An efficient low-altitude route authentication method with privacy protection

Abstract

A privacy-preserving and efficient low-altitude route authentication method is proposed. In the system initialization phase, the trusted authority center configures system security parameters and initializes Bloom filters, while setting up outposts to prepare for data processing. In the route verification information generation phase, the trusted authority center defines the legal routes of drones for each outpost and generates Bloom filters. The trusted authority center uses the filter to generate elements and sends them to the outposts to prepare for subsequent verification. In the route verification phase, the outposts receive real-time flight data from drones, use Bloom filters to filter illegal route elements, and send them to the trusted authority center after processing. The trusted authority center verifies the received elements and confirms them as legal routes if successful. This method ensures that only drones on legal routes pass verification, protects the privacy of route information, reduces computing and communication overhead, adapts to resource-constrained drone environments, and provides safe and efficient route authentication.

Description

Technical Field

[0001] The present invention relates to unmanned aerial vehicle route verification and wireless communication network security technology, and in particular to an efficient low-altitude route authentication method with privacy protection. Background Art

[0002] With the booming development of the low-altitude economy, drone logistics business has begun to sprout and expand. Operators have opened a large number of routes and built take-off and landing points in cities to complete a considerable number of cargo delivery tasks. In this operating system, each drone logistics mission is route planned by the flight control center. The drone needs to choose a specific flight route from the multiple legal routes allocated to perform point-to-point cargo transportation in the city airspace.

[0003] However, as the scale of low-altitude drone traffic networks continues to expand, traditional centralized supervision methods are difficult to meet demand. In order to achieve effective supervision, the air traffic control center may delegate some airspace management authority to offline outposts distributed in the city in the future. These outposts are deployed and managed by third-party organizations. However, this regulatory model faces severe security challenges: on the one hand, registered drones may be hijacked and flown randomly, and unregistered drones may occupy routes and fly illegally. These behaviors will pose a threat to public safety, requiring outposts to be able to determine the legality of drone flight routes in the airspace in real time; on the other hand, since drones often perform commercial flight missions, their route information has important commercial value, and drones and outposts belong to different organizations. Third-party outposts may steal complete route information, so drones need to avoid leaking additional route information to outposts during the authentication process.

[0004] When addressing these security challenges, it is also necessary to consider the hardware limitations of the drone itself. As an edge device, the drone has limited computing resources and it is difficult to support the high energy consumption requirements brought by the complex cryptographic system. At the same time, the drone logistics scenario has high requirements for real-time communication and cannot withstand too many rounds of communication interactions. Therefore, how to complete the legitimacy verification of the drone route and protect the privacy of the route data under limited resource conditions has become a difficult problem that needs to be solved urgently.

[0005] Existing drone security protection technologies mainly focus on the confidentiality and integrity of communication links, and establish trust relationships through various identity authentication and key establishment protocols. However, research on achieving efficient verification while protecting route privacy is relatively insufficient. In particular, considering the resource constraints of drones, completing efficient route verification while ensuring data security is also an important issue to be solved.

[0006] UAV network security technology based on cryptographic protocols:

[0007] With the rapid development of drone logistics and the continuous expansion of application scenarios, the safety verification of drone routes faces unprecedented challenges. The use of a large number of drones increases the risk of illegal intrusion and hijacking. Once hacker organizations master the intrusion methods of a certain type of drone, it may lead to large-scale security accidents, which will not only endanger public safety, but also cause serious interference to urban airspace management. At present, the security research on drone route verification mainly focuses on three aspects: drone communication security protocol, route authentication mechanism and identity management system.

[0008] UAV communication security protocol. It mainly relies on the design of key distribution and management framework to ensure the communication security between the UAV and the ground control center, and to ensure the confidentiality, integrity and authenticity of the command transmission and data return process.

[0009] Route authentication mechanism: The route information is authenticated and integrity verified through cryptographic methods to ensure that the drone flies along the designated legal route and prevent the route from being tampered with or forged.

[0010] Identity management system. Including drone registration and authentication and real-time identity verification, involving the establishment of a multi-party mutual trust mechanism, key updates, and validity management of identity credentials.

[0011] Currently, drone route verification has become the focus of industry attention because it provides the necessary security guarantee for urban low-altitude traffic management. By setting up distributed outposts, drones can be monitored in real time and their routes verified. However, existing verification technologies based on cryptographic protocols mainly focus on the security protection of the communication process and lack effective solutions for route privacy protection. Existing technologies mainly protect the authenticity and confidentiality of communication links, but lack a mechanism for efficient verification under the premise of protecting route privacy. In addition, existing privacy protection protocols are generally more complex, require multiple rounds of interaction, and have large computational and communication overheads, which are not suitable for actual scenarios where drone resources are limited.

[0012] It should be noted that the information disclosed in the above background technology section is only used for understanding the background of the present application, and therefore may include information that does not constitute prior art known to ordinary technicians in the field. Summary of the invention

[0013] The main purpose of the present invention is to overcome the defects existing in the above-mentioned background technology and provide an efficient low-altitude route authentication method with privacy protection.

[0014] To achieve the above object, the present invention adopts the following technical solutions:

[0015] An efficient low-altitude route authentication method with privacy protection includes a system initialization phase, a route authentication information generation phase and a route authentication phase;

[0016] The system initialization phase includes: the trusted authority center sets the basic security parameters of the system, including hash functions and bilinear mapping parameters, and initializes the Bloom filter; the trusted authority center and the sentinel are set up to prepare for subsequent data processing;

[0017] The route verification information generation phase includes: the trusted authority center defines the legal route of the UAV under the airspace of each outpost and generates a Bloom filter; using the Bloom filter to generate corresponding elements and send them to the outpost;

[0018] The route verification stage includes: the outpost receives the real-time flight data set of the drone, uses the Bloom filter to filter elements that do not belong to the legal route, and processes the filtered elements and sends them to the trusted authority center. The trusted authority center verifies the received elements according to the Bloom filter. If the verification is successful, the corresponding elements are placed in the final legal route set.

[0019] Furthermore, the trusted authoritative center is a flight control center.

[0020] Furthermore, the system initialization phase specifically includes the following steps:

[0021] The trusted authority center gives security parameters, calls the parameter generation algorithm to generate the hash function and bilinear mapping parameters required by the system, and randomly selects a number to calculate the system master key;

[0022] The trusted authority center divides the urban airspace equally into multiple unit blocks, assigns a unique number to each unit block, and then evenly distributes the unit blocks to each outpost for management;

[0023] The trusted authority selects an array large enough to create a Bloom filter and initializes it to 0 in preparation for subsequent route verification;

[0024] When the outpost is built and registered, the trusted authority center generates the airspace range and private key for it and delivers it to the outpost offline so that the outpost can perform subsequent route verification work.

[0025] Furthermore, the route verification information generation stage specifically includes the following steps:

[0026] The trusted authority center defines the legal routes of drones in the airspace of each outpost and generates a set of legal routes.

[0027] The trusted authority randomly selects a number, calculates and generates a set representing the no-fly zone, which describes the no-fly zone for drones under the outpost airspace;

[0028] Based on the set of legal routes and the set of no-fly zones, the trusted authority center performs a Bloom filter construction operation to generate a hash function and a bit array;

[0029] The trusted authority center checks the unit blocks in the legal route set, identifies the false positive blocks that may be misjudged as being in the no-fly zone by the Bloom filter, and records the false positive blocks in a set;

[0030] The trusted authority generates a polynomial based on the set of false positive blocks and randomly selects an element to generate an element sequence;

[0031] The trusted authority center uses the master key to generate a signature for the route information to ensure that the route information cannot be tampered with;

[0032] The trusted authority center distributes the generated route information and signature to the drone so that the drone can use it in the subsequent route verification phase.

[0033] Furthermore, the route information includes a legal route set, a false positive block set, a Bloom filter, and an element sequence.

[0034] Furthermore, the route verification stage specifically includes the following steps:

[0035] When a drone enters the outpost’s airspace for the first time, it sends information containing the Bloom filter, element sequence, verification parameters, and signature to the outpost. The outpost first verifies the legitimacy of the signature to confirm that the mission verification information provided by the drone is legitimate.

[0036] When the outpost detects that the drone enters a new unit block, the outpost calculates a specific value and uses the Bloom filter to verify whether the unit block belongs to the drone’s legal route; if the verification passes, the outpost will continue to monitor the drone’s flight trajectory;

[0037] If the unit block does not belong to a legal route, the outpost will calculate and send a specific message to the drone, requesting further verification;

[0038] After receiving the message from the outpost, the drone selects a specific element from the element sequence and calculates the verification value, and then sends the verification value back to the outpost;

[0039] After receiving the verification value sent by the drone, the outpost performs a final verification; if the verification is successful, it indicates that the unit block has passed the false positive verification and is part of the drone's legal route; the outpost will continue to monitor the drone's flight trajectory until the drone enters the next unit block.

[0040] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the privacy-protecting and efficient low-altitude route authentication method.

[0041] A computer program product comprises a computer program, wherein when the computer program is executed by a processor, the efficient low-altitude route authentication method for privacy protection is implemented.

[0042] The present invention has the following beneficial effects:

[0043] In response to the challenges mentioned above, based on the low-altitude logistics scenario of drones, the present invention proposes an efficient low-altitude route authentication method with privacy protection. The present invention can complete efficient legitimacy verification under the premise of protecting the confidentiality of the complete route information of the drone. It can be combined with existing cryptographic technology and lightweight security computing methods to make it suitable for situations where drone resources are limited, and realize efficient and secure verification of route information. The present invention takes into account the balance between protecting route privacy and ensuring verification efficiency, has high verification efficiency, and effectively solves the problem of limited computing power and communication resources of drones.

[0044] The present invention satisfies the demand for drone low-altitude route authentication in drone low-altitude logistics scenarios. Compared with the prior art, the advantages of the present invention mainly include: first, it ensures that only drones flying on legal routes can pass the verification of the outpost; second, it ensures the confidentiality of the drone's complete route information during the verification process; third, it realizes efficient drone low-altitude route verification, greatly reducing computing overhead and communication overhead.

[0045] Other beneficial effects of the embodiments of the present invention will be further described below. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 Schematic diagram of an efficient UAV low-altitude route authentication scheme with privacy protection according to an embodiment of the present invention. DETAILED DESCRIPTION

[0047] The following is a detailed description of the embodiments of the present invention. It should be emphasized that the following description is only exemplary and is not intended to limit the scope and application of the present invention.

[0048] It should be noted that when an element is referred to as being "fixed to" or "disposed on" another element, it can be directly on the other element or indirectly on the other element. When an element is referred to as being "connected to" another element, it can be directly connected to the other element or indirectly connected to the other element. In addition, connection can be used for fixing as well as for coupling or communication.

[0049] It should be understood that the orientation or position relationship indicated by terms such as "length", "width", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside" and "outside" are based on the orientation or position relationship shown in the accompanying drawings, and are only for the convenience of describing the embodiments of the present invention and simplifying the description, and do not indicate or imply that the referred device or element must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the present invention.

[0050] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of the embodiments of the present invention, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0051] Definitions of Abbreviations and Key Terms:

[0052] Bloom Filters:

[0053] Bloom filters provide a probabilistic and efficient member query function. In this scheme, Bloom filters are used to quickly test set membership. Given a bit array B of length m and k independent hash functions , where S represents all possible sets. This structure has the characteristic of false positive, that is, it may mistakenly judge an element that is not in the set as being in the set, but will not have false negative, that is, it will not judge an element in the set as not being in the set. The Bloom filter mainly consists of two functions:

[0054] :Given a set S, for each element , calculate k hash values , and set the bit at the corresponding position in array B to 1. Output the constructed bit array B.

[0055] : Given an element x, calculate k hash values , if the corresponding k positions in B are all 1, output True (x may be in the set at this time), otherwise output False (x is definitely not in the set at this time).

[0056] For a given array length m and set size n, there is an optimal relationship between the false positive probability p and the number of hash functions k: .

[0057] Bilinear Maps

[0058] Given security parameters , , , To satisfy The cyclic group of

[0059] Bilinear: ,and , we can get .

[0060] Non-degenerate: exists , so that .

[0061] Computability: , there is an efficient algorithm to calculate .

[0062] Bilinear parameter generator Represents a parameter The probability algorithm for the input is output as a seven-tuple .in Express satisfaction A large prime number, is an additive cyclic group, is a multiplicative cyclic group, and is a generator, is a bilinear map that satisfies non-degenerate and computable properties.

[0063] Identity-Based Signature (IBS):

[0064] Identity-based signatures provide a public key signature mechanism that does not require a certificate. In this scheme, the user's public key can be directly derived from his or her identity information (such as recognizable strings such as email addresses and phone numbers) without the need for additional public key certificates. The entire system is maintained by a trusted private key generator (PKG), which holds the system master secret key (MSK) and is responsible for generating the corresponding private key for the user. IBS mainly consists of the following four algorithms:

[0065] : Input security parameter λ to generate system master public key MPK and master private key MSK. MPK is open to the public, and MSK is kept securely by PKG.

[0066] PKG uses MSK to generate the corresponding private key SK for the user ID. This process requires identity authentication to ensure that the private key is only issued to legitimate users.

[0067] :The user uses the private key SK to sign the message M and generate a signature value σ.

[0068] → True / False: Anyone can use the signer’s identity ID to verify whether the signature σ on the message M is valid. Output True if the signature is valid, otherwise output False.

[0069] The security of this scheme is based on the unforgeability of the signature, that is, without the corresponding private key, an attacker cannot generate a valid signature for any message, even if the attacker can obtain the private key of another identity and the signature of any message.

[0070] In low-altitude drone logistics scenarios, in order to prevent the occurrence of illegal and random drone flights, third-party offline outposts must verify the legality of drone flight routes in real time. In addition, since drone route information has potential commercial value, the privacy of drone route information needs to be guaranteed during the verification process, and third-party outposts should not be able to obtain additional drone route information. At the same time, as edge devices, drones have limited computing resources and it is difficult to meet the energy consumption requirements of high-complexity cryptographic systems; the scenario has high requirements for real-time communication, and the number of communication interaction rounds should not be too many. It is necessary to complete route verification and protect data privacy under limited resource conditions.

[0071] like Figure 1 As shown, for low-altitude UAV logistics scenarios, an embodiment of the present invention proposes a privacy-protected and efficient UAV low-altitude route authentication method, which is suitable for situations where UAV resources are limited. Under the premise of protecting the confidentiality of the UAV's complete route information, efficient and secure verification of route information is achieved. Figure 1 In the figure, A and B represent the starting point and end point of the drone route, and S1 to S4 represent different outposts.

[0072] The privacy-preserving and efficient low-altitude route authentication method includes a system initialization phase, a route authentication information generation phase, and a route authentication phase;

[0073] The system initialization phase includes: the trusted authority center (such as the flight control center) sets the basic security parameters of the system, including hash functions and bilinear mapping parameters, and initializes the Bloom filter; the trusted authority center and the sentinel are set up to prepare for subsequent data processing;

[0074] The route verification information generation phase includes: the trusted authority center defines the legal route of the UAV under the airspace of each outpost and generates a Bloom filter; using the Bloom filter to generate corresponding elements and send them to the outpost;

[0075] The route verification stage includes: the outpost receives the real-time flight data set of the drone, uses the Bloom filter to filter elements that do not belong to the legal route, and processes the filtered elements and sends them to the trusted authority center. The trusted authority center verifies the received elements according to the Bloom filter. If the verification is successful, the corresponding elements are placed in the final legal route set.

[0076] In a preferred embodiment, the system initialization phase specifically includes the following steps:

[0077] (1) Setting basic security parameters of the system: The Trusted Authority (TA) gives security parameters, calls the parameter generation algorithm to generate the hash function and bilinear mapping parameters required by the system, and randomly selects a number to calculate the system master key;

[0078] (2) Division of urban airspace: The trusted authority center divides the urban airspace equally into multiple unit blocks, assigns each unit block a unique number, and then evenly distributes the unit blocks to each outpost for management;

[0079] (3) Initialize Bloom filter: The trusted authority selects an array large enough to create a Bloom filter and initializes it to 0 in preparation for subsequent route verification;

[0080] (4) Generate the airspace range and private key of the outpost: When the outpost is built and registered, the trusted authority generates the airspace range and private key for it and delivers it to the outpost offline so that the outpost can perform subsequent route verification work.

[0081] In a preferred embodiment, the route verification information generation stage specifically includes the following steps:

[0082] (1) Delineation of legal routes: The Trusted Authority (TA) defines legal routes for drones in the airspace of each outpost and generates a set of legal routes.

[0083] (2) Generate a no-fly zone set: The TA randomly selects a number, calculates and generates a set representing the no-fly zone, which describes the no-fly zone of the drone under the outpost airspace;

[0084] (3) Bloom filter construction: Based on the legal route set and the no-fly zone set, the TA performs a Bloom filter construction operation to generate a hash function and a bit array.

[0085] (4) Identifying false positive blocks: TA checks the unit blocks in the legal route set, identifies the false positive blocks that may be misjudged as being in the no-fly zone by the Bloom filter, and records these false positive blocks in a set;

[0086] (5) Generating polynomials and element sequences: TA generates a polynomial based on the set of false positive blocks and randomly selects an element to generate an element sequence;

[0087] (6) Generate signature: TA uses the master key to generate a signature for the route information to ensure that the route information cannot be tampered with; the route information includes the legal route set, the false positive block set, the Bloom filter, and the element sequence;

[0088] (7) Assigning route information: TA assigns the generated route information and signature to the UAV so that the UAV can use it in the subsequent route verification phase.

[0089] In a preferred embodiment, the route verification stage specifically includes the following steps:

[0090] (1) Initial verification: When a drone enters the outpost’s airspace for the first time, it sends information containing a Bloom filter, element sequence, specific parameters, and signature to the outpost. The outpost first verifies the legitimacy of the signature to confirm that the mission verification information provided by the drone is legitimate.

[0091] (2) Real-time route verification: When the outpost detects that the drone enters a new unit block, the outpost calculates a specific value and uses the Bloom filter to verify whether the unit block belongs to the drone’s legal route; if the verification passes, the outpost will continue to monitor the drone’s flight trajectory;

[0092] (3) Handling false positive situations: If the unit block does not belong to a legal route, the outpost will calculate and send a specific message to the drone to request further verification;

[0093] (4) Drone response: After receiving the message from the outpost, the drone selects a specific element from the element sequence and calculates the verification value, and then sends the verification value back to the outpost;

[0094] (5) Final verification: After receiving the verification value sent by the drone, the outpost performs a final verification. If the verification succeeds, it indicates that the unit block has passed the false positive verification and is part of the drone’s legal route. The outpost will continue to monitor the drone’s flight trajectory until the drone enters the next unit block.

[0095] Through the above steps, the route verification phase ensures the legality of the UAV's flight route under the outpost airspace and handles possible false positive situations, thereby ensuring the flight safety and data privacy of the UAV.

[0096] The above-mentioned embodiment of the present invention designs a method for authenticating low-altitude routes of unmanned aerial vehicles based on multi-party secure computing technology, realizes the privacy protection of low-altitude routes of unmanned aerial vehicles, and completes efficient route verification under the premise of ensuring data security. In this method, the third-party outpost can only know the actual flight route of the unmanned aerial vehicle, and cannot know the complete legal route information. In the embodiment of the present invention, a low-altitude route verification scheme using BLOOM filters and a concise privacy set intersection protocol is designed, which uses BLOOM filters for rapid verification and performs false positive re-verification through a concise privacy set intersection protocol, greatly reducing computing and communication overhead. At the same time, identity-based signature technology is used to ensure the immutability of route information. Efficient low-altitude route verification of unmanned aerial vehicles is achieved.

[0097] The specific embodiments of the present invention and algorithm examples thereof are further described below.

[0098] In order to meet the demand for drone low-altitude route authentication in drone low-altitude logistics scenarios, an embodiment of the present invention proposes an efficient low-altitude route authentication method with privacy protection.

[0099] The implementation process of the privacy-protected and efficient low-altitude route authentication method of the present invention is divided into three parts: 1) system initialization; 2) route verification information generation; 3) route verification. Its workflow is as follows:

[0100] 1) System initialization

[0101] During the system initialization phase, the Flight Control Center (FCC) is assumed to be the Trusted Authority (TA). The TA will perform the following steps to generate the entire system.

[0102] (1) Given security parameters , Call Generate Parameters ,in At the same time, the FAA randomly selects a number , calculated value As the system master key.

[0103] (2) TA divides the urban airspace equally into Unit blocks, each unit block is assigned a random value As its unique number. TA distributes these unit blocks equally to outposts monitor, and the number of unit blocks managed by each outpost is .

[0104] (3) TA initializes the BLOOM filter and selects an array large enough to create the BLOOM filter, which is initialized to 0.

[0105] At the outpost When building and registering, TA generates an airspace range for it and its private key , and Offline delivery to outpost j.

[0106] 2) Generation of route verification information

[0107] First, TA defines the legal routes of the drone in the airspace of each outpost in this mission. That is, for outpost j, a set , if there is a number The unit blocks are allowed to fly through in this mission, then the set There is one ,satisfy .

[0108] TA randomly selects a number ,calculate , and generate a set , for all ,gather There is one ,satisfy . Describes the no-fly zone for drones in the airspace of outpost j during this mission.

[0109] TA is based on and Perform the following operations to generate mission verification information for the drone in the airspace of outpost j:

[0110] (1) Execute BLOOM.Build , generate k independent hash functions and a bit array , whose length is .

[0111] (2) Initialize an empty set For all , TA checks whether satisfy: If it exists, it means that this unit block For a false positive block in a legitimate route, the FAA will Add to collection middle, All unit blocks that belong to legitimate routes but are false positives in this mission are recorded.

[0112] (3) For a given , TA generates a polynomial: .in are the coefficients of the corresponding terms of the polynomial. Based on this polynomial, the FAA randomly selects , generating elements Next, TA generates the sequence ,in TA uses the master key pair Generate signature , and the route information under the airspace of outpost j Assigned to drone.

[0113] 3) Route verification

[0114] When a drone enters the airspace of outpost j for the first time, Sent to the outpost. The outpost first verifies the signature Legality: If this formula is established, it means that the mission verification information initially provided by the drone is legal, and the subsequent route certification work can continue.

[0115] When outpost j detects that the drone has entered a new unit block When , and verify If the above formula holds, it means that the unit block If the drone is part of the legal route, the outpost will continue to silently monitor the drone's flight path until the drone enters the next unit block.

[0116] If the above formula does not hold, the outpost j calculates and choose a random number ,calculate , the outpost will Send to drone.

[0117] The drone received a message from the outpost. After that, select ,calculate , and

[0118] Send to outpost j.

[0119] Received After that, the outpost j verifies:

[0120]

[0121] If the above formula is verified to be true, it means that the unit block Passed the false positive verification, It is part of the legal route of the drone. Outpost j will continue to monitor the drone's flight path silently until the drone reaches the next unit block.

[0122] The method of the present invention can effectively realize the privacy protection of efficient low-altitude route authentication for drone low-altitude logistics scenarios. In this method: 1. Utilize the BLOOM filter and the concise privacy set intersection protocol to realize efficient low-altitude route authentication. The scheme first uses the BLOOM filter to quickly verify whether the flying drone is in a legal route, and uses the privacy set intersection protocol to quickly verify possible misjudgment results, which greatly reduces the computational overhead and communication overhead of the verification process. 2. Combined with the identity-based signature technology (IBS), the route verification information granted to the drone is signed, which effectively ensures the non-tamperability of the drone route verification information.

[0123] In summary, the present invention proposes a privacy-protected and efficient low-altitude route authentication method, which is particularly suitable for UAV low-altitude logistics scenarios. The method achieves efficient legitimacy verification under the premise of protecting the confidentiality of the complete route information of the UAV through three stages: system initialization, route verification information generation and route verification. By using Bloom filters and privacy set intersection protocols, the present invention greatly reduces the computational overhead and communication overhead of the verification process, and uses identity-based signature technology to ensure the non-tamperability of route verification information. This not only ensures that only UAVs flying on legal routes can pass the verification of the outpost, but also protects the privacy of the UAV route information during the verification process, avoiding the leakage of additional route information to the outpost. In addition, the method fully considers the resource limitations of the UAV, is suitable for situations where UAV resources are limited, effectively solves the problems of computing power and communication resource limitations, improves verification efficiency, and provides a safe, efficient, and privacy-protected solution for route authentication in UAV low-altitude logistics scenarios.

[0124] An embodiment of the present invention further provides a storage medium for storing a computer program, which at least performs the above method when executed.

[0125] An embodiment of the present invention further provides a control device, comprising a processor and a storage medium for storing a computer program; wherein the processor is configured to execute at least the method described above when executing the computer program.

[0126] An embodiment of the present invention further provides a processor, wherein the processor executes a computer program and at least executes the method described above.

[0127] The storage medium can be implemented by any type of non-volatile storage device, or a combination thereof. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a ferromagnetic random access memory (Flash Memory), a magnetic surface memory, an optical disc, or a compact disc read-only memory (CD-ROM); the magnetic surface memory can be a disk memory or a tape memory. The storage medium described in the embodiments of the present invention is intended to include, but is not limited to, these and any other suitable types of memory.

[0128] In the several embodiments provided by the present invention, it should be understood that the disclosed systems and methods can be implemented in other ways. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as: multiple units or components can be combined, or can be integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0129] The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units; some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0130] In addition, all functional units in the embodiments of the present invention may be integrated into one processing unit, or each unit may be separately used as a unit, or two or more units may be integrated into one unit; the above-mentioned integrated units may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0131] A person skilled in the art can understand that: all or part of the steps of implementing the above method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above method embodiment; and the aforementioned storage medium includes: mobile storage devices, read-only memories (ROM, Read-Only Memory), random access memories (RAM, Random Access Memory), disks or optical disks, etc. Various media that can store program codes.

[0132] Alternatively, if the above-mentioned integrated unit of the present invention is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present invention can be essentially or partly reflected in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROM, RAM, magnetic disks or optical disks.

[0133] The methods disclosed in the several method embodiments provided by the present invention can be arbitrarily combined without conflict to obtain new method embodiments.

[0134] The features disclosed in several product embodiments provided by the present invention can be arbitrarily combined without conflict to obtain new product embodiments.

[0135] The features disclosed in several method or device embodiments provided by the present invention can be arbitrarily combined without conflict to obtain new method embodiments or device embodiments.

[0136] The above contents are further detailed descriptions of the present invention in combination with specific preferred embodiments, and it cannot be determined that the specific implementation of the present invention is limited to these descriptions. For those skilled in the art of the present invention, several equivalent substitutions or obvious variations can be made without departing from the concept of the present invention, and the performance or use is the same, which should be regarded as belonging to the protection scope of the present invention.

Claims

1. An efficient low-altitude route authentication method with privacy protection, characterized in that: It includes system initialization phase, route verification information generation phase and route verification phase; The system initialization phase includes: the trusted authority center sets the basic security parameters of the system, including hash functions and bilinear mapping parameters, and initializes the Bloom filter; the trusted authority center and the sentinel are set up to prepare for subsequent data processing; The route verification information generation phase includes: the trusted authority center defines the legal route of the UAV under the airspace of each outpost and generates a Bloom filter; using the Bloom filter to generate corresponding elements and send them to the outpost; The route verification stage includes: the outpost receives the real-time flight data set of the UAV, uses the Bloom filter to filter the elements that do not belong to the legal route, and processes the filtered elements and sends them to the trusted authority center, and the trusted authority center verifies the received elements according to the Bloom filter. If the verification is successful, the corresponding elements are placed in the final legal route set; The system initialization stage specifically includes the following steps: The trusted authority center gives security parameters, calls the parameter generation algorithm to generate the hash function and bilinear mapping parameters required by the system, and randomly selects a number to calculate the system master key; The trusted authority center divides the urban airspace equally into multiple unit blocks, assigns a unique number to each unit block, and then evenly distributes the unit blocks to each outpost for management; The trusted authority selects an array large enough to create a Bloom filter and initializes it to 0 in preparation for subsequent route verification; When the outpost is built and registered, the trusted authority generates the airspace range and private key for it and delivers it to the outpost offline so that the outpost can perform subsequent route verification work; The route verification information generation stage specifically includes the following steps: The trusted authority center defines the legal routes of drones in the airspace of each outpost and generates a set of legal routes. The trusted authority randomly selects a number, calculates and generates a set representing the no-fly zone, which describes the no-fly zone for drones under the outpost airspace; Based on the set of legal routes and the set of no-fly zones, the trusted authority center performs a Bloom filter construction operation to generate a hash function and a bit array; The trusted authority center checks the unit blocks in the legal route set, identifies the false positive blocks that may be misjudged as being in the no-fly zone by the Bloom filter, and records the false positive blocks in a set; The trusted authority generates a polynomial based on the set of false positive blocks and randomly selects an element to generate an element sequence; The trusted authority center uses the master key to generate a signature for the route information to ensure that the route information cannot be tampered with; The trusted authority center distributes the generated route information and signature to the drone so that the drone can use it in the subsequent route verification phase.

2. The privacy-protected and efficient low-altitude route authentication method according to claim 1, characterized in that: The trusted authoritative center is the flight control center.

3. The privacy-protected and efficient low-altitude route authentication method according to claim 1, characterized in that: The route information includes a legal route set, a false positive block set, a Bloom filter, and an element sequence.

4. The privacy-protected, efficient low-altitude route authentication method according to claim 1 or 3, characterized in that: The route verification phase specifically includes the following steps: When a drone enters the outpost’s airspace for the first time, it sends information containing the Bloom filter, element sequence, verification parameters, and signature to the outpost. The outpost first verifies the legitimacy of the signature to confirm that the mission verification information provided by the drone is legitimate. When the outpost detects that the drone enters a new unit block, the outpost calculates a specific value and uses the Bloom filter to verify whether the unit block belongs to the drone’s legal route; if the verification passes, the outpost will continue to monitor the drone’s flight trajectory; If the unit block does not belong to a legal route, the outpost will calculate and send a specific message to the drone, requesting further verification; After receiving the message from the outpost, the drone selects a specific element from the element sequence and calculates the verification value, and then sends the verification value back to the outpost; After receiving the verification value sent by the drone, the outpost performs a final verification; if the verification is successful, it indicates that the unit block has passed the false positive verification and is part of the drone's legal route; the outpost will continue to monitor the drone's flight trajectory until the drone enters the next unit block.

5. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the efficient low-altitude route authentication method with privacy protection as described in any one of claims 1 to 4 is implemented.

6. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the efficient low-altitude route authentication method with privacy protection as described in any one of claims 1 to 4 is implemented.

Images