Hierarchical Security Framework for Drone Control in Parcel Delivery ^†

Abstract

Secure delivery of packages by drones requires reliable management of cryptographic keys, despite limited on-board resources, multiple users, and the risk of interception or manipulation. This paper proposes a hierarchical model of a Key Distribution Center that manages the generation, distribution, storage, control, and destruction of cryptographic keys. The model uses public-key mechanisms for secure transmission of session keys and lightweight symmetric encryption for communication between the drone and the recipient. A session key lifecycle is defined, including verification, encrypted storage, validity control, and secure deletion. The operational workflow for the secure delivery of packages is also described. The proposed approach improves confidentiality, scalability, and access control.

1. Introduction

Unmanned aerial vehicles (UAVs), also known as drones, are increasingly used in civilian and industrial applications, from parcel delivery and environmental monitoring to inspections, emergency response, and surveillance. With the integration of drones into large-scale digital ecosystems, ensuring their communication security becomes a critical prerequisite for safe and reliable operation. This problem acquires special significance in delivery-related scenarios. The drone exchanges sensitive and important information, such as its coordinates, recipient identifiers, parcel reference numbers, and delivery status. In environments like this, the security, integrity, and authenticity of generated and exchanged data are of significant importance not only to protecting the information but also for physical safety and mission continuity.

Research to date shows that drone security is viewed through multiple aspects and attack surfaces, including hardware, software, communication, and sensor subsystems. Compromise of any of these subsystems affects the drone’s overall behavior during operation [1]. UAV security depends not only on protecting the communication channel from passive interception, but also on ensuring connectivity, which is essential for any delivery system [2]. The many possible attacks that drones are subject to can affect navigation, control, and delivery performance. Such attacks can lead to the falsification of navigation-related signals, mislead the drone, and cause route deviation, mission interruption, or unsafe landing behavior. Similarly, sensor-oriented attacks can manipulate the drone’s behavior by providing false sensor inputs [3,4]. These studies show that UAV security vulnerabilities can quickly move from cyber to physical damage [5]. In addition to communication and sensor threats, hardware attacks are critical for the practical deployment of unmanned aerial vehicles (UAVs) [6]. Intelligent agent-based architectures can support proactive resource allocation, adaptive network reconfiguration, anomaly detection, and data fusion in large-scale monitoring systems [7]. This confirms the need for secure and flexible communication architectures in drone-based logistics scenarios. Any physical access to the UAV or ground equipment allows an adversary to extract keys, modify firmware, or even perform side-channel analysis. Research in some publications highlights that storing cryptographic keys directly on the device or relying solely on software protocols is problematic. Attacks can extract keys or expose drone nodes to physical and side-channel attacks. In this regard, conventional approaches to key storage seem insufficient for platforms with a high risk of compromise. Therefore, when designing secure communication for drones, one cannot rely only on the choice of encryption algorithm; a secure mechanism for storing, managing, and protecting keys is required [8].

Full key lifecycle management should also be considered [9]. This issue becomes even more acute in drone delivery systems, where there are many users. In drones, impersonation and false commands can result in collisions, drone crashes, or even human injuries [10]. Several established building blocks exist in modern cryptography, such as centralized key distribution, public key infrastructures (PKI), digital certificates, and challenge-response authentication mechanisms [11]. Therefore, a scalable, well-controlled approach to key management is needed to maintain secure communication among the drone, the key management infrastructure, and the final recipient of the packages, while remaining compatible with the limited memory and computational resources of UAV platforms.

To address these challenges and ensure secure drone control in a logistics package-delivery scenario, this work proposes a hierarchical model based on a Key Distribution Center (KDC). The model is built around three main pillars. First, a hierarchical architecture that allows for scalable distribution of cryptographic keys. The second stage of the model is a procedure for the full lifecycle of session keys, including generation, verification, storage, distribution, key expiration, and final destruction. Third, an operational workflow describing how secure communication between the drone and the recipient is achieved during package delivery.

2. Materials and Methods

2.1. Threat Modeling in a Logistic Scenario with Unmanned Vehicles

The scenario we consider for the delivery of a parcel by a drone assumes that the adversary has the capability and knowledge to access the wireless communication channel between the KDC, the drone, and the recipient of the requested delivery. Therefore, under this hypothesis, the attacker can try to intercept, replay, delay, modify, or insert false messages during the establishment of cryptographic keys during operational communication. Besides this, the adversary can try to present themselves as a legitimate drone, recipient, or network element, to gain unauthorized access to information related to the delivery, or to manipulate the delivery process. These assumptions characterize the typical hostile environment described for unmanned vehicles and the Internet of Drones, where open wireless access, outdoor operation, and limited resources make the communication layer especially vulnerable to attacks [1,11]. The threat model in this work explicitly considers the following attacks (see Figure 1):

• Eavesdropping that is aimed at unlawfully revealing coordinates, shipment identifiers, or session cryptographic keys;
• Replay attacks, in which previously recorded valid messages are retransmitted to deceive communicating entities.
• Imitation attacks (impersonation), attempts in which the adversary presents themselves as a legitimate drone or recipient;
• Compromise of keys is an attack in which access to data can be disclosed, or, after the physical capture of a node, access to locally stored key material can be realized;
• Denial-of-service (DoS) attacks can prevent the establishment of a secure session or block timely communication related to delivery [1].

Figure 1 presents the main participants in the considered threat model for the drone: the base for packaging and dispatching parcels, the KDC, the drone, and the recipient, along with the secure communication channels between them. After identifying the main threats in the logistics scenario involving drones and how we are dealing with them, we present a cryptographic architecture capable of resisting these attacks. In response to the described challenges and to enhance security in drone control during parcel delivery, we propose a hierarchical KDC-based key management model.

2.2. Hierarchical KDC-Based Model for Key Management for Secure Drone Control in Parcel Delivery Scenarios

In drone-based parcel delivery systems, cryptographic protection must not be treated as a set of isolated encryption primitives. Rather, it must function as an integrated trust management mechanism, coordinating interactions among the logistics infrastructure, the drone platform, and the final recipient. For this reason, in this work, an approach is adopted that embraces a hierarchical security model with a Key Distribution Center (KDC) at its core, functioning as the root of trust in the system, as shown in Figure 2.

For the management of cryptographic keys, NIST SP 800-57 follows the design established in [12]. In this standard, functions such as protection, distribution, renewal, and revocation of key material are treated as basic security elements rather than secondary implementation details.

The architecture model includes multiple communicating objects: different roles and levels of trust, like the packaging base or dispatch center, the drone itself, ground control, and the authorized recipient. We assume that every drone and every user possesses a public/private key pair known to the KDC. On the other hand, the KDC is responsible for generating session keys and ensuring their secure delivery to the communicating parties. During the model’s design, we assume with high probability the following actions by the adversary: eavesdropping, message interception, unauthorized disclosure of delivery data, attempts at imitation, and partial compromise of a communication session. Instead of requiring constant sharing of secret data between all these objects, the proposed model introduces a central authority that securely manages identities and distributes temporary session keys to authenticated participants.

As shown in Figure 2, the proposed hierarchical model clearly distinguishes its levels. The first level of security is the KDC layer, responsible for identity registration, establishing long-term trust, applying policies, and securely issuing session credentials. The second level includes operational infrastructure components, such as the base for packaging and managing the station, which require authorization for specific delivery missions. The third level includes subjects for executing missions, primarily the drone, as well as the authentication of the end user receiving the parcel. During the execution of a specific mission or during delivery, this hierarchy provides not only structural but also cryptographic separation, with trust transmitted in a descending (top-down) manner and operational session keys generated in an ascending (bottom-up) manner. The proposed model organizes the function for the distribution of keys hierarchically to support large-scale deployments. For example, when object A needs to communicate securely with object B, which is located in a different administrative domain, the request is forwarded from the local KDC to a KDC of a higher level. Additionally, every user must possess a key pair for working with a cryptographic algorithm that uses a public key, as public keys are exchanged with the KDC. In this way, the organization of secure communication between the KDC and its users is ensured, as the information is encrypted with the corresponding public key for which it is intended. After that, it is directed towards the target domain. As a result of this hierarchical organization, the need for direct trust relationships between every pair of communicating participants is reduced.

A main advantage of the proposed hierarchical model is that the drone need not store a large number of long-term keys for all possible communication partners. Instead, each drone establishes trust only with the KDC (or with the infrastructure it provides) and receives short-term keys only for active sessions. From this stem several important advantages:

• Reduced long-term exposure to keys; since they are short-term, the risk of compromise is limited in time.
• Limited impact during a compromise: even if a given key is disclosed, only the current session is affected, not the entire communication history;
• Precise control over access rights, since different sessions can have different permission levels.

This logic is inspired by established practices such as Kerberos and its extension, PKINIT, which use asymmetric cryptography for initial authentication. All subsequent exchanges rely on symmetric cryptography for better performance and security. This hybrid approach is especially suitable for UAV platforms, as it uses slow but secure asymmetric cryptography only for the initial key exchange, followed by high-performance symmetric cryptography for regular communication, keeping latency, energy consumption, and computational costs low [13].

2.3. Principle of Operation of the Drone During Parcel Delivery

For a drone to be used for parcel delivery, it must have a module for communicating with the KDC and users via a GSM modem. Additionally, the secret key K_drone must be recorded in its controller and memory, paired with the exchanged KDC public key PK_drone, and used to receive the symmetric session keys. Also, a cryptographic algorithm must be installed and optimized depending on the number and types of operations, given the lower computational power and the limited memory available for secure communication with the KDC and users.

When the drone takes a parcel for a given user, it receives the delivery coordinates, the parcel number, the user’s identifier ID_user, and the symmetric session key Kc for secure communication with this user, encrypted using PK_drone from the KDC. This message is decrypted in the drone through PK_drone. At the same time, the KDC sends an encrypted message to the user using the user’s public key Euser, containing the symmetric session key Kc, the parcel number, and the drone identifier ID_drone. The user decrypts the message, using his secret key PK_user. When the drone reaches the recipient’s coordinates, it sends an encrypted message using a symmetric cryptographic algorithm and the session key. The encrypted message contains the parcel number, the coordinates of its location, and the drone identifier. When the recipient receives this encrypted message, they decrypt it using the symmetric cryptographic algorithm with the session key. Upon recognizing the parcel number and the drone ID, the recipient sends an encrypted message to the drone confirming the parcel number, the recipient’s ID, and, if necessary, corrected coordinates.

Upon receiving the encrypted message from the recipient, the drone decrypts it using the session key. Upon recognizing the recipient’s ID, it corrects the landing coordinates if necessary. When the parcel is taken from the recipient’s side, the session key for communication is deleted from the drone, and it heads towards the previously set coordinates of the packaging base. This drone work is realized according to the proposed algorithm.

2.4. Algorithmic Model for Generation, Distribution, Storage, and Destruction of the Cryptographic Keys

The generation of the keys is performed in the microcontroller KDC with the help of generators of pseudo-random numbers, as the degree of randomness must be sufficiently high, as is shown in Figure 3. Also, the storage, registration, and removal of keys are performed in the microcontroller, where databases for the key information are created. The information for the keys themselves must be stored in encrypted form. This can be achieved through the algorithmic model shown in Figure 3, which consists of two logically related algorithmic processes: Algorithm 1 and Algorithm 2 [14]. The first process covers the lifecycle management of session keys in the Key Distribution Center (KDC). including key generation, validation of weak keys, encryption with the main key, secure storage in the database, lifecycle monitoring, and destruction of expired or invalid keys.

The second process describes the procedure for secure communication, in which the KDC extracts and decrypts the stored session key, prepares session-related data, encrypts the information separately for the drone and the target recipient using their respective public keys, and delivers the secure messages to both parties. After decryption, the drone and the recipient extract the session key and establish a secure communication channel to exchange delivery-related information.

Algorithm 1: Session Key Lifecycle Management (KDC)

Microcontroller (KDC) initiates the key management process. At this stage, the operation’s context is determined, for example, the drone identifier, the user identifier, and the mission or parcel identifier. Random Number Generator generates a candidate session key, which is temporary and is intended to be used only within the framework of one specific communication session or mission. Check for weak keys using statistical tests for randomness. Here, the randomness of the generated key and its statistical characteristics are evaluated, thereby making it vulnerable to cryptanalysis. When the key is determined to be weak, it is not allowed for use and is destroyed immediately. After that, the algorithm returns to the generation stage until a cryptographically resilient key is obtained. Encrypt the session key with the master key: $$K_c^{enc}=\mathrm{Enc}(K_M,K_c)$$ Upon receiving a valid, sufficiently strong key, the KDC protects it by encrypting it with the system’s main key. $K_M$. As a result, a secure representation of the session key is created, denoted as $K_c^{enc}$. This step is necessary because the session key must not be stored in open form in the system database. This way, even if unauthorized access is obtained to the database, the key itself remains protected. Store in database $K_c^{enc}$ together with metadata: ID_drone; ID_user; _ID/parcel_ID; creation moment t_create; validity period or remaining time of the key T(Kc). Periodically check key validity: if $T\left(K_c\right)\le T_{\min }$ (minimum acceptable lifetime), trigger key destruction. The main criterion is whether the remaining lifetime of the key T(Kc) is greater than a minimum allowable threshold Tmin. If this criterion is not met, the mission has already finished, or there is a suspicion of compromise, the key is considered invalid and destroyed. If the check is successful, the key remains active and can be used for communication. Key destruction: Set $T\left(K_c\right)=0$, erase $K_c^{enc}$ from the database, and delete any copies from volatile memory. This occurs either upon timeout or after session termination.

Once the session key exists and is securely stored, the algorithm proceeds to the second main process: establishing secure communication and distributing it to the participants.

Algorithm 2: Secure Communication (Key Distribution and Usage)

1. Upon a communication request between a drone and a user, the KDC retrieves the corresponding record from the database using ${\mathrm{ID}}_{\mathrm{drone}}$ and ${\mathrm{ID}}_{\mathrm{user}}$ and $mission\text{\_}ID$ 2. Decrypt the session key using the master key:

$$K_c=\mathrm{Dec}\left(K_M,K_c^{enc}\right),$$ (1)

3. Prepare the session data block:

$$\mathrm{M}=\{{\mathrm{K}}_{\mathrm{c}}, coordinates, {ID}_{user}, {ID}_{drone}, packet\text{\_}ID, {\mathrm{t}}_{\mathrm{c}\mathrm{r}\mathrm{e}\mathrm{a}\mathrm{t}\mathrm{e}}\mathrm{\}}$$ (2)

The data packet serves as the logical basis for secure communication and provides participants not only a key but also the context for its validity. 4. Asymmetrically encrypt $\mathrm{M}$ for both participants:

$$M_{\mathrm{drone}}=\mathrm{Enc}\left(E_{\mathrm{drone}},M\right),M_{\mathrm{user}}=\mathrm{Enc}\left(E_{\mathrm{user}},M\right)$$ (3)

5. Send $M_{\mathrm{drone}}$ to the drone and $M_{\mathrm{user}}$ to the user. 6. Encryption for individual participants. Drone: Decrypts $M=\mathrm{Dec}\left({PK}_{dron},M_{\mathrm{drone}}\right)$ and extracts $K_c$ and session data. User: Decrypts $M=\mathrm{Dec}\left({PK}_{user},M_{\mathrm{user}}\right)$ and extracts $K_c$ and session data. 7. Establish a secure session: The drone and the user use $K_c$ as a symmetric key for data encryption and exchange over a secure channel.

2.5. Secure Drone-to-Recipient Communication Workflow

The workflow for secure communication between a drone and a recipient is shown in Figure 4. Two communication channels are shown: internet communication, used between the KDC and the end participants, and GSM communication, used for the operational exchange between the drone and the recipient during the mission. In the first, initial phase, the KDC distributes a session key, Kc, and related identifiers to the drone and the recipient via the internet. In the operational phase, the drone and the recipient exchange messages via the GSM channel. The exchange includes the drone’s identifier, the user’s identifier, the parcel’s identifier, coordinates, an arrival notification, and confirmation. In this way, cryptographic protection, participant identification, and real-time delivery coordination are ensured.

To clarify the logic of data exchange,

Table 1. Functional description of messages M1–M6 in the proposed secure drone delivery workflow.

Message	Communication Path	Payload	Main Purpose
M1	KDC → Drone (Internet)	C1 = {Kc, IDuser, parcel_ID, user coordinates}	Provides the drone with the session key, the recipient’s identity, the parcel identifier, and the delivery coordinates necessary to start the secure mission.
M2	KDC → User (Internet)	C2 = {Kc, IDdrone, parcel_ID}	Provides the recipient with the session key, drone identity, and parcel identifier, enabling trusted identification of the delivery source
M3	Drone → User (GSM)	C3 = {IDdrone, parcel_ID, current coordinates/arrival notification}	Notifies the recipient about the drone status, current location, or arrival at the delivery point
M4	User → Drone (GSM)	C4 = {ID user, parcel_ID, optional corrected coordinates/confirmation}	Allows the recipient to confirm identity, acknowledge delivery readiness, or provide updated coordinates
M5	Drone → User (GSM	C5 = {IDdrone, parcel_ID, current coordinates/arrival notification}	Sends operational delivery-status information from the drone to the legitimate recipient during the final delivery phase
M6	User → Drone (GSM)	C6 = {IDuser, parcel_ID, optional corrected coordinates/confirmation}	Returns confirmation or corrected location data from the legitimate recipient to the drone to support secure parcel handover

systematizes the functional roles of the messages in the proposed secure workflow. The first two messages establish the initial cryptographic and identification context via the KDC, while the remaining messages coordinate the operational delivery between the drone and the legitimate recipient.

The described exchange of messages M₁–M₆ demonstrates the practical implementation of the proposed hierarchical KDC-based model for the secure delivery of parcels by drone. The initial phase establishes a cryptographic context and binds participants to a specific mission. In the operational phase, it maintains secure two-way coordination between the drone and the recipient. This separation between the preliminary distribution of key material and subsequent events for securing communication exchanges increases scalability, facilitates access management, and reduces the impact of an eventual compromise of individual messages or participants.

3. Results and Discussion

The proposed hierarchical KDC-based model provides several practical advantages compared to approaches based on static pre-shared keys or direct pairwise trust relationships among all participants. In a large-scale delivery environment, the number of drones, recipients, delivery sessions, and logistic nodes can scale dynamically. Under such conditions, maintaining long-term keys for all possible communication pairs becomes unmanageable and increases the impact of a potential key compromise. The proposed model mitigates this risk by assigning the KDC the role of a centralized trusted authority and by distributing short-term session keys strictly for a specific delivery mission.

From a security perspective, the use of temporary session keys limits the temporal and functional scope of a potential compromise. If a session key is revealed, the effect is limited to the current delivery session and does not reveal past or future communications. This is especially important in drone delivery scenarios, where the drone operates in an open wireless environment and is vulnerable to interception, impersonation, replay attacks, and physical capture. The proposed lifecycle procedure, including key generation, verification, encrypted storage, validity control, and destruction, directly addresses these risks.

Another important result is the separation between the key distribution phase and the operational communication phase. The KDC is used to establish the cryptographic context before the critical transmission stage, after which the drone and the recipient exchange encrypted operational messages using the session key. This reduces the need for continuous dependence on the KDC during the final delivery phase and can improve operational reliability in cases of temporary degradation of network function.

The proposed workflow also improves the traceability and control of the delivery process. Each message is linked to a specific drone ID, user ID, package ID, session key, and delivery context. This binding between cryptographic material and mission-related metadata reduces the possibility of unauthorized package retrieval, false delivery confirmation, or message replay. At the same time, the model remains compatible with the limited computational resources of UAV platforms, as asymmetric cryptography is primarily used for secure key distribution. In contrast, symmetric cryptography is used for the regular exchange of operational data.

However, several limitations must be considered. The KDC represents a critical infrastructure component and must be protected against unauthorized access, denial-of-service attacks, and operational failures. In practical implementations, redundancy, backup KDC nodes, secure audit logs, and fail-safe communication mechanisms must be implemented. Furthermore, the proposed model requires experimental verification on a real or simulated UAV platform to evaluate latency, memory utilization, computational overhead, energy consumption, and the reliability of key destruction mechanisms.

Overall, the results show that the proposed architecture can serve as a practical framework for secure drone package delivery. It combines scalable key management, limited key exposure, mission-specific authentication, and lightweight operational communication. These features make the model suitable for further development, prototype implementation, and experimental verification in logistics scenarios involving unmanned aerial vehicles.

In the present work, an integrated approach is proposed for secure communication during the delivery of parcels with drones, which is based on a hierarchical KDC-based model for the management of cryptographic keys, a formal description of the lifecycle of the session keys, and a defined workflow for the exchange of messages between the participants. The proposed architecture addressed the security challenges identified in Section 2.1. By introducing a centralized trust authority (KDC) and a hybrid cryptographic scheme (asymmetric for key distribution and symmetric for operational exchange). Achieving a high balance between high protection and compatibility with the limited resources of UAV platforms.

A main contribution of the model is the full lifecycle management of session keys, from generation and checking for weak keys, through encrypted storage in a database, to automatic destruction upon expiration of validity or upon mission completion. This guarantees that, even with physical access to the drone or unauthorized access to the KDC’s infrastructure, the compromise of an individual key has a strictly limited impact in time and scope. The defined secure workflow with six messages (M1–M6) provides a practical framework for secure delivery, in which the preliminary distribution of key material and identification data allows the drone and the recipient to establish secure two-way communication in real time, without the need for a constant connection with the KDC during the critical phase of handing over the parcel. In this way, the proposed solution addresses contemporary security requirements in drone logistics while also offering scalability and flexibility for implementation in distributed systems with many users’ capabilities.

4. Conclusions

A hierarchical KDC-based model for managing cryptographic keys is presented. The presented and proposed model ensures, first of all, secure communication in parcel-delivery scenarios involving unmanned aerial vehicles (UAVs), commonly known as drones. All of this helps encompass the full lifecycle of session keys, including a defined operational workflow for interactions among the drone, the recipient, and the key distribution center.

The proposed approach demonstrates resilience against the main threats in a wireless environment. It provides a practical basis for building secure logistics systems with drones, while accounting for the limited computational and energy resources of UAV platforms. Future research will focus on the hardware implementation of the model on a drone prototype with limited resources, testing and verifying the protocol, and enhancing the fault tolerance of the KDC infrastructure through the development of mechanisms.