The cryptographic linking of transaction logs in blockchain enhances transparency across UAV communication networks. When paired with high-speed technologies like 5G, blockchain facilitates secure, low-latency data transmission—essential for real-time tasks such as inspections and emergency responses [20,133]. However, blockchain adoption in UAV systems presents challenges. As the number of transactions increases, the ledger expands, resulting in higher storage demands and slower processing speeds, which can hinder real-time decision-making in drone swarms [47]. Additionally, consensus mechanisms such as Proof of Work (PoW) impose significant energy costs, making them unsuitable for battery-constrained UAVs [160]. Alternatives, such as Proof of Stake (PoS) and Directed Acyclic Graph (DAG)-based models, offer more energy-efficient options. While blockchain enhances data integrity, it does not inherently protect privacy [161]. Public blockchains may expose sensitive information unless supplemented with privacy-preserving technologies such as zero-knowledge proofs. Moreover, vulnerabilities like 51% attacks remain a concern, especially in small-scale deployments [24].

5.5. Privacy Concerns in Data Collection

Beyond cybersecurity, privacy has emerged as a critical concern in UAV-assisted operations [162]. The use of high-resolution cameras and advanced sensors enables precise data acquisition, but also raises ethical and legal questions regarding the inadvertent capture of personally identifiable or sensitive information [163]. Studies have emphasized the importance of adhering to local data protection regulations and establishing transparent guidelines for data collection, processing, and sharing to maintain public trust and ensure legal compliance [41,43]. The integration of automation and intelligent workflows in UAV operations has led to significant efficiency gains, particularly in applications such as environmental monitoring and infrastructure inspection [42,69]. However, these advancements also introduce new complexities related to data storage, processing, and regulatory oversight. As UAV systems become more autonomous, ensuring secure and responsible data handling becomes increasingly critical [164].

5.6. Limitations of Traditional Security Mechanisms

Software-based anomaly detection and cryptographic safeguards often fail under adversarial conditions [22]. Sybil attacks, where multiple fake identities are injected into a swarm network, can destabilize consensus and authentication protocols [165]. Studies show that injecting Sybil nodes can overwhelm identity-based systems, leading to communication breakdowns and mission failure [166]. UAVs are vulnerable to a wide range of cyber threats, including GPS spoofing, replay attacks, and denial of service intrusions [142,145]. These risks are amplified in swarm-based models, where the attack surface expands and the potential for rogue drone infiltration increases [114]. While software-based defenses—such as anomaly detection and lightweight encryption—offer some protection, they often prove inadequate in disconnected or adversarial environments [22]. This has led to a growing interest in hardware-assisted security solutions, which offer more robust protection against sophisticated attacks [167].

5.7. Emerging Technologies for Secure UAV Networks

To address these vulnerabilities, modern UAV systems are increasingly adopting hardware-rooted security solutions [168]. PUFs and TPMs provide device-specific cryptographic identities and secure attestation [168,169]. PUFs leverage manufacturing variations to generate unique fingerprints without storing keys [123]. Figure 14 summarizes the diverse applications of field programmable gate array (FPGA) based PUFs in UAV security, including IP protection, key sharing, authentication, and random number generation, which collectively enhance hardware-rooted trust in resource-constrained environments [170].

While TPMs enable secure boot and integrity verification before swarm coordination. These mechanisms offer resilience against spoofing, tampering, and identity manipulation [171]. Federated learning offers a privacy-preserving approach to UAV data processing by enabling drones to share model updates rather than raw data. This reduces data exposure while optimizing energy efficiency and maintaining learning performance across distributed networks [134]. Efficient resource management is essential for maintaining data integrity and operational continuity in UAV-assisted networks. Factors such as energy consumption, trajectory planning, and channel modeling directly influence a drone’s ability to securely transmit and process data [38]. Optimized resource allocation ensures that computational tasks are assigned to drones with sufficient processing power and battery capacity, minimizing service disruptions and data loss [172]. Advancements in digital twin (DT) technology—such as the TwinPort architecture—have further enhanced real-time monitoring and predictive maintenance, improving both security and operational efficiency in smart infrastructure networks [69].

5.8. Swarm Coordination and Optimization Algorithms

Optimizing drone swarm coordination is critical to preventing collisions and ensuring efficient communication. Optimization algorithms such as Genetic Algorithm (GA) and Particle Swarm Optimization (PSO) are used to identify and protect critical nodes within the swarm’s communication topology [30,115]. These algorithms enable effective coordination by optimizing node selection, ensuring that drones can operate without significant interference or risk of disruption [78,125]. Figure 15 represents a hierarchical swarm coordination model, where drones are organized into unit swarms, sub-cluster swarms, and cluster swarms. This structure supports optimization algorithms such as GA and PSO by reducing complexity and improving scalability in large UAV networks [173].

Additionally, managing data transmission and controlling response latencies is vital for avoiding collisions, as delays can undermine the effectiveness of collision avoidance strategies [159].

5.9. Case Studies and Real-World Incidents

Incidents from the real world offer concrete proof of the vulnerabilities covered in this section [174]. These examples show how UAV systems are vulnerable to a variety of threats, ranging from coordinated swarm invasions and armed payloads to passive surveillance and infrastructure overflights [29]. By looking at these incidents, we may learn more about how cyber risks affect operations and why proactive, multi-layered security measures are essential [45].

Table 3. Documented drone security incidents.

Incident/Source	Description	Attack Mode	Reference
Naval Swarm Overflights (2019)	Coordinated drones circled U.S. naval ships.	Unauthorized presence	[175]
Sofia, Bulgaria (2025)	Air traffic was halted due to an unauthorized drone, leading to delays and an emergency declaration	Disruption	[176]
Langley & UK Airbase Swarm (2023)	Multi-drone incursion into military airspace with unknown controllers	Coordinated swarm intrusion	[175]
Nashville Substation Plot (2024)	Man arrested for planning drone attack with C-4 explosives on power infrastructure	Weaponized payload threat	[177]
Pinyon Plain Uranium Mine (2025)	Drone crashed into safety wires, disrupting operations and leading to arrest	Industrial disruption	[178]

documents the security events involving UAVs below, with an emphasis on the various attack methods and operational weaknesses.

Due to these instances, UAV systems must have strong cybersecurity frameworks in place [99,100]. The range of assault options, from active hijacking demonstrations to passive intrusions over vital infrastructure, highlights the complex nature of UAV vulnerabilities [25]. These real-world examples support the need for hardware, software and regulatory protections in integrated security solutions [177]. The move from software-only defenses to integrated hardware–software security frameworks is required due to the changing threat landscape [166]. Strong defense against identity-based attacks, spoofing, and tampering is provided by hardware security primitives such as PUFs and TPMs [167,169]. In order to further improve UAV resistance in hostile situations, future research should investigate AI-driven threat detection, quantum-resistant cryptography, and decentralized trust models [179].

6. Hardware Security Primitives

In secure drone swarm operations, hardware security primitives are essential to establish trust, verify identities, and protect against physical and cyber threats [180,181].

6.1. Layered Architecture and Embedded Security

Layered Architecture and Embedded Security, Figure 16 presents a multi-layered framework for secure drone collaboration, where the Security Layer integrates essential hardware-based elements like PUFs, TPMs and Distance-Bounding Protocols [19,182,183]. These components facilitate strong authentication and secure communication by utilizing the unique physical characteristics of the devices and their tamper-proof modules [16]. Furthermore, the incorporation of blockchain technology improves decentralized trust and ensures data integrity throughout the swarm [184]. Situated below the Communication Layer, which encompasses both infrastructure networks and FANETs, these security measures guarantee that communication protocols remain not only efficient but also resistant to spoofing, relay attacks, and unauthorized access [123]. This layered strategy highlights the vital importance of hardware security in enabling scalable and reliable drone swarm operations.

6.2. Core Technologies and Their Roles

HSPs offer tamper-proof security through on-chip features such as PUFs, RNGs, TPMs, and secure enclaves [183]. PUFs are particularly appealing because of their low energy usage and distinctive, nonreplicable response traits [127]. As shown in Figure 17, PUF-based authentication operates on a challenge–response mechanism. A verifier issues a challenge to the device, which uses its intrinsic PUF to generate a unique response. This response is then compared against pre-stored values in a secure database to confirm authenticity, ensuring lightweight and tamper-resistant verification [185].

They are increasingly incorporated into blockchain systems to facilitate decentralized identity and licensing structures [184]. TPMs continue to be crucial for secure boot and remote attestation, especially in military-grade UAVs [183]. Secure enclaves, such as ARM TrustZone, provide isolated execution environments, albeit with increased cost and complexity [186]. New designs embed PUFs into RISC-V SoCs to enable low-power hardware-level security and to further elucidate the differences and applications of these primitives [182,187,188]. Figure 18 provides a simplified illustration of the components of hardware security primitives, offering a visual framework to support the classification and understanding of foundational techniques.

Table 4. Condensed summary of hardware security primitives with key metrics.

Refs.	Primitive	Summary	Key Metrics
[51,167,185,189]	PUFs	Microscopic manufacturing variations, key-less device identities at very low cost. Environmental drift and modeling attacks limit reliability. Underpin IoT authentication and secure boot.	Entropy: 0.89–0.98; BER: 5–15%; Modeling Resistance: Medium
[19,53,54]	TRNGs	High-entropy randomness for cryptographic protocols. Require post-processing, sensitive to environmental conditions. Underpin TLS/SSL session-key negotiation.	Entropy: ≈1.0; NIST SP800-22: Pass; Throughput: 10–100 Mbps
[190,191,192]	Logic Locking & Obfuscation	Protects IP from reverse engineering and overproduction. Area/power overhead, vulnerable to SAT- and side-channel attacks.	Area: 5–15%; Power: 8–12%; SAT Attack: >106 s
[193,194,195,196,197]	Tamper-Resistant Hardware	Detect/respond to physical attacks to safeguard assets. Expensive, high-assurance systems. Smartcards, HSMs use conductive meshes.	FIPS 140-3 Level 3–4; Cost: High
[189,198,199]	Emerging Primitives	Novel entropy sources at ultra-low power. Integration challenges, limited standardization. Target next-gen IoT security.	Power: <10 $\mathsf{\mu }$W; Entropy: 0.95; Standardization: Low

outlines their benefits, drawbacks, real-world applications, and recent research advancements.

6.3. Comparative Assessment of HSP-Based Security Techniques

A comparative study indicates that PUF-based approaches strike the optimal balance between energy efficiency and security, making them particularly suitable for environments with limited resources [26]. Although blockchain systems ensure robust integrity, they do so at the expense of increased latency and power consumption [20]. TPMs and distance-bounding protocols are preferred in scenarios requiring high assurance or when facing adversarial conditions [52].

6.3.1. Quantitative Comparison

Quantitative Comparison,

Table 5. Quantitative comparison of security techniques.

Technique	Energy (mL/op)	Latency (ms)	Tamper Resistance	References
ECC	∼15.6	∼8–10	No	[116,121]
SRAM/DRAM PUF	∼0.2	∼1–100	Yes	[200,201,202]
TPM (ECC)	∼15.6	∼8–20	Yes	[194]
Blockchain	≥200	≥1000	Partial (Auditable)	[160,203]

provides a summary of the energy usage, latency, and tamper resistance for each method, supported by evidence from benchmark studies.

The values are approximate estimates derived from experimental and survey literature. On embedded devices, ECC typically uses tens of millijoules per scalar multiplication, with execution times ranging from 8 to 15 ms for optimized implementations [116,121]. SRAM and DRAM PUFs exhibit very low energy consumption (<1 mJ) and latency, from microseconds for SRAM PUFs to approximately 88 ms for DRAM-latency PUFs, with strong inherent tamper resistance [200,201,202]. TPMs that implement ECC incur similar computational costs to standalone ECC but add hardware-based tamper resistance and wake-up energy overhead [52,194]. Blockchain-based mechanisms, particularly PoW and distributed consensus, demand significantly higher energy (≥200 mJ) and latency (≥1 s) per confirmed transaction, providing auditable integrity rather than complete tamper-proofing [160,203].

6.3.2. Radar Chart Analysis

A radar chart comparing five well-known UAV security techniques—ECC, PUFs, TPMs, Blockchain integrated with HSPs, and distance bounding using Ultra-Wideband (UWB)—across five important criteria—scalability, latency, deployment readiness, hardware cost, and energy efficiency—is presented in Figure 19 to summarize the comparative insights covered in this section.

The chart illustrates the trade-offs inherent in each approach. PUFs demonstrate strong performance in latency, scalability, and cost-effectiveness, making them ideal for lightweight UAV deployments [204]. Blockchain + HSP systems offer decentralized control and auditability but are constrained by high latency and energy demands, limiting their suitability for real-time or energy-sensitive missions [19,49]. TPMs and distance bounding protocols provide robust tamper resistance and proximity assurance, making them well-suited for high-assurance or military-grade operations, albeit with increased hardware complexity [183,196]. ECC, meanwhile, offers a balanced profile across all dimensions, making it a versatile choice for general-purpose swarm cryptography [205]. This visual comparison underscores the importance of context-aware selection of security primitives. No single technique excels across all metrics, and deployment decisions should be guided by mission requirements, operational constraints, and threat models. From an operational feasibility standpoint, emerging methods such as AI-driven PUFs and blockchain-based attestation offer significant advantages over traditional security mechanisms but introduce unique operational considerations [47,204]. AI-augmented PUFs enhance reliability under environmental variations and aging, reducing error rates and improving entropy stability compared to conventional PUFs [206]. However, they require additional computational resources for model training and inference, which may impact energy budgets in UAV swarms [160]. Similarly, blockchain-based attestation provides decentralized trust and immutable audit trails, addressing single points of failure inherent in traditional PKI systems [143]. Yet, its feasibility in UAV environments is constrained by high latency, bandwidth consumption, and consensus overhead, particularly in large swarms [199]. In contrast, traditional mechanisms such as ECC and TPMs are well-understood, lightweight, and easier to certify but lack adaptability and scalability for dynamic, distributed UAV networks [128]. Therefore, while emerging approaches promise stronger resilience and transparency, their deployment must balance energy efficiency, latency, and interoperability to ensure operational feasibility in real-world UAV scenarios [52].

6.3.3. Why Hardware Is the New Frontier in UAV Swarm Security?

Traditional cybersecurity approaches, such as cryptographic protocols and anomaly detection systems, have been proven to be insufficient in adversarial environments where UAV swarms operate. These software-based methods often lack the resilience needed to counter physical and protocol-level attacks that exploit the inherent vulnerabilities of wireless and distributed systems [183]. For example, low-cost GPS spoofing using (SDRs) such as the HackRF One (priced under $300) has successfully manipulated UAV coordinates in more than 90% of test scenarios, allowing attackers to redirect or force land drones [207]. Similarly, laser fault injection tools such as the RayV Lite (available for less than $500) have demonstrated the ability to bypass firmware integrity checks mid-flight, compromising drone behavior in real time [156]. At the network level, Sybil attacks have overwhelmed swarm coordination protocols by injecting dozens of fake drone identities, effectively paralyzing swarm operations unless mitigated by hardware-based identity verification [129]. These examples underscore the limitations of relying solely on software defenses. In contrast, the hardware roots of trust, including PUFs, TPMs, and secure enclaves, anchor security in the physical properties of the device [195,196]. These primitives offer tamper resistance, device-specific authentication, and secure attestation, which makes them suitable for the constrained and high-risk environments in which UAV swarms operate [168,181]. Moreover, these hardware-level protections are not merely theoretical [19]. Recent research has emphasized the importance of modular subsystem-based architectures that integrate such primitives into broader security frameworks. For instance, a multi-layered defense system developed using MATLAB Simulink demonstrated the effectiveness of integrating hardware-level protections with real-time threat detection and response mechanisms [208]. By embedding security at the hardware level, these mechanisms provide a foundational layer of trust that is difficult to replicate or subvert, even under sophisticated attack scenarios. As such, they represent a critical change in the design of secure UAV systems, allowing more robust protection for both drones and the sensitive data they collect [17,180,182].

6.4. Hardware–Software Trade-Offs and Hybrid Architectures for UAV Swarms

Although HSPs such as TPMs and PUFs provide strong physical roots of trust, their integration with software-based mechanisms is essential for comprehensive UAV swarm security [19]. Hardware solutions offer tamper resistance and unclonable identities, making them highly resilient to physical attacks [168]. However, they introduce cost, weight, and design complexity, and are difficult to update once deployed [181]. Conversely, software-based approaches—such as ECC, blockchain, and federated learning—are flexible, easily upgradable, and cost-effective, but they impose higher computational and energy overhead on resource-constrained UAVs and remain vulnerable to malware and key extraction attacks [128,134,184]. For UAV swarms, these trade-offs are critical: hardware ensures robust identity and secure boot, while software enables adaptive cryptographic agility and distributed trust [183,209]. A hybrid approach that combines hardware anchors such as (PUF-derived keys) with lightweight or post-quantum cryptography and AI-driven trust scoring offers the best balance between security strength, scalability, and operational efficiency [204]. This integration mitigates single-point weaknesses and aligns with emerging standards for quantum-safe and adaptive security in autonomous aerial systems [185].

6.5. Emerging Trends: AI-Augmented PUFs, Post-Quantum Primitives, and Hybrid Trust Anchors

Recent research leverages ML not only to attack PUFs, but also to enhance their reliability in dynamic environments. Neural network-assisted calibration and error recovery improve stability under voltage and temperature variations, reducing bit error rates without compromising uniqueness, while complementary techniques such as lightweight or reverse fuzzy extractors and multiple-reference enrollment further minimize error correction overheads—an essential property for UAVs operating under rapid environmental changes [210,211]. Conversely, increasingly sophisticated ML/DL modeling attacks against arbiter and composite PUF families (e.g., DNN-based modeling) have motivated adversarial defenses and NN-based challenge–response transformations to increase the complexity of successful attacks. For UAV swarms, where physical capture and CRP harvesting are realistic threats, ML-aided reliability combined with ML-aware anti-modeling countermeasures is becoming best practice [212,213]. Additionally, AI-driven trust scoring and anomaly prediction can be fused with PUF/TPM attestation to detect insider threats during swarm coordination [214]. In parallel, post-quantum cryptography (PQC) is transitioning from research to deployment to counter the “harvest now, decrypt later” threat and accommodate long UAV lifecycles. NIST finalized three PQC standards in August 2024—module lattice KEM (FIPS 203, CRYSTALS-Kyber), module lattice signatures (FIPS 204, CRYSTALS-Dilithium) and stateless hash-based signatures (FIPS 205, SPHINCS+), with a fourth (HQC) announced in 2025 [215,216,217]. While these primitives provide forward security and quantum resistance, their larger key and signature sizes compared to ECC impact bandwidth and energy in multi-hop swarm networks, prompting hybrid migration strategies and embedded-class optimizations [216]. A practical approach combines PUF-derived identities (for unclonable hardware roots) with PQC credentials (for quantum resilience), anchored by TPM or TEE where available, and couples these anchors with AI-driven trust scoring for continuous, behavior-aware admission control across UAV swarms. This layered architecture aligns with emerging UAV security roadmaps that emphasize adaptive, learning-enhanced defenses while meeting regulatory mandates for quantum-safe cryptography [214,215].

7. Verification, Licensing, and Regulation

In light of the vulnerabilities associated with satellite navigation, alternative strategies such as distance-bounding protocols [218] and delay-based decryption [219] are gaining prominence. These methods enforce location-aware regulations by tying chip functionality to physical presence. AI-enhanced environmental PUFs further bolster this approach by utilizing ambient information for implicit geo-verification [206]. Blockchain-integrated attestation processes support geofencing, licensing, and auditability, thereby reducing reliance on centralized authorities [161].

7.1. Verification

Considering the ongoing susceptibility of GPS-based navigation to spoofing and jamming, both academia and industry have begun to focus on hardware-rooted location verification and decentralized compliance mechanisms within UAV systems [17]. This transition reflects the necessity to enforce spatial limitations, licensing regulations, and operational accountability, especially for swarm drones involved in infrastructure inspection, urban logistics, or cross-border operations [85].

7.1.1. Distance-Bounding Protocols

DB protocols serve as mechanisms for verifying locations by estimating the maximum distance between a verifier and a prover through the analysis of round-trip signal delays [220]. These protocols are formulated to defend against relay (mafia fraud) and wormhole attacks, especially in environments lacking GPS or facing adversarial conditions [92]. DB protocols compatible with UAVs frequently utilize UWB and millimeter-wave (mmWave) technologies to attain precision within sub-meter accuracy [221]. Recent innovations have led to the development of Frequency-Modulated Continuous Wave (FMCW) implementations, which provide enhanced energy efficiency and accuracy for UAV-related applications [92]. Furthermore, multi-point DB protocols have been suggested to improve safety in the airspace and verify trajectories. A system has been introduced that integrates DB with Automatic Dependent Surveillance-Broadcast (ADS-B), capable of accurately identifying spoofed UAVs [222]. Their protocol underwent validation through ArduPilot SITL simulations, affirming its effectiveness for swarm coordination and collision avoidance [223]. Despite their strength, DB protocols encounter obstacles in real-world deployment, including the necessity for precise synchronization, specialized timing hardware, and susceptibility to environmental noise. These limitations hinder scalability in extensive UAV networks [222]. Ongoing studies are investigating low-power DB variations, RFID-based implementations, and alternatives that do not rely on timing to minimize hardware demands and enhance practicality in real-world applications [224].

7.1.2. Delay-Based Cryptographic Decryption

Delay-Based Cryptographic Decryption represents a burgeoning method that imposes geospatial constraints by restricting access to encrypted data or instructions based on latency profiles [225]. These profiles are pre-defined and align with certain physical locations, ensuring that UAVs can only carry out mission-critical operations within authorized areas [219]. This approach proves especially beneficial in environments where GPS is compromised, as traditional geofencing methods may not succeed. By working in conjunction with secure timer modules and Trusted Execution Environments (TEEs), delay-based decryption facilitates real-time enforcement of spatial regulations and mission logic [225]. Figure 20 provides an overview of the workflow for delay-based decryption, where a policy authority provisions latency profiles and a TEE enforces location verification through timing challenges before releasing mission keys [91].

Recent progress has introduced lightweight cryptographic algorithms such as ASCON-128a, which deliver robust security assurances with minimal computational demands, perfect for UAV platforms with limited resources [226]. Additionally, machine learning-based delay-aware detection systems have been proposed to dynamically modify decryption thresholds in response to UAV behavior and environmental factors [227]. These systems bolster resilience against spoofing, unauthorized access, and timing manipulation, particularly in swarm operations where decentralized control is essential [228]. While offering promise, delay-based decryption methods necessitate accurate latency calibration and thorough environmental modeling to guarantee reliability across various operational situations [229].

7.1.3. Environmental Physical Unclonable Functions (ePUFs)

Environmental Physical Unclonable Functions (ePUFs) are hardware security constructs that harness variations in the surrounding environment—such as light levels, temperature, magnetic fields, and barometric pressure—to create unique challenge–response pairs [206]. These responses act as implicit geolocation tokens, allowing UAVs to confirm their physical presence without depending on external signals [43]. Recent studies have shown that entropy sourced from environmental noise can yield device-location fingerprints that are resilient to replay and spoofing attempts [197]. For instance, Ref. [198] demonstrated that drones can learn and validate these fingerprints to establish geographic authenticity, enhancing location assurance in environments devoid of GPS. An important application is the PUFloc protocol, created by Nair and Thampi, which merges PUF characteristics with tiered location-based authentication. This protocol utilizes hash functions, XOR operations, and random number generators to facilitate lightweight and secure mutual authentication [230]. FPGA implementations of PUFloc have shown minimal power usage and strong resistance to cloning and interference. ePUFs hold significant importance in safeguarding privacy during location authentication, especially in sensitive or disputed areas [231]. Their combination with AI models enables adaptive learning of environmental signatures, thereby improving robustness and scalability in dynamic UAV operations [199].

7.1.4. Blockchain-Backed Geofencing and Licensing

Blockchain-Enhanced Geofencing and Licensing provides a decentralized structure for UAV mission oversight, licensing, and accountability [20]. By utilizing smart contracts on distributed ledgers, UAVs can independently verify flight permissions, operational regions, and device authenticity, decreasing dependency on centralized entities and increasing transparency [47]. Figure 21 illustrates the system architecture underpinning this approach. It shows how various nodes—Training Nodes, Mining Nodes, and hybrid Training and Mining Nodes—interact with MEC servers via a blockchain network. These nodes collaboratively manage model training and mining tasks, with MEC servers facilitating consensus and blockchain integrity. The use of model upload (solid black arrows) and download (red dashed arrows) pathways highlights the decentralized exchange of operational data, reinforcing the secure and transparent nature of UAV oversight [143].

Initiatives like those suggested by [199] combine blockchain technology with secure hardware anchors, such as PUF-derived device identities, facilitating trustless verification of mission legitimacy. Smart contracts can actively enforce geofencing rules, triggering alerts or disabling critical flight functions when UAVs stray from designated routes [143]. The Geofences in the Sky initiative expands this concept by merging blockchain with 5G technology, allowing for real-time UAV traffic management across centralized, decentralized, and hybrid modes of operation [184]. This capability enables the dynamic enforcement of no-fly zones and mission parameters, particularly in urban and cross-border settings [20]. Despite its potential, blockchain-based UAV systems encounter challenges related to latency, throughput, and energy usage, particularly in swarm operations and missions with time constraints [130]. Ongoing research into blockchain-supported UAV communication, zero-knowledge proofs, and lightweight consensus protocols seeks to overcome these challenges and enhance scalability [199].

7.2. Regulatory Frameworks for UAV Operations

The transition of drone uses from military to civilian applications has introduced regulatory challenges that must be addressed to fully realize the potential of drone technology [39]. Issues surrounding misuse, privacy violations, and military utilization highlight the necessity for robust regulations [232]. The variability of regulations across different countries significantly influences the acceptance and use of drone technology [233]. Accompanied by a comparative analysis of drone regulations in major regions, highlighting differences in registration processes, altitude restrictions, licensing categories, and limitations on autonomous operations [40]. While regulatory frameworks such as ICAO SARPs and national UAV laws aim to ensure safety and privacy, significant gaps remain. Current policies are fragmented and often lag behind technological progress, resulting in inconsistent altitude limits, BVLOS permissions, and certification standards across jurisdictions [234,235]. This lack of harmonization creates interoperability challenges for UAV swarms operating in multinational contexts. For example, variations in sense-and-avoid requirements, spectrum allocations, and data protection laws complicate cross-border missions and increase compliance costs [236]. Furthermore, the absence of mutual recognition agreements for UAV certifications and pilot credentials limits scalability for commercial and defense applications. Addressing these gaps requires coordinated international efforts to standardize operational protocols, enable secure data exchange, and align privacy regulations without stifling innovation [237].

Regulations typically encompass pilot licensing, drone registration, restricted operational areas, and insurance requirements, with distinctions based on the drone’s weight, population density, altitude, and intended applications [238]. For example, the UK’s Air Navigation Order requires human operators to maintain control of drones, limiting fully autonomous operations and restricting drone usage in areas such as underground locations or ventilation shafts without human oversight [39]. Similarly, the Federal Aviation Administration (FAA) in the US prioritizes aerospace safety but lacks guidelines on privacy, leaving a gap in addressing ethical and human rights issues [3]. Several countries are striving to harmonize regulations to promote global consistency [97,239]. The European Union has established categories for drone operations in Figure 22 as open, specific, and certified, each with customized licensing and training requirements [237]. International cooperation and shared best practices are critical to addressing the global nature of drone technology and its applications [40].

7.2.1. Privacy and Data Protection Laws

Privacy and data protection regulations govern the manner in which drones can gather, store, and disseminate information, particularly in public and residential settings [232]. Nonetheless, there are still regulatory shortcomings. For instance, while the FAA ensures airspace safety, it lacks thorough privacy regulations [240]. Laws tailored to specific purposes, such as those overseeing police drone operations in France and the U.S., seek to tackle these issues [240]. Research from [97] indicates that the implementation of Production-Linked Incentives (PLIs) has eased regulations and offered incentives to boost local drone manufacturing and economic development. However, concerns regarding safety and privacy continue to be significant, requiring ongoing adjustments to laws to keep pace with advancing technologies and emerging threats [241].

7.2.2. Airspace Management and Compliance

Drones are required to adhere to airspace regulations, which often involve registration and obtaining flight permits [242]. Regulatory structures usually outline operational areas, altitude restrictions, and conditions for Beyond Visual Line of Sight (BVLOS) operations. These regulations are vital for preventing conflicts with manned aircraft and ensuring a secure integration into national airspace systems [243].

7.2.3. Ethical Considerations in UAV Deployment

Ethical dilemmas encompass excessive surveillance, data exploitation, and the effects of drones on public confidence [243]. Ref. [239] described drones as “aerial technologies of domination,” where local communities experience vulnerabilities due to constant monitoring. Such actions erode sovereignty and perpetuate systemic disparities, particularly evident in African settings. This implies that the public’s view of drones, especially in areas where they have been employed for military operations, often entails psychological repercussions, resulting in resistance to their use in civilian applications [88]. Given this context, enhancing capabilities, fostering international collaboration, and educating the public are vital to achieving a balance between innovation and safety, as well as ethical considerations. By tackling these challenges and promoting cooperation, policymakers can ensure that drone technologies develop responsibly and fairly [40,88]. The regulation of UAV systems is a dynamic and complex field influenced by technological progress, public apprehensions, and geopolitical factors [174]. While numerous nations have progressed in outlining operational limits and licensing requirements, there are still deficiencies concerning privacy safeguards, ethical governance, and oversight of autonomous flights [237]. Real-world instances highlight the necessity of purpose-specific legislation and international collaboration [39]. To guarantee the responsible and fair use of drone technologies, ongoing regulatory adjustments, capability enhancement, and public involvement are crucial [40]. By aligning legal structures with emerging threats and societal expectations, policymakers can encourage safe, ethical, and scalable integration of UAVs [174].

7.2.4. Regulatory Integration and Compliance Frameworks

To implement emerging UAV technologies such as distance-bounding, delay-based decryption, and blockchain-supported licensing, regulators are investigating policy-aligned enforcement models. Organizations such as the European Union Aviation Safety Agency (EASA) and the FAA have shown interest in combining remote ID systems and licensing frameworks with secure location verification systems [7,242]. Suggested models encompass the following: Drones ID attestation certificates, location-specific token signing, and real-time revocation lists disseminated via 5G and FANET infrastructure. However, the lack of interoperable standards and inconsistent legal frameworks across jurisdictions remains a significant barrier to global adoption [238]. Harmonizing these approaches will be essential to enable scalable, secure, and internationally compliant UAV operations [97].

8. Deployment Challenges

While hardware security primitives (HSPs) offer promising solutions for securing UAV systems, their practical deployment across diverse operational environments introduces unique challenges [19]. Unlike controlled laboratory settings, real-world scenarios impose constraints related to mobility, connectivity, and environmental unpredictability [114,133]. Factors such as harsh weather conditions, dynamic threat landscapes, and resource limitations amplify the complexity of implementing secure and reliable UAV operations [244]. In addition, mission-specific requirements, ranging from stringent latency demands in military applications to resilience in disaster-stricken areas and compliance with regulatory frameworks in urban airspaces, necessitate context-aware security strategies [245].

8.1. Disaster Zones: Lightweight and Offline-Capable Security

In areas affected by disasters, UAVs frequently function without dependable communication networks or power supplies [246]. These limitations call for lightweight, offline-capable security solutions [81]. PUFs are especially apt for these situations due to their minimal power requirements and their capability to generate cryptographic keys as needed, without the necessity for secure storage [167]. PUFs facilitate secure identity verification and key distribution in the field, aiding autonomous UAV operations during search-and-rescue efforts, infrastructure evaluations, and emergency logistics [50]. Figure 23 presents the PUF-based enrollment process, which enables secure identity verification and key distribution by leveraging unique device-specific responses to challenges. This approach supports autonomous UAV operations in critical missions [185].

Nevertheless, PUFs can be influenced by environmental changes, and their entropy might diminish over time [230]. Other strategies, such as pre-shared keys or QR-code based authentication, have been utilized in certain deployments, but they do not offer the dynamic and tamper-resistant characteristics of PUFs [219,224]. Additional research is essential to enhance the stability and dependability of PUFs in extreme environmental conditions and to create hybrid systems that merge PUFs with lightweight cryptographic protocols for improved resilience [185].

8.2. Military Deployments: Tamper Resistance and Cryptographic Robustness

Military UAVs function in high-risk environments where adversaries might try to intercept, spoof, or physically compromise devices [90]. In these settings, tamper-resistant hardware and strong cryptographic components are crucial [195]. TPMs and secure elements are routinely employed to safeguard sensitive information and cryptographic keys [196]. Furthermore, distance-bounding protocols are utilized to confirm the proximity of control stations, reducing risks of relay and spoofing attacks [92]. Recent studies have investigated the incorporation of PUF-based distance bounding to bolster defenses against fraud and man-in-the-middle attacks [206]. However, these protocols typically require precise timing hardware and strict synchronization, which can be challenging to implement across extensive UAV swarms [92]. Alternative strategies like frequency hopping and spread-spectrum communication provide some defense against jamming and interception, but they lack the detailed location verification offered by distance bounding [146]. Future investigations should concentrate on scalable, low-latency distance-bounding solutions and adaptive tamper detection systems that can respond flexibly to physical threats [85].

8.3. Urban Environments: Privacy, Licensing, and Compliance

Urban UAV operations are subject to stringent regulatory frameworks that prioritize privacy safeguarding, airspace management, and adherence to license [85]. To fulfill these criteria, ref. [199] has suggested combining PUF-based device identities with blockchain-supported geofencing and licensing systems. These frameworks utilize smart contracts to enforce operational limits, such as flight areas, time constraints, and payload limitations [143]. For example, a drone equipped with a PUF-derived identity can register its credentials on a blockchain ledger, allowing decentralized validation of its permissions and activities. If the drone strays from its designated route, smart contracts can trigger notifications or disable critical operations [184]. This method improves auditability and trust without the need to rely on centralized authorities [160]. However, blockchain-based systems face issues related to latency, energy demands, and network availability, particularly in real-time or swarm operations [130]. Alternative solutions like centralized remote ID systems or 5G-assisted geofencing provide lower latency, but reintroduce vulnerabilities associated with single points of failure [20]. The utilization of UAVs in disaster areas, military operations, and urban settings requires customized security approaches [247]. Lightweight solutions such as PUFs are ideal for environments with limited infrastructure [51], while TPMs and distance-bounding techniques deliver strong safeguards in hostile situations [196,218]. Deployments in urban areas require compliance-focused solutions that harmonize privacy, auditability, and responsiveness [39]. These differences highlight the need for flexible, context-sensitive security frameworks and an ongoing exploration of scalable, resilient, and interoperable hardware security solutions [183].

9. Conclusions and Future Work

This review has examined the role of HSPs in enabling secure location verification for UAV swarms, analyzing the strengths and limitations of approaches such as PUFs, TPMs, blockchain-integrated systems, and distance-bounding techniques. Among these, PUFs emerge as the most energy-efficient and scalable solution for resource-constrained UAV environments, whereas TPMs and blockchain-based frameworks offer enhanced security for high-assurance and regulated applications. For practical deployment, industry stakeholders are advised to adopt PUF-based authentication for lightweight UAVs, leverage blockchain for decentralized licensing and audit trails, and consider TPMs for secure boot and attestation in mission-critical or military-grade systems. Ultimately, deployment strategies should be tailored to environmental constraints, regulatory requirements, and operational objectives.

Despite these advancements, several challenges persist, creating opportunities for future research. UAVs remain constrained by limited computational and energy resources, which restrict the complexity of current verification mechanisms. Physical vulnerabilities also pose a significant risk, necessitating robust anti-tampering measures. Furthermore, scalability in swarm scenarios, where multiple drones must be verified simultaneously without incurring excessive latency or energy overhead—remains an open problem. Compatibility with existing UAV communication protocols is another underexplored area that must be addressed to ensure seamless integration into real-world systems.

To overcome these limitations, future research should prioritize the design of lightweight PUF architectures optimized for UAV platforms to enhance both power efficiency and operational speed. Integrating blockchain-based frameworks with hardware security offers a promising pathway toward decentralized and tamper-proof location verification. In swarm environments, quorum-based consensus mechanisms supported by hardware-secured tokens could provide scalable and reliable verification solutions. Additionally, the fusion of ML techniques with hardware roots of trust holds significant potential for real-time anomaly detection and spoofing prevention. Beyond these directions, emerging areas such as post-quantum secure primitives, AI-augmented PUFs, and RISC-V-based secure architectures represent transformative opportunities for UAV security. Post-quantum cryptography will be essential to counter “harvest now, decrypt later” threats, ensuring long-term confidentiality for mission-critical data in swarms with extended lifecycles. AI-augmented PUFs can significantly improve reliability under environmental variations while enabling adaptive trust scoring and anomaly detection, which are crucial for dynamic swarm coordination. Similarly, RISC-V-based secure control systems offer open, customizable hardware platforms that integrate hardware roots of trust with lightweight cryptographic accelerators, reducing energy overhead while maintaining strong security guaranties. Together, these innovations pave the way for scalable, quantum-safe, and context-aware security frameworks that align with regulatory requirements and operational constraints. Future research should focus on integrating these technologies into hybrid architectures, validating their performance in real-world swarm deployments, and developing interoperability standards to ensure seamless adoption across heterogeneous UAV ecosystems.