Low-delay identification friend or foe verification method based on real-time identification public key calculation

Abstract

The invention relates to a low-delay identification friend or foe verification method based on real-time identification public key calculation, and belongs to the technical field of identity authentication and identification friend or foe. According to the method, an identification device locally calculates an identification public key in real time, a signature is generated in combination with a random number, an identification number and a task context, and identity authentication is completed through data packet transmission. A receiving end identification device does not need to depend on a central system, and performs signature verification by analyzing a data packet and calculating a public key, so as to judge a target attribute. The method supports a plurality of encryption algorithms, is compatible with symmetric and asymmetric mechanisms, and is suitable for complex combat scenes such as distributed, broken links and unmanned formation. Compared with a traditional identification mode depending on central control or a preset key, the method has the characteristics of decentralization, autonomous calculation, high security, quick response and the like, and the deployment flexibility, combat survivability and adaptive capacity of the system are improved.

Description

Technical Field

[0001] This invention belongs to the field of identity authentication and friend-or-foe identification technology, and relates to a low-latency friend-or-foe identification verification method based on real-time identifier public key calculation. Background Technology

[0002] With the development of information warfare, unmanned combat platforms and intelligent terminals have been widely used in multi-domain battlefields, including air, ground, and sea. The coordination, autonomous mission execution, and rapid response capabilities among unmanned platforms place higher demands on identification systems. Especially in tactical-level network environments, platforms need to achieve rapid and reliable friend-or-foe identification in the absence of central control.

[0003] Existing IFF (Identification Friend or Foe) systems typically employ a centralized architecture, relying on ground command centers or remote key servers to uniformly manage identity verification and key authentication. This approach has significant limitations: firstly, communication link interruptions or delays can lead to identification failures or even misjudgments; secondly, some solutions use pre-configured public keys for identity verification, which pose system-level security risks should these keys be leaked. Furthermore, in operational scenarios involving distributed networking and autonomous cluster identification, the response speed of traditional architectures is insufficient to meet the demands of dynamic and rapid identification.

[0004] Currently, some authentication methods attempt to introduce digital signature mechanisms, using identity key pairs for identification. However, they still rely on key distribution and centralized scheduling. Especially in areas where the enemy is strong and we are weak, where the network is extremely unstable, or where communication is restricted, it is impossible to rely on a central system to dynamically distribute keys or authentication parameters, making the system difficult to use in actual combat.

[0005] Therefore, there is an urgent need for a friend-or-foe identification verification method that is decentralized, supports real-time identifier computation, signature self-verification, and has extremely low latency, in order to meet the requirements of rapid identification, secure response, and independent system operation under modern high-mobility and high-confrontation conditions. Summary of the Invention

[0006] In view of this, the purpose of the present invention is to provide a low-latency friend-or-foe identification verification method based on real-time identifier public key calculation.

[0007] To achieve the above objectives, the present invention provides the following technical solution:

[0008] A low-latency friend-or-foe identification verification method based on real-time identifier public key computation includes the following steps:

[0009] S1: The identification device assigns a unique identifier ID to each communication unit and stores the corresponding private key TID. pri Stored in the device, configured to calculate the identifier public key TID based on the identifier number. pubThe algorithm logic, where: ID represents the unique identification number of the identification device; TID pri This indicates the private key, used only for local signing; TID pub This indicates the identifier's public key, which is generated in real-time based on the ID.

[0010] S2: The initiator constructs an identification data packet based on the current task. req This includes the random number Rand, the identifier ID, the task context parameter CTX, and the signature field Sig, where:

[0011]

[0012] Rand is a one-time random number used to prevent replay; CTX is the current task context parameter used to bind task information; ||·|| indicates a concatenation operation; This indicates a function that uses the identifier's private key for signing;

[0013] S3: After receiving the data packet, the receiving end identification device generates a TID based on the received ID using a local algorithm. pub Use the following formula for signature verification:

[0014]

[0015] in This indicates a function that uses the identifier's public key for verification;

[0016] S4: If the verification result is true, the identity of the initiator is confirmed to be valid and it is determined to be our target; otherwise, it is considered not our target.

[0017] Furthermore, the identifier public key TID pub The generation is based on a preset algorithm model, which includes hash function mapping, linear operation mapping, or symmetric encryption derivation algorithm, and is used to generate TID from local identifier ID in real time without relying on a key server. pub .

[0018] Furthermore, the signature function With verification function The encryption algorithm used has a configurable structure and supports at least one of the following algorithms:

[0019] National commercial cryptographic algorithms, including SM2 and SM4;

[0020] International standard algorithms, including RSA and Elliptic Curve Cryptography (ECC);

[0021] User-defined symmetric or asymmetric key algorithms, wherein the algorithms must satisfy the encryption characteristics of separable keys and verifiable signatures.

[0022] Furthermore, the context parameter CTX includes at least two of the following:

[0023] Current task number;

[0024] Timestamp information;

[0025] Area code;

[0026] Initiator identity category;

[0027] The purpose of CTX is to limit the recognition request to take effect in a specific task context and to enhance the integrity and unforgeability of the recognition information.

[0028] Furthermore, the identification data packet req The structure is as follows:

[0029] Packet req ={Rand,ID,CTX,Sig}

[0030] The transmission length of the data packet is limited to the range allowed by the communication protocol to ensure fast transmission and identification efficiency.

[0031] Furthermore, in S1 to S3, each identification step is completed independently by the identification device locally, including data splicing, signature generation, identification data packet construction, identification public key generation and signature verification. The end-to-end processing latency of the identification process is less than the preset maximum response time to meet the real-time identification requirements in highly dynamic or highly mobile scenarios.

[0032] Furthermore, the method adopts a decentralized architecture, and the identification process does not rely on a central control node, broadcast base station or remote key server. All authentication operations are completed through point-to-point interaction between identification devices, which is applicable to distributed combat scenarios including but not limited to tactical networking, unmanned equipment formation, autonomous cluster identification, and edge communication disconnection.

[0033] Furthermore, the identification device includes the following modules:

[0034] The identifier management module is used to store the identifier ID and the private key TID. pri ;

[0035] The public key calculation module is used to generate TIDs in real time based on IDs. pub ;

[0036] The signature generation module is used to sign the concatenated content of Rand, ID, and CTX.

[0037] The verification logic module is used to receive identification data packets, call the public key calculation module to generate verification keys, and complete signature verification.

[0038] Specifically, the identifier management module provides an ID to the public key calculation module and a TID to the signature generation module. pri The signature generation module outputs a signature result, which, together with the original fields, forms the identification data packet; the receiving end's verification logic module calls the public key calculation module to generate a TID. pub The data is then input into the verification function to complete the identity authentication.

[0039] The beneficial effects of this invention are as follows:

[0040] (1) The present invention calculates the identifier public key locally in real time by the identification device, replacing the traditional method of pre-setting the public key, which significantly reduces the risk of key leakage and improves the security and dynamic adaptability of identity authentication.

[0041] (2) The present invention adopts a decentralized identification architecture, and the identification process is completed point-to-point by the identification device, which gets rid of the dependence on central servers, broadcast nodes or key distribution systems and adapts to complex battlefield environments with unstable or completely disconnected communication.

[0042] (3) The entire identification process of this invention is completed locally without external query or remote call. The identification response is efficient and rapid, which can meet the timeliness requirements of high-speed mobile equipment and real-time combat systems.

[0043] (4) This invention supports a variety of encryption algorithms, has high algorithm compatibility and configurability, and can flexibly select algorithm structures according to different combat requirements, security levels and platform capabilities, thereby improving the system's versatility and cross-platform deployment capabilities.

[0044] (5) The present invention introduces a task context binding mechanism, which strongly correlates the identification results with specific tasks, time, region and other parameters, effectively preventing the forgery or forwarding of data packets and improving the credibility and accuracy of the identification behavior.

[0045] Other advantages, objectives, and features of the invention will be set forth in part in the description which follows, and in part will be apparent to those skilled in the art from the following examination, or may be learned from practice of the invention. The objectives and other advantages of the invention can be realized and obtained through the following description. Attached Figure Description

[0046] To make the objectives, technical solutions, and advantages of the present invention clearer, the preferred embodiments of the present invention will be described in detail below with reference to the accompanying drawings, wherein:

[0047] Figure 1 This is a schematic diagram of the end-to-end deployment structure of the identification method of the present invention;

[0048] Figure 2This is a schematic diagram of the system deployment structure of the system center for multiple identification terminals in the identification method of the present invention;

[0049] Figure 3 A schematic diagram illustrating the construction process for identifying data packets;

[0050] Figure 4 This is a flowchart of the verification process at the receiving end.

[0051] Figure 5 This is a schematic diagram of the module structure of the identification device;

[0052] Figure 6 This is a schematic diagram of distributed recognition and interaction applicable to unmanned platform formations. Detailed Implementation

[0053] The following specific examples illustrate the implementation of the present invention. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and various details in this specification can be modified or changed based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the illustrations provided in the following embodiments are only schematic representations of the basic concept of the present invention. Unless otherwise specified, the following embodiments and features can be combined with each other.

[0054] The accompanying drawings are for illustrative purposes only and are schematic diagrams, not actual pictures. They should not be construed as limiting the invention. To better illustrate the embodiments of the invention, some parts in the drawings may be omitted, enlarged, or reduced, and do not represent the actual product dimensions. It is understandable to those skilled in the art that some well-known structures and their descriptions may be omitted in the drawings.

[0055] In the accompanying drawings of the embodiments of the present invention, the same or similar reference numerals correspond to the same or similar components. In the description of the present invention, it should be understood that if terms such as "upper," "lower," "left," "right," "front," and "rear" indicate the orientation or positional relationship based on the orientation or positional relationship shown in the drawings, they are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, the terms used to describe positional relationships in the drawings are only for illustrative purposes and should not be construed as limiting the present invention. For those skilled in the art, the specific meaning of the above terms can be understood according to the specific circumstances.

[0056] Figure 1 This is a schematic diagram of the system deployment structure of the identification method of the present invention, showing a scenario in which multiple identification devices communicate and authenticate identities under conditions without central control.

[0057] Figure 2 The diagram illustrates a decentralized system architecture with a central node controlling multiple identification terminals. The central node is capable of initiating identification requests and broadcasting identification operations to multiple terminals. Each terminal possesses local computation and independent verification capabilities. The entire system does not rely on a unified control server and supports multi-node point-to-point communication.

[0058] Figure 3 The diagram illustrates the construction process of the identification data packet, showing the constituent fields of the data packet constructed by the initiator and the processing steps for generating the signature.

[0059] Figure 4 The flowchart for the verification process at the receiving end illustrates how the identification device parses fields, calculates the identifier public key, and performs signature verification after receiving the identification data packet.

[0060] Figure 5 The diagram shows the modular structure of the identification device, illustrating the connection relationships and data flow between the identification management module, public key calculation module, signature generation module, and verification logic module within the device.

[0061] Figure 6 This is a schematic diagram of distributed identification interaction suitable for unmanned platform formations, illustrating the point-to-point identification broadcasting and mutual authentication method between multiple identification devices.

[0062] Example 1: Dual-machine end-to-end real-time identification process

[0063] This embodiment is applicable to rapid friend-or-foe verification between two unmanned platforms with autonomous identification capabilities, without relying on a command center or remote server.

[0064] S11: Identification Configuration

[0065] Each identification device is assigned a unique identifier, called the device number, during system initialization, and the corresponding identifier's private key is securely stored locally. Simultaneously, the system has a pre-built identifier public key calculation algorithm that can calculate the corresponding identifier public key locally in real time based on the device number.

[0066] S12: Data Packet Construction

[0067] When identification is required, the initiating end generates a random number and collects current task context information, such as the current task number, timestamp, and region code. The initiating end concatenates the random number, device number, and context information into a data segment, signs it using a local identifier private key, and obtains a signature field. Subsequently, the initiating end sends the identification data packet, composed of the random number, device number, context information, and signature, to the target identification device.

[0068] S13: Data Packet Reception and Verification

[0069] After receiving the identification data packet, the receiving end extracts the device ID, random number, and context information, and calls the local public key calculation module to generate the initiator's identifier public key based on the device ID. Then, it uses this public key to verify the received signature. If the verification passes, the recipient is confirmed as a legitimate entity; if the verification fails, the recipient is determined to be an unauthorized target.

[0070] S14: Process the response

[0071] Based on the verification results, the receiving end can perform further control actions, such as establishing communication, allowing access, or conducting joint operations.

[0072] This embodiment demonstrates a typical process of the method of the present invention in point-to-point identification, fully reflecting its characteristics of decentralization, autonomous computation and rapid response.

[0073] Example 2: Multi-platform distributed formation recognition process

[0074] This embodiment is applicable to the identification and mutual recognition within an autonomous combat formation composed of multiple unmanned platforms, used to form a trusted internal network.

[0075] S21: Node Deployment

[0076] Each unmanned platform in the formation is assigned a unique identification number before leaving the factory or being deployed, and a private key matching the number is written to it. Each platform has the identification device structure described in the method of this invention, which can independently calculate the public key and complete the verification.

[0077] S22: Cruise Identification Request

[0078] During flight or combat, each platform periodically broadcasts an identification request to other platforms in the formation. The identification request data packet contains a random number, the platform's serial number, current combat mission information, and a signature field. The signature is generated by concatenating the aforementioned fields using the platform's private key.

[0079] S23: Multi-node verification response

[0080] Upon receiving the request, each node extracts the device ID, calculates the public key identifying the requester, and verifies the signature. If the verification is valid, it is marked as a trusted platform. Each platform maintains a local list of trusted platforms for subsequent collaborative decision-making.

[0081] S24: Identify synchronization and redundancy mechanisms

[0082] Considering that some nodes may be unable to receive requests due to signal obstruction, the system supports multi-round broadcasting, identity caching, and partial timeout mechanisms to ensure that most platforms can still independently identify other members under disconnection conditions, thereby enhancing the robustness of the formation.

[0083] This embodiment demonstrates the practicality and flexibility of the present invention in unmanned formation and autonomous cluster recognition.

[0084] Example 3: Identification and Verification Process in High-Interference Environments

[0085] This embodiment is applicable to complex electromagnetic interference areas or mission-level link interruption environments, where the combat platform completes rapid identity verification through minimal communication interaction.

[0086] S31: One-way data delivery

[0087] In a non-interactive communication environment, the initiating end only sends identification data packets to the receiving end without requiring a response from the receiving end. The data packet construction method is the same as in Example 1.

[0088] S32: Local Fast Validation

[0089] The receiving end immediately performs identification public key calculation and signature verification operations based solely on the received data packet. If the verification is successful, the initiating target is added to the short-term trusted target pool for reference in subsequent operational logic.

[0090] S33: De-responsive strategy

[0091] This mode does not require feedback of results to the initiating end, and is suitable for scenarios such as channel congestion, strong anti-interference, and link discontinuity, ensuring that the system still has a minimum identification capability under passive conditions.

[0092] This embodiment further demonstrates the advantages of the present invention in applications under conditions of anti-interference, low interaction, and ad hoc decision-making.

[0093] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A low-latency friend-or-foe identification verification method based on real-time identifier public key computation, characterized in that: Includes the following steps: S1: The identification device assigns a unique identifier ID to each communication unit and stores the corresponding private key TID. pri Stored in the device, configured to calculate the identifier public key TID based on the identifier number. pub The algorithm logic, where: ID represents the unique identification number of the identification device; TID pri This indicates the private key, used only for local signing; TID pub This indicates the identifier's public key, which is generated in real-time based on the ID. S2: The initiator constructs an identification data packet based on the current task. req This includes the random number Rand, the identifier ID, the task context parameter CTX, and the signature field Sig, where: Rand is a one-time random number used to prevent replay; CTX is the current task context parameter used to bind task information; ||·|| indicates a concatenation operation; This indicates a function that uses the identifier's private key for signing; S3: After receiving the data packet, the receiving end identification device generates a TID based on the received ID using a local algorithm. pub Use the following formula for signature verification: in This indicates a function that uses the identifier's public key for verification; S4: If the verification result is true, the identity of the initiator is confirmed to be valid and it is determined to be our target; otherwise, it is considered not our target.

2. The low-latency friend-or-foe identification verification method based on real-time identifier public key computation according to claim 1, characterized in that: The public key TID pub The generation is based on a preset algorithm model, which includes hash function mapping, linear operation mapping, or symmetric encryption derivation algorithm, and is used to generate TID from local identifier ID in real time without relying on a key server. pub .

3. The low-latency friend-or-foe identification verification method based on real-time identifier public key computation according to claim 1, characterized in that: The signature function With verification function The encryption algorithm used has a configurable structure and supports at least one of the following algorithms: National commercial cryptographic algorithms, including SM2 and SM4; International standard algorithms, including RSA and Elliptic Curve Cryptography (ECC); User-defined symmetric or asymmetric key algorithms, wherein the algorithms must satisfy the encryption characteristics of separable keys and verifiable signatures.

4. The low-latency friend-or-foe identification and verification method based on real-time identifier public key computation according to claim 1, characterized in that: The context parameter CTX includes at least two of the following: Current task number; Timestamp information; Area code; Initiator identity category; The purpose of CTX is to limit the recognition request to take effect in a specific task context and to enhance the integrity and unforgeability of the recognition information.

5. The low-latency friend-or-foe identification and verification method based on real-time identifier public key computation according to claim 1, characterized in that: The identification data packet req The structure is as follows: Packet req ={Rand,ID,CTX,Sig} The transmission length of the data packet is limited to the range allowed by the communication protocol to ensure fast transmission and identification efficiency.

6. The low-latency friend-or-foe identification verification method based on real-time identifier public key computation according to claim 1, characterized in that: In S1 to S3, each identification step is completed independently by the identification device locally, including data splicing, signature generation, identification data packet construction, identification public key generation and signature verification. The end-to-end processing latency of the identification process is less than the preset maximum response time to meet the real-time identification requirements in highly dynamic or highly mobile scenarios.

7. The low-latency friend-or-foe identification and verification method based on real-time identifier public key computation according to claim 1, characterized in that: The method adopts a decentralized architecture, and the identification process does not rely on a central control node, broadcast base station or remote key server. All authentication operations are completed through point-to-point interaction between identification devices. It is applicable to distributed combat scenarios including but not limited to tactical networking, unmanned equipment formation, autonomous cluster identification, and edge communication disconnection.

8. The low-latency friend-or-foe identification and verification method based on real-time identifier public key computation according to claim 1, characterized in that: The identification device includes the following modules: The identifier management module is used to store the identifier ID and the private key TID. pri ; The public key calculation module is used to generate TIDs in real time based on IDs. pub ; The signature generation module is used to sign the concatenated content of Rand, ID, and CTX. The verification logic module is used to receive identification data packets, call the public key calculation module to generate verification keys, and complete signature verification. Specifically, the identifier management module provides an ID to the public key calculation module and a TID to the signature generation module. pri The signature generation module outputs a signature result, which, together with the original fields, forms the identification data packet; the receiving end's verification logic module calls the public key calculation module to generate a TID. pub The data is then input into the verification function to complete the identity authentication.

Images