CAPSID: A Private Session ID System for Small UAVs

The US Federal Aviation Administration (FAA) has recently mandated that small unmanned aerial vehicles (UAVs) be equipped with a transmitter that broadcasts the UAV's serial number, location, and altitude. The inclusion of a unique identifier in the form of a UAV serial number has stoked fears that the identifier will be used to track UAV operators and has even led some UAV operators to file a lawsuit against the FAA.

In this paper, we propose CAPSID, an implementation of the FAA session ID concept that provides message authenticationsomething current Remote ID implementations lack-and strong operator anonymity. The FAA (or its equivalent in other jurisdictions) retains the ability to de-anonymize operators, but only in circumstances prescribed by law. To make this possible, CAPSID introduces a partially trusted third party, the Custodian, that serves as the bridge between anonymous identifiers and true operator identity. The Custodian ensures that the legal requirements for de-anonymization are met, preventing unnecessary mass collection of personally identifying information by a government agency.

We formally verify the message authentication property of CAP-SID using a cryptographic protocol checker and provide a formal proof of identifier non-linkability, even in the presence of corrupt (but non-colluding) authorities.