CAPSID: A Private Session ID System for Small UAVs

The US Federal Aviation Administration (FAA) has recently mandated that small unmanned aerial vehicles (UAVs) be equipped with a transmitter that broadcasts the UAV’s serial number, location, and altitude. The inclusion of a unique identifier in the form of a UAV serial number has stoked fears that the identifier will be used to track UAV operators and has even led some UAV perators to file a lawsuit against the FAA. In this paper, we propose CAPSID, an implementation of the FAA session ID concept that provides message authentication—something current Remote ID implementations lack—and strong operator anonymity. The FAA (or its equivalent in other jurisdictions) retains the ability to de-anonymize operators, but only in circumstances prescribed by law. To make this possible, CAPSID introduces a partially trusted third party, the Custodian, that serves as the bridge between anonymous identifiers and true operator identity. The Custodian ensures that the legal requirements for de-anonymization are met, preventing unnecessary mass collection of personally identifying information by a government agency. We formally verify the message authentication property of CAPSID using a cryptographic protocol checker and provide a formal proof of identifier non-linkability, even in the presence of corrupt (but non-colluding) authorities.