Unmanned aerial vehicle mobile edge computing security authentication method and system based on identity-based encryption and physical unclonable function

Abstract

The invention discloses an unmanned aerial vehicle mobile edge computing security authentication method and system based on identity-based encryption and a physical unclonable function, and belongs to the field of mobile edge computing and unmanned aerial vehicle communication security. A physical response is generated in combination with PUF hardware of the unmanned aerial vehicle node, the physical response and the ID are bound as a credible voucher, and meanwhile, a derived private key for IBE is generated for the unmanned aerial vehicle node based on the ID; after the unmanned aerial vehicle is networked, the KGC periodically initiates challenge response verification, the unmanned aerial vehicle generates a current response by using PUF hardware and returns the current response, the KGC performs comparison, and if an abnormality occurs, the KGC broadcasts to a full text to isolate an abnormal node; iBE is directly carried out on the basis of the ID of the receiver in communication between the unmanned aerial vehicles, and certificate exchange overhead is avoided. According to the method, lightweight identity authentication, physical attack resistance and efficient key management under dynamic topology are realized, and the method is suitable for unmanned aerial vehicle edge computing scenes with limited resources.

Description

Technical Field

[0001] The present invention relates to the field of mobile edge computing and unmanned aerial vehicle (UAV) communication security, and more specifically, to a UAV mobile edge computing security authentication method and system based on identity-based encryption and physically unclonable functions. Background Art

[0002] With the rapid development of Mobile Edge Computing (MEC) technology, unmanned aerial vehicles (UAVs) are well-suited to serve as edge computing nodes in MEC networks due to their flexible deployment, wide-area coverage, and low cost. UAV swarms can dynamically form networks to provide low-latency, high-bandwidth computing services for remote areas, emergency communications, or IoT scenarios. However, the high mobility of UAV nodes, the dynamic network topology, and the open wireless channel environment in which they operate pose significant security challenges for UAV mobile edge computing applications, particularly regarding identity authentication and key management. Traditional certificate-based public key infrastructure solutions struggle to adapt to the dynamic nature of UAV networks due to the complex processes involved in certificate issuance and revocation. Lightweight protocols based on symmetric keys suffer from inefficient key distribution and updates. Furthermore, as resource-constrained edge nodes, UAVs' limited computing power, storage capacity, and energy consumption further constrain the implementation of complex security protocols.

[0003] In existing research, identity-based encryption (IBE) has been proposed to simplify key management. By directly using user identities (such as drone identifiers) as public keys, it eliminates the overhead of certificate storage and verification. However, IBE schemes typically rely on a trusted third-party key generation center, which can introduce single points of failure or key escrow risks when drones dynamically join or leave the network. On the other hand, the Physical Unclonable Function (PUF), a hardware-level security mechanism, leverages the inherent physical properties of drone chips to generate unclonable responses, providing a natural defense for device authentication. However, existing PUF schemes are mostly designed for static IoT devices and lack deep integration with IBE, resulting in security gaps in identity binding and key update mechanisms. In summary, current security authentication schemes for drone mobile edge computing scenarios still lack deep integration of drone hardware security attributes, making software-layer protocols vulnerable to physical cloning or side-channel attacks. Therefore, there is an urgent need for a new authentication protocol that integrates lightweight cryptography and hardware security features to ensure the trustworthy identity of drone nodes while meeting the needs of mobile edge computing scenarios for low latency, high robustness and resistance to physical attacks. Summary of the Invention

[0004] The purpose of the present invention is to overcome the shortcomings of the existing technology and provide a method and system for secure authentication of unmanned aerial vehicle mobile edge computing based on identity-based encryption and physically unclonable functions. This method integrates identity-based encryption and physically unclonable functions for secure communication and is suitable for networks with unmanned aerial vehicles as edge computing nodes. It can solve the key problems of node identity trusted authentication, lightweight key management and resistance to physical attacks.

[0005] The object of the present invention is achieved through the following solutions:

[0006] A secure authentication method for drone mobile edge computing based on identity-based encryption and physically unclonable functions (PUFs) is proposed. By integrating identity-based encryption (IBE) and physically unclonable functions (PUFs), dual identity binding and dynamic authentication of drone nodes are achieved. The method specifically includes the following steps:

[0007] Step 1, Pre-deployment: The trusted key generation center assigns a unique ID to each drone node and generates a derived key for each drone node based on the ID. The node uses its own hardware containing a physical unclonable function (PUF) to generate a unique physical response, namely the PUF response, using the ID as the stimulus input. The trusted key generation center stores this response and binds it to the ID of each drone node to form a trusted node database.

[0008] Step 2: Dynamic identity authentication: After the drones are networked, the trusted key generation center acts as an edge computing server node, periodically requiring all drone nodes in the network to regenerate PUF responses using their respective IDs as incentives. The nodes encrypt the PUF responses with the identity base and transmit them back to the server node; the server node decrypts them and compares them with the pre-stored responses. If they are inconsistent, the server node broadcasts to the entire network that the node is untrustworthy, triggering the isolation mechanism.

[0009] Furthermore, the method further comprises the steps of:

[0010] Decentralized key management: Communication between drones, responses sent back to server nodes, and broadcasts from server nodes to the entire network are directly based on identity-based encryption. The receiver's ID and public key are used to encrypt data, and the receiver decrypts it using its own derived key.

[0011] Furthermore, in step 1, the trusted key generation center assigns a unique identity ID to each drone node and generates a derived key for each drone node based on the identity ID. The node uses its own hardware containing a physical unclonable function (PUF) to generate a unique physical response, namely a PUF response, using the ID as the stimulus input. The trusted key generation center stores the response and binds it to the ID of each drone node to form a trusted node database, which specifically includes the following sub-steps:

[0012] S11, the trusted key generation center assigns a unique identity ID to each drone node;

[0013] S12, the trusted key generation center generates a master key pair for identity-based encryption based on the security parameter λ;

[0014] S13, the trusted key generation center generates a derived private key for each drone node based on the ID and master key pair;

[0015] S14, the drone node uses its own PUF hardware to take the ID as the stimulus input to obtain the initial response value R and transmit it to the trusted key generation center for storage;

[0016] S15, the trusted key generation center broadcasts the registered legitimate drone node ID to the entire network to assist the drone node in creating a local network trusted node ID list.

[0017] Furthermore, in step 2, after the drones are networked, the trusted key generation center acts as an edge computing server node and periodically requires all drone nodes in the network to regenerate PUF responses using their respective IDs as incentives. The nodes encrypt the PUF responses using the identity base and transmit them back to the server node. The server node decrypts the responses and compares them with the pre-stored responses. If they are inconsistent, the server node broadcasts to the entire network that the node is untrustworthy, triggering an isolation mechanism. This specifically includes the following sub-steps:

[0018] S21, after the drones are networked, the trusted server node periodically broadcasts verification instructions to the drone nodes in the network, requiring all nodes to return the current response value of the PUF hardware;

[0019] S22, the drone node uses the local PUF hardware to obtain the current response value with the identity ID as the stimulus input, and performs IBE on the response value through the server node's ID and master public key and transmits it back;

[0020] S23, after receiving and decrypting the current response value, the server node compares it with the pre-stored initial response value and performs subsequent processing.

[0021] Furthermore, the communication between drones, the response sent back by the drone to the server node, and the broadcasting of the server node to the entire network are directly based on identity-based encryption, using the recipient's ID and public key to encrypt data, and the recipient decrypts it using its own derived key, and further includes the following sub-steps:

[0022] When a drone node sends a message to another node, it needs to check whether the ID of the other node is in the local network trusted node ID list;

[0023] After a drone node receives a message sent between other nodes and decrypts the ID of the other node, it needs to check whether this ID is in the local network trusted node ID list.

[0024] Furthermore, in step S23, after receiving and decrypting the current response value, the server node compares it with the pre-stored initial response value and performs subsequent processing, which specifically includes the following sub-steps:

[0025] S231, if the trusted server node finds that the current response value returned by a certain drone node is different from the initial response value, it marks the node as invalid in the trusted database and broadcasts the abnormal state of the node to all nodes in the network;

[0026] S232, after receiving the broadcast containing the abnormal node information, the trusted drone node in the network deletes the ID of the abnormal node from the local network trusted node ID list.

[0027] Furthermore, the trusted node database includes the identity ID of the trusted node, the initial response R of the drone PUF hardware to its ID, and the i and the derived key SK i Three fields.

[0028] Furthermore, all drone nodes build and maintain a network trusted node A list used to record the identities of nodes that can communicate normally.

[0029] Furthermore, the local network trusted node ID list of the drone node is used to adapt to the dynamic nature of frequent node entry or exit in the mobile edge computing scenario.

[0030] A secure authentication system for UAV mobile edge computing based on identity-based encryption and physically unclonable functions, including:

[0031] The pre-deployment module is used to enable the trusted key generation center to assign a unique identity ID to each drone node and generate a derived key for each drone node based on the identity ID. The node uses its own hardware containing a physical unclonable function (PUF) to generate a unique physical response, namely the PUF response, using the ID as the stimulus input. The trusted key generation center stores the response and binds it to the ID of each drone node to form a trusted node database.

[0032] The dynamic identity authentication module is used when the drones are networked. The trusted key generation center acts as an edge computing server node and periodically requires all drone nodes in the network to regenerate PUF responses using their respective IDs as incentives. The nodes encrypt the PUF responses with the identity base and transmit them back to the server node. The server node decrypts them and compares them with the pre-stored responses. If they are inconsistent, the server broadcasts to the entire network that the node is untrustworthy, triggering the isolation mechanism.

[0033] The decentralized key management module is used to enable communication between drones, drones sending responses back to server nodes, and server nodes broadcasting to the entire network directly based on identity-based encryption. The data is encrypted using the receiver's ID and public key, and the receiver decrypts it using its own derived key.

[0034] The beneficial effects of the present invention include:

[0035] (1) Anti-physical attack: The present invention uses the drone ID as both the incentive of the physical unclonable function and part of the identity-based encryption component, thereby achieving dual binding of hardware security attributes and cryptographic identity, preventing drone identity forgery or physical cloning attacks.

[0036] (2) Dynamic adaptability: The dynamic response authentication mechanism proposed in this invention can detect abnormal node behavior in real time, and the trusted key generation center periodic authentication and blacklist broadcast mechanism can adapt to the scenario where drones frequently join and exit.

[0037] (3) Low communication overhead: The present invention uses identity-based encryption to implement certificateless lightweight key management, adapting to the resource-constrained characteristics of drones, and quickly revoking and updating identities under dynamic network topologies. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0039] Figure 1 This is an example diagram of a typical drone mobile edge computing scenario and threat model;

[0040] Figure 2 This is a flow chart of the identity-based encryption module in an embodiment of the present invention;

[0041] Figure 3 Schematic diagram of the pre-deployment phase and the dynamic verification phase in an embodiment of the present invention;

[0042] Figure 4This is a flow chart of the exception handling module in an embodiment of the present invention. DETAILED DESCRIPTION

[0043] All features disclosed in all embodiments in this specification, or steps in all methods or processes implicitly disclosed, except for mutually exclusive features and / or steps, can be combined and / or expanded or replaced in any manner.

[0044] The present invention aims to at least solve the problems of trusted authentication of node identities, lightweight key management, and resistance to physical attacks in dynamic UAV networks. By integrating identity-based encryption and physical unclonable functions, the present invention provides an innovative solution to monitor the security of nodes in the network in real time while maintaining confidential communication between nodes. Specifically, refer to Figure 1 , Figure 1 This paper demonstrates a typical drone-based mobile edge computing scenario, where drones can act as edge computing nodes in dynamic mobile networks. However, attackers use complex, multi-stage, multi-technique methods to infiltrate target drone nodes, eavesdrop on network communications, and collect sensitive information. Furthermore, because drone networks operate in open wireless channels, explicitly transmitting information within the network is extremely dangerous, requiring data to be transmitted only in ciphertext. Because the frequent certificate exchange and revocation operations of traditional public key infrastructure place significant overhead on edge nodes, identity-based encryption (IBE) is used in networks with limited end-node resources.

[0045] In a preferred embodiment, a secure authentication method for mobile edge computing (MEC) using identity-based encryption (IBE) and a physical unclonable function (PUF) is proposed. To address the challenges of identity forgery, physical cloning attacks, and complex key management in dynamic UAV networking scenarios, this method innovatively integrates IBE and PUF to create a layered authentication mechanism for ensuring secure communications in MEC networks. The mechanism primarily includes the following steps: During the pre-deployment phase, a trusted key generation center (KGC) assigns a unique ID to each UAV node. Using its PUF hardware, a physical response is generated and bound to the ID as a trusted credential. Furthermore, a derived private key for IBE is generated for the UAV node based on the ID. After the UAVs are networked, the KGC periodically initiates challenge-response verification. The UAVs use their PUF hardware to generate the current response and transmit it back. The KGC compares the response and, if an anomaly is detected, broadcasts the response to the entire network to isolate the anomalous node. Inter-UAV communication directly utilizes the recipient's ID for IBE, avoiding certificate exchange overhead. This embodiment achieves lightweight identity authentication, resistance to physical attacks, and efficient key management under dynamic topology through the dual binding of hardware security and cryptographic identity, and is suitable for resource-constrained drone edge computing scenarios.

[0046] In another preferred embodiment, a UAV mobile edge computing security authentication system based on identity-based encryption and physically unclonable functions is provided, comprising:

[0047] The pre-deployment module is used to enable the trusted key generation center to assign a unique identity ID to each drone node and generate a derived key for each drone node based on the identity ID. The node uses its own hardware containing a physical unclonable function (PUF) to generate a unique physical response, namely the PUF response, using the ID as the stimulus input. The trusted key generation center stores the response and binds it to the ID of each drone node to form a trusted node database.

[0048] The dynamic identity authentication module is used when the drones are networked. The trusted key generation center acts as an edge computing server node and periodically requires all drone nodes in the network to regenerate PUF responses using their respective IDs as incentives. The nodes encrypt the PUF responses with the identity base and transmit them back to the server node. The server node decrypts them and compares them with the pre-stored responses. If they are inconsistent, the server broadcasts to the entire network that the node is untrustworthy, triggering the isolation mechanism.

[0049] The decentralized key management module is used to enable communication between drones, drones sending responses back to server nodes, and server nodes broadcasting to the entire network directly based on identity-based encryption. The data is encrypted using the receiver's ID and public key, and the receiver decrypts it using its own derived key.

[0050] In other embodiments, based on any of the above embodiments, a drone mobile edge computing security authentication system based on identity-based encryption and physically unclonable functions is provided, which specifically includes the following three modules:

[0051] (1) Identity-based encryption module based on pairing groups. Figure 2 The identity-based encryption module is used for communication between drone edge nodes and between drone edge nodes and trusted server nodes after drone nodes are networked. Its main function is to encrypt data in network communications, preventing attackers from eavesdropping and exploiting it for other attacks (such as model inversion attacks and data reconstruction attacks). The specific implementation steps are as follows:

[0052] Step 1: Key generation and private key derivation. Key generation and private key derivation occur during the system initialization and node pre-registration phase (before drone nodes are networked). They mainly generate a master key pair for the entire network and a derived private key for each node (including trusted server nodes).

[0053] The trusted key generation center (which will serve as a trusted server node later) randomly selects a pairing group G, G according to the security parameter λ. T And the pairing operation e:G×G→G T , randomly select group G,G T The generator g,g T Then uniformly select s←Z p , calculate h: =g s ∈G. Master public key PK=(G,G T ,g,g T ,e,h), master private key SK=s.

[0054] Next, according to the unique identity ID of each node i (including drone edge nodes and trusted server nodes), i Generate a derived private key for each node, where the identity space is {0,1} * The derived private key SK of the i-th node i =HF(ID i ) s , where the hash function HF:{0,1} * →G.

[0055] Step 2: Encryption. When a node i in the UAV network sends a message to node j, the encryption algorithm is called. The message space in the network is defined as GT , that is, the message M∈G that node i wants to send T Node i first uniformly selects r←Z p , calculate C1: =g r ∈G, calculate C2: =e(h,HF(ID j )) r M∈G T . Obtain the ciphertext group C: = (C1, C2).

[0056] Step 3: Decryption. When node j receives the ciphertext group C = (C1, C2) sent by node i, it calls the decryption algorithm. Node j uses its own derived private key SK j Restore the message M': =C2 / e(C1,SK j ).

[0057] Step 4: Correctness analysis. Message recovered by node j Therefore, according to the pairing property of the pairing group, the message recovered by node j is the original message sent by node i.

[0058] (2) System initialization and node pre-registration module. Figure 3 This module is used before drones are networked. It mainly generates the master key pair required for identity-based encryption, the derived keys of each node, and registers drone nodes on the trusted server. This module works in an absolutely secure environment. The specific implementation steps are as follows:

[0059] Step 1: Generate the keys for identity-based encryption. The trusted key generation center generates the master key pair in the network and the derived private key of each node.

[0060] Step 2: Pre-registration of drone nodes. The trusted key generation center assigns a globally unique ID (hardware serial number or address-based hash function generation) to each drone node and sends all IDs to all drone nodes through a secure channel (such as physical contact).

[0061] After receiving the IDs of all nodes, drone node i stores the IDs of other nodes and sets its own identity ID I As the stimulus input to the PUF hardware, an initial response R is generated. i :=puf i (ID i ) and pass the key-value pair (ID i ,R i ) is sent to the trusted key generation center. After receiving the key-value pair and verifying the legitimacy of the ID contained therein, the trusted key generation center stores the corresponding initial response.

[0062] Step 3: Construct the trusted database and the network trusted node ID list. After the trusted key generation center generates derived keys for all nodes and records the initial response values ​​of all legitimate nodes, it will construct a trusted database that contains the following fields: i (globally unique), the initial response R of the drone’s PUF hardware to its ID i and the derived key SK i In addition, each drone node locally builds and maintains a list of trusted network node IDs, recording only the identity IDs of secure nodes in the network. During communication, the trusted server node broadcasts the list of trusted network node IDs for each drone node to accommodate the dynamic nature of drone node entry and exit mechanisms in the mobile edge computing network.

[0063] (3) Dynamic identity authentication and exception handling module. The dynamic identity authentication and exception handling module works during the formal communication process after the UAV network is established. Together with the pairing-based identity-based encryption, it ensures secure communication in the mobile edge computing network and meets the needs of the mobile edge computing scenario for high robustness and resistance to physical attacks.

[0064] Step 1: Periodic challenge-response verification. Figure 3 The trusted server node initiates verification at fixed time intervals T or events (such as drone nodes joining or leaving the network). Specifically, the trusted server node broadcasts verification instructions to the entire network, requiring all drone nodes to participate in the verification process.

[0065] After receiving the verification challenge (Challenge), a drone node i uses its own identity ID i As the stimulus input, the current response value R′ is generated by the local PUF hardware i :=puf i (ID i ). Then, the node uses the master public key and the identity ID of the server node s Encrypt the current response value to obtain ciphertext C i :=Enc(PK,ID s ,R′ i ), and sends the ciphertext to the server, where Enc is an identity-based encryption algorithm based on the pairing group.

[0066] After receiving the ciphertext response from node i, the trusted server node first uses its own derived private key to obtain the plaintext response R′ i =Dec(SK s ,C i Then, it is compared with the key-value pair (ID i ,Ri ) to determine whether node i is still a trusted node.

[0067] Step 2: Exception handling and network trusted node ID list maintenance. Figure 4 If, during the periodic challenge-response phase, the trusted server node discovers that a node's current response differs from its pre-stored response value, it indicates that the node has experienced an anomaly. (Any active attack against the PUF, such as an invasive physical attack, will alter the hardware structure of the PUF device and the electrical environment during operation, thereby changing the PUF's mapping method and generating a different response.) At this point, the trusted server node broadcasts a message to the entire network stating that the node is no longer trusted. Upon receiving this message, other trusted nodes remove the untrusted node from their local list of trusted node IDs.

[0068] Step 3: Secure communication between drone nodes and network trusted node ID list. When a node needs to send a message to node i, it will first check the identity ID of node i. i Is it in the local network trusted node ID list. If it exists, the normal communication process will proceed, otherwise, the communication process will be terminated. Similarly, a node receives a message and obtains the identity ID of the message source node after decryption. i After that (need to decrypt to get), first check the ID i Checks whether the node exists in the local network trusted node ID list. If not, the message will be discarded.

[0069] The units involved in the embodiments of the present invention may be implemented in software or hardware, and the units described may also be provided in a processor. In some cases, the names of these units do not limit the units themselves.

[0070] According to one aspect of an embodiment of the present invention, a computer program product or computer program is provided, comprising computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the methods provided in the various optional implementations described above.

[0071] As another aspect, embodiments of the present invention further provide a computer-readable medium, which may be included in the electronic device described in the above embodiments, or may exist independently and not incorporated into the electronic device. The computer-readable medium carries one or more programs, and when executed by the electronic device, the electronic device implements the methods described in the above embodiments.

Claims

1. A secure authentication method for UAV mobile edge computing based on identity-based encryption and physically unclonable functions, characterized by: By integrating identity-based encryption (IBE) and physical unclonable function (PUF), dual identity binding and dynamic authentication of drone nodes are achieved. The specific steps include: Step 1, Pre-deployment: The trusted key generation center assigns a unique ID to each drone node and generates a derived key for each drone node based on the ID. The node uses its own hardware containing a physical unclonable function (PUF) to generate a unique physical response, namely the PUF response, using the ID as the stimulus input. The trusted key generation center stores this response and binds it to the ID of each drone node to form a trusted node database. Step 2: Dynamic identity authentication: After the drones are networked, the trusted key generation center acts as an edge computing server node, periodically requiring all drone nodes in the network to regenerate PUF responses using their respective IDs as incentives. The nodes encrypt the PUF responses with the identity base and transmit them back to the server node; the server node decrypts them and compares them with the pre-stored responses. If they are inconsistent, the server node broadcasts to the entire network that the node is untrustworthy, triggering the isolation mechanism.

2. The method for secure authentication of UAV mobile edge computing based on identity-based encryption and physically unclonable functions according to claim 1 is characterized in that: Also includes the steps: Decentralized key management: Communication between drones, responses sent back to server nodes, and broadcasts from server nodes to the entire network are directly based on identity-based encryption. The receiver's ID and public key are used to encrypt data, and the receiver decrypts it using its own derived key.

3. The method for secure authentication of UAV mobile edge computing based on identity-based encryption and physically unclonable functions according to claim 2 is characterized in that: In step 1, the trusted key generation center assigns a unique identity ID to each drone node and generates a derived key for each drone node based on the identity ID. The node uses its own hardware containing a physical unclonable function (PUF) to generate a unique physical response, namely the PUF response, using the ID as the stimulus input. The trusted key generation center stores the response and binds it to the ID of each drone node to form a trusted node database. The specific sub-steps include the following: S11, the trusted key generation center assigns a unique identity ID to each drone node; S12, the trusted key generation center generates a master key pair for identity-based encryption based on the security parameter λ; S13, the trusted key generation center generates a derived private key for each drone node based on the ID and master key pair; S14, the drone node uses its own PUF hardware to take the ID as the stimulus input to obtain the initial response value R and transmit it to the trusted key generation center for storage; S15, the trusted key generation center broadcasts the registered legitimate drone node R to the entire network to assist the drone node in creating a local network trusted node ID list.

4. The method for secure authentication of UAV mobile edge computing based on identity-based encryption and physically unclonable functions according to claim 1, characterized in that: In step 2, after the drones are networked, the trusted key generation center acts as an edge computing server node and periodically requires all drone nodes in the network to regenerate PUF responses using their respective IDs as incentives. The nodes encrypt the PUF responses using the identity base and transmit them back to the server node. The server node decrypts the responses and compares them with the pre-stored responses. If they are inconsistent, the server node broadcasts to the entire network that the node is untrustworthy, triggering the isolation mechanism. This specifically includes the following sub-steps: S21, after the drones are networked, the trusted server node periodically broadcasts verification instructions to the drone nodes in the network, requiring all nodes to return the current response value of the PUF hardware; S22, the drone node uses the local PUF hardware to get the current response value with the identity ID as the stimulus input. The response value is IBE-ed using the server node’s ID and master public key and sent back; S23, after receiving and decrypting the current response value, the server node compares it with the pre-stored initial response value and performs subsequent processing.

5. The method for secure authentication of UAV mobile edge computing based on identity-based encryption and physically unclonable functions according to claim 3 is characterized in that: The communication between drones, the response sent back by drones to the server node, and the broadcasting of the server node to the entire network are directly based on identity-based encryption, using the recipient's ID and public key to encrypt data, and the recipient decrypts it using its own derived key, and also includes the following sub-steps: When a drone node sends a message to another node, it needs to check whether the ID of the other node is in the local network trusted node ID list; After a drone node receives a message sent between other nodes and decrypts the ID of the other node, it needs to check whether this ID is in the local network trusted node ID list.

6. The method for secure authentication of UAV mobile edge computing based on identity-based encryption and physically unclonable functions according to claim 4 is characterized in that: In step S23, after receiving and decrypting the current response value, the server node compares it with the pre-stored initial response value and performs subsequent processing, which specifically includes the following sub-steps: S231, if the trusted server node finds that the current response value returned by a certain drone node is different from the initial response value, it marks the node as invalid in the trusted database and broadcasts the abnormal state of the node to all nodes in the network; S232, after receiving the broadcast containing the abnormal node information, the trusted drone node in the network deletes the ID of the abnormal node from the local network trusted node ID list.

7. The method for secure authentication of UAV mobile edge computing based on identity-based encryption and physically unclonable functions according to claim 1, characterized in that: The trusted node database includes the identity ID of the trusted node, the initial response R of the drone PUF hardware to its ID i and the derived key SK i Three fields.

8. The method for secure authentication of UAV mobile edge computing based on identity-based encryption and physically unclonable functions according to claim 1, characterized in that: All drone nodes build and maintain a network trusted node ID list to record the identities of nodes that can communicate normally.

9. The method for secure authentication of UAV mobile edge computing based on identity-based encryption and physically unclonable functions according to claim 8, characterized in that: The local network trusted node ID list of the drone node is used to adapt to the dynamic nature of frequent node entry or exit in mobile edge computing scenarios.

10. A UAV mobile edge computing security authentication system based on identity-based encryption and physically unclonable functions, characterized by: include: The pre-deployment module is used to enable the trusted key generation center to assign a unique identity ID to each drone node and generate a derived key for each drone node based on the identity ID. The node uses its own hardware containing a physical unclonable function (PUF) to generate a unique physical response, namely the PUF response, using the ID as the stimulus input. The trusted key generation center stores the response and binds it to the ID of each drone node to form a trusted node database. The dynamic identity authentication module is used to generate PUF responses after the drones are networked. The trusted key generation center acts as an edge computing server node and periodically requires all drone nodes in the network to regenerate PUF responses using their respective IDs as incentives. The nodes encrypt the PUF responses with the identity base and transmit them back to the server node. The server node decrypts it and compares it with the pre-stored response. If there is any inconsistency, it broadcasts to the entire network that the node is untrustworthy, triggering the isolation mechanism. The decentralized key management module is used to enable communication between drones, drones sending responses back to server nodes, and server nodes broadcasting to the entire network directly based on identity-based encryption. The data is encrypted using the receiver's ID and public key, and the receiver decrypts it using its own derived key.

Images