Due to the limited payload and power of drones, the computational overhead, storage overhead and communication overhead that can be used for secure communication are restricted, making it difficult to apply some complex but fairly secure authentication protocols on drones. In this paper, we propose a low-complexity protocol for storing identity information in a resource-unconstrained device that does not require the UAV to store the information, thereby enhancing the UAV’s resistance to capture. The protocol in this paper mainly consists of quasi-cyclic low-density parity-check (QC-LDPC) codes, physical unclonable functions (PUFs) based on random-access memory (RAM), “XOR” operations, and hash computation. The protocol in this paper is an authentication architecture in which the drone is guided by the ground station to read its identity information, and the drone does not store any identity information in advance. The protocol is divided into two phases: 1. fuzzy authentication of fingerprint PUF and 2. uniqueness authentication accomplished while guiding the recovery of identity PUF. Recovering identity PUF in this paper, QC-LDPC is used as the error control module, and the optimization of bit-flip decoding significantly reduces the probability of decoding failure. After the comparative security analysis and comparative overhead analysis of this paper’s protocol, it can be concluded that this paper’s protocol can withstand common attacks (including attacks attempting to pass authentication, attacks attempting to interfere with authentication, and physical capture attacks), and the storage and communication overhead is small in the case of large time overhead.