Method and system for safely sharing operation data of low-altitude unmanned aerial vehicle

Abstract

The invention provides a low-altitude unmanned aerial vehicle operation data security sharing method and system, and the method comprises the steps: initializing a low-altitude unmanned aerial vehicle operation data security sharing system through a low-altitude traffic management platform, and generating a public parameter, a master key and an identity private key of a user; wherein the master key comprises a master public key and a master private key; the unmanned aerial vehicle encrypts the operation data of the unmanned aerial vehicle based on the identity information of the agent side to obtain an initial ciphertext, and uploads the initial ciphertext to the cloud platform; the agent side decrypts the initial ciphertext based on an identity private key of the agent side to obtain operation data of the unmanned aerial vehicle, generates a re-encryption key and uploads the re-encryption key to the cloud platform; the cloud platform re-encrypts the initial ciphertext based on the re-encryption key to generate a re-encrypted ciphertext; and the multi-body sharer end decrypts the re-encrypted ciphertext based on the identity private key of the multi-body sharer end to obtain the operation data of the unmanned aerial vehicle. According to the invention, the sharing security of the operation data of the unmanned aerial vehicle in a dynamic open network environment can be efficiently guaranteed.

Description

Technical Field

[0001] This invention relates to the field of data sharing technology, and in particular to a method and system for securely sharing operational data of low-altitude unmanned aerial vehicles (UAVs). Background Technology

[0002] Currently, low-altitude intelligent network operations are still in their initial stages. Drones are primarily controlled independently by their respective operators, and data flow is relatively simple, consisting mainly of data transmission from the drone to the ground control station. However, this isolated operational model is insufficient to meet the future needs of multi-entity collaborative operations in low-altitude environments. From the perspective of air-to-ground collaborative sharing of drone operational data, drone nodes share operational data (such as flight plans and location information) with multiple ground network nodes through air-to-ground and ground-to-ground communication. However, due to the dynamic openness of the network, drone operational data is susceptible to various security threats during multi-entity sharing.

[0003] Some existing technologies propose point-to-point secure sharing schemes, which assign session keys to each pair of communication nodes to enable pairwise communication; other schemes use attribute-based encryption (ABE) methods to achieve more efficient multi-user access control. This type of scheme allows data owners to define access policies based on attribute sets and encrypt data. Decryption can only be completed using the attribute private key when the attributes of the receiving user meet the policy, thereby achieving flexible point-to-multipoint data sharing.

[0004] However, in a point-to-multipoint sharing environment, keys need to be negotiated separately for each participant, leading to significant computational and communication overhead and making it difficult to meet the needs of efficient sharing among multiple users. While the ABE scheme provides flexible multi-participant sharing access control capabilities, changes in access policies or dynamic user additions / exits significantly increase the complexity of key management and updates, making it unsuitable for resource-constrained and dynamic UAV operating environments. In contrast, the Identity-Based Broadcast Encryption (IBBE) scheme can significantly reduce key management costs. However, existing IBBE sharing schemes typically have the following shortcomings: first, the scale of the system's common parameters grows linearly with the number of participants, requiring most schemes to pre-set the sharing group capacity during the initialization phase, limiting system scalability; second, during decryption, each participant needs to perform additional mathematical operations for other members within the group, resulting in a heavy computational burden on the receiving end. Summary of the Invention

[0005] In view of this, the purpose of this invention is to provide a method and system for securely sharing low-altitude unmanned aerial vehicle (UAV) operation data, which can efficiently ensure the security of sharing UAV operation data in a dynamic open network environment.

[0006] To achieve the above objectives, the technical solution adopted by the present invention is as follows: In a first aspect, the present invention provides a method for securely sharing low-altitude unmanned aerial vehicle (UAV) operation data, applied to a system for securely sharing low-altitude UAV operation data. This system includes: a low-altitude traffic management platform, UAVs, a cloud platform, an agent terminal, and multiple sharing parties. The method includes: the low-altitude traffic management platform initializing the system, generating public parameters, a master key, and user identity private keys; wherein the master key includes a master public key and a master private key; the UAV encrypts its operation data based on the agent terminal's identity information to obtain initial ciphertext, and uploads the initial ciphertext to the cloud platform; the agent terminal decrypts the initial ciphertext based on its own identity private key to obtain the UAV operation data, and generates a re-encryption key, which is then uploaded to the cloud platform; the cloud platform re-encrypts the initial ciphertext based on the re-encryption key to generate re-encrypted ciphertext; and the multiple sharing parties decrypt the re-encrypted ciphertext based on their own identity private keys to obtain the UAV operation data.

[0007] Optionally, the low-altitude traffic management platform initializes the low-altitude UAV operation data security sharing system, generating public parameters, a master key, and the user's private key. This includes: constructing a bilinear mapping group system based on pre-set security parameters and randomly generated prime numbers, and constructing two hash functions; selecting two generators from the bilinear mapping group system based on the hash functions and a symmetric encryption / decryption algorithm to obtain the public parameters; randomly generating an integer and a multiplicative cyclic group generator, and calculating based on the public parameters, the integer, and the multiplicative cyclic group generator to obtain the master key; and generating the user's private key based on the public parameters, the master key, and the user's identity information.

[0008] Optionally, the drone encrypts its operational data based on the identity information of the agent to obtain initial ciphertext, including: encrypting the plaintext of the operational data based on public parameters, the master public key, the drone's identity information, the agent's identity information, the cloud platform's identity information, and a randomly generated symmetric key to obtain the ciphertext body; calculating the ciphertext header based on a randomly generated first random number and the current time; and obtaining the initial ciphertext based on the ciphertext body and the ciphertext header.

[0009] Optionally, the agent decrypts the initial ciphertext using its own identity private key to obtain the drone's operational data, including: calculating a symmetric key based on public parameters, the initial ciphertext, and the agent's identity information; and decrypting the initial ciphertext using the symmetric key to obtain the plaintext of the drone's operational data.

[0010] Optionally, generating a re-encryption key includes: calculating intermediate parameters based on public parameters, the master public key, the agent's private identity key, the identity information of the multi-subject sharing group, and a randomly generated second random number; wherein the multi-subject sharing group includes multiple data sharers; and calculating the re-encryption key based on a randomly generated third random number and the intermediate parameters.

[0011] Optionally, the cloud platform re-encrypts the initial ciphertext based on the re-encryption key to generate re-encrypted ciphertext, including: calculating the initial ciphertext header to obtain the re-encrypted ciphertext based on the public parameters, the initial ciphertext, and the re-encryption key.

[0012] Optionally, the multi-entity sharing end decrypts the re-encrypted ciphertext based on its own identity private key to obtain the drone's operational data, including: calculating the hash value of the data sharer based on the public parameters and the data sharer's identity information, and obtaining the generator corresponding to the hash value of the data sharer from the re-encryption key; if the data sharer belongs to the multi-entity sharing group, then obtaining the symmetric key based on the generator corresponding to the hash value of the data sharer and the data sharer's identity private key; and decrypting the re-encrypted ciphertext based on the symmetric key to obtain the plaintext of the drone's operational data.

[0013] Secondly, this invention provides a secure data sharing system for low-altitude unmanned aerial vehicles (UAVs), comprising: a low-altitude traffic management platform, a UAV, a cloud platform, an agent terminal, and a multi-entity sharing terminal; the low-altitude traffic management platform initializes the secure data sharing system for low-altitude UAV operations, generating public parameters, a master key, and user identity private keys; wherein, the master key includes: a master public key and a master private key; the UAV encrypts its operational data based on the identity information of the agent terminal to obtain initial ciphertext, and uploads the initial ciphertext to the cloud platform; the agent terminal decrypts the initial ciphertext based on its own identity private key to obtain the UAV's operational data, and generates a re-encryption key, and uploads the re-encryption key to the cloud platform; the cloud platform re-encrypts the initial ciphertext based on the re-encryption key to generate re-encrypted ciphertext; the multi-entity sharing terminal decrypts the re-encrypted ciphertext based on its own identity private key to obtain the UAV's operational data.

[0014] Thirdly, the present invention provides an electronic device including a processor and a memory, the memory storing computer-executable instructions executable by the processor, the processor executing the computer-executable instructions to implement the steps of the method provided in any of the first aspects above.

[0015] Fourthly, the present invention provides a computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, performs the steps of the method provided in any of the first aspects above.

[0016] This invention brings the following beneficial effects: The present invention provides a method and system for securely sharing low-altitude unmanned aerial vehicle (UAV) operation data. The method is applied to a system for securely sharing low-altitude UAV operation data, which includes: a low-altitude traffic management platform, UAVs, a cloud platform, an agent terminal, and multiple sharing parties. The method includes: the low-altitude traffic management platform initializing the system, generating public parameters, a master key, and user identity private keys; wherein the master key includes a master public key and a master private key; the UAV encrypts its operation data based on the agent terminal's identity information to obtain initial ciphertext, and uploads the initial ciphertext to the cloud platform; the agent terminal decrypts the initial ciphertext based on its own identity private key to obtain the UAV operation data, and generates a re-encryption key, which is then uploaded to the cloud platform; the cloud platform re-encrypts the initial ciphertext based on the re-encryption key to generate re-encrypted ciphertext; and the multiple sharing parties decrypt the re-encrypted ciphertext based on their own identity private keys to obtain the UAV operation data. The above method integrates identity-based broadcast encryption mechanism with efficient symmetric encryption technology. Users can use their identity private keys to complete stateless sharing of shared groups without the need to preset group capacity, thereby improving scalability and flexibility. At the same time, by introducing ciphertext re-encryption, it realizes point-to-point and point-to-multipoint data sharing modes, which can effectively resist security threats such as eavesdropping, replay attacks and unauthorized access, and efficiently ensure the security of running data sharing in a dynamic open network environment.

[0017] Other features and advantages of the invention will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the invention. The objects and other advantages of the invention are realized and obtained in accordance with the structures particularly pointed out in the description, claims and drawings.

[0018] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0019] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0020] Figure 1 A schematic diagram of a low-altitude unmanned aerial vehicle (UAV) operation data security sharing system provided in an embodiment of the present invention; Figure 2 A flowchart illustrating a method for securely sharing operational data of a low-altitude unmanned aerial vehicle (UAV) according to an embodiment of the present invention; Figure 3 A schematic diagram of an initialization phase provided in an embodiment of the present invention; Figure 4 A schematic diagram illustrating an initial sharing phase provided in an embodiment of the present invention; Figure 5 This is a schematic diagram of a multi-subject sharing stage provided in an embodiment of the present invention; Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0022] Currently, existing IBBE sharing schemes typically have the following shortcomings: First, the scale of the system's common parameters grows linearly with the number of sharers, requiring most schemes to pre-set the sharing group capacity during the initialization phase, which limits the system's scalability; second, during the decryption process, each sharer needs to perform additional mathematical operations for other members within the group, resulting in a heavy computational burden on the receiving end.

[0023] Based on this, the present invention provides a method and system for secure sharing of low-altitude unmanned aerial vehicle (UAV) operation data, which can efficiently ensure the security of sharing UAV operation data in a dynamic open network environment.

[0024] To facilitate understanding of this embodiment, a low-altitude unmanned aerial vehicle (UAV) operational data security sharing system disclosed in this invention will first be introduced. See [link to relevant documentation]. Figure 1 The diagram shows a low-altitude unmanned aerial vehicle (UAV) operation data security sharing system. The system mainly includes: a low-altitude traffic management platform, UAVs, a cloud platform, an agent terminal, and a multi-entity sharing terminal.

[0025] The Low-Altitude Traffic Management Platform (LATM) initializes the low-altitude UAV operation data security sharing system, generating public parameters, a master key, and user identity private keys. The master key includes a master public key and a master private key. In one implementation, the LATM is primarily responsible for implementing the UAV operation data sharing security mechanism. This includes setting the security level of the sharing system, initializing the system's public parameters, verifying the identity of newly joined users, and distributing corresponding identity private keys through a secure channel.

[0026] The drone encrypts its operational data based on the agent's identity information to obtain initial ciphertext, which is then uploaded to the cloud platform. In one implementation, the drone, as the data producer, is responsible for initially encrypting various data generated during operation, such as situational monitoring and mission logs, and uploading the initial ciphertext to the cloud platform. Drones often have limited resources, such as computing power, storage, and battery life.

[0027] The agent decrypts the initial ciphertext using its own private key to obtain the drone's operational data and generates a re-encryption key, which is then uploaded to the cloud platform. In one implementation, the agent is the initial data sharer authorized by the drone, typically the drone ground control station or operator, and can be flexibly configured according to different application scenarios. The agent can not only access and decrypt the initial ciphertext data (point-to-point), but also set access control through re-encryption as needed to achieve multi-entity data sharing (point-to-multipoint).

[0028] The cloud platform re-encrypts the initial ciphertext using a re-encryption key to generate a re-encrypted ciphertext. In one implementation, the cloud platform acts as a data storage and computing center, responsible for storing data uploaded by the drone and providing data management, analysis, and intelligent services. Simultaneously, the cloud platform provides system users with secure and efficient data access services, allowing users to access cloud data anytime, anywhere via network devices.

[0029] The multi-entity sharing end decrypts the re-encrypted ciphertext based on its own identity private key to obtain the drone's operational data. In one implementation, the multi-entity sharing end refers to multiple system users who need to access the shared drone operational data, such as drone operation service providers, industry regulators, research institutions, and other types of users.

[0030] The low-altitude UAV operation data security sharing system provided in this embodiment of the invention integrates an identity-based broadcast encryption mechanism with efficient symmetric encryption technology. Users can use their identity private keys to complete stateless sharing of shared groups without the need for preset group capacity, thereby improving scalability and flexibility. At the same time, by introducing ciphertext re-encryption, it realizes point-to-point and point-to-multipoint data sharing modes, which can effectively resist security threats such as eavesdropping, replay attacks and unauthorized access, and efficiently ensure the security of operation data sharing in a dynamic open network environment.

[0031] Next, a detailed description will be given of a method for securely sharing low-altitude unmanned aerial vehicle (UAV) operational data as disclosed in the embodiments of the present invention. See [link to relevant documentation]. Figure 2 The flowchart shown illustrates a method for securely sharing operational data of low-altitude unmanned aerial vehicles (UAVs), which mainly includes the following steps S201 to S205: Step S201: The low-altitude traffic management platform initializes the low-altitude UAV operation data security sharing system, generating public parameters, master key, and user identity private key.

[0032] In one implementation, the low-altitude traffic management platform calculates and generates parameters for the entire scheme, including publicly available scheme parameters, a master key pair, and each user's private key. The master key includes a master public key and a master private key.

[0033] Step S202: The drone encrypts its operational data based on the agent's identity information to obtain initial ciphertext, and then uploads the initial ciphertext to the cloud platform.

[0034] Step S203: The agent decrypts the initial ciphertext based on its own identity private key to obtain the drone's operation data, generates a re-encryption key, and uploads the re-encryption key to the cloud platform.

[0035] Step S204: The cloud platform re-encrypts the initial ciphertext based on the re-encryption key to generate re-encrypted ciphertext.

[0036] Step S205: The multi-subject sharing terminal decrypts the re-encrypted ciphertext based on its own identity private key to obtain the drone's operation data.

[0037] In one implementation, the drone first selects an initial sharer (i.e., an agent), then uses the sharer's identity information to encrypt the operational data to obtain initial ciphertext, and finally uploads the ciphertext to a cloud platform. The agent can retrieve the initial ciphertext from the cloud platform and decrypt it using its own private key to obtain the drone's operational data.

[0038] In another implementation, the agent establishes a shared group (i.e., multiple stakeholders sharing the data) and generates a re-encryption key for the initial ciphertext, which is then sent to the cloud platform. The cloud platform re-encrypts the initial ciphertext, and users in the shared group can use their own private keys to decrypt the re-encrypted ciphertext, thereby achieving secure sharing of drone operation data among multiple stakeholders.

[0039] The low-altitude UAV operation data secure sharing method provided in this embodiment of the invention integrates an identity-based broadcast encryption mechanism with efficient symmetric encryption technology. Users can use their identity private keys to complete stateless sharing of shared groups without pre-setting group capacity, thereby improving scalability and flexibility. At the same time, by introducing ciphertext re-encryption, it realizes point-to-point and point-to-multipoint data sharing modes, which can effectively resist security threats such as eavesdropping, replay attacks and unauthorized access, and efficiently ensure the security of operation data sharing in a dynamic open network environment.

[0040] In one implementation, for the aforementioned step S201, i.e., when the low-altitude traffic management platform initializes the low-altitude UAV operation data security sharing system and generates public parameters, master keys, and user identity private keys, the low-altitude traffic management platform can utilize a public parameter generation algorithm. Master key generation algorithm and registration algorithm The initialization of the shared system includes the following steps: (1) Based on the pre-set security parameters and randomly generated prime numbers, construct a bilinear mapping group system and construct two hash functions. Based on the hash functions and symmetric encryption and decryption algorithms, select two generators from the bilinear mapping group system to obtain the public parameters.

[0041] In practice, the low-altitude traffic management platform operates a public parameter generation algorithm. Generate public parameters: First, given the security parameters. The common parameter generation algorithm randomly selects a large prime number. And construct a bilinear mapping group system. ,in, Represents a group of integers and Representing the cyclic group of multiplication and Describe a bilinear mapping, i.e. Then, the common parameter generation algorithm constructs two hash functions. and And select a symmetric encryption / decryption algorithm. and Such as the AES algorithm. Finally, from the group Two generators are randomly selected from the data. The output public parameters are .

[0042] (2) Randomly generate an integer and a multiplicative cyclic group generator, and calculate based on the public parameters, the integer and the multiplicative cyclic group generator to obtain the master key.

[0043] In practice, the low-altitude traffic management platform runs a master key generation algorithm. Generate master key: Given public parameters The master key generation algorithm first randomly selects an integer. A generator of a multiplicative cyclic group Then, the master key generation algorithm calculates... , and Finally, output the master public key. and the master private key .

[0044] (3) Generate the user's identity private key based on the public parameters, master private key and user's identity information.

[0045] In practice, the low-altitude traffic management platform operates a registration algorithm. Generate the user's private key: Specifically, given the public parameters Master private key and a user's identity information The registration algorithm calculates and outputs the identity private key. : (1) In one implementation, for the aforementioned step S202, i.e., when the drone encrypts its operational data based on the agent's identity information to obtain the initial ciphertext, the following methods may be used, including but not limited to: First, based on the public parameters, master public key, drone identity information, agent identity information, cloud platform identity information, and randomly generated symmetric key, the plaintext of the operation data is encrypted to obtain the ciphertext body; then, based on the first randomly generated random number and the current time, the ciphertext header is calculated; based on the ciphertext body and the ciphertext header, the initial ciphertext is obtained.

[0046] In practice, the drone is designated as the initial sharer (also known as the agent). (For example, it can be set as a drone ground control station). The drone uses an encryption algorithm. The plaintext of the running data is encrypted to obtain the initial ciphertext: Specifically, given the public parameters Master key Plaintext of runtime data Data owner identity (i.e., the drone's identity information) Initial sharer identity information and identity information of the cloud platform The encryption algorithm randomly selects a random element. Used as a symmetric key, and used to encrypt plaintext. The generated ciphertext body is shown below: (2) Then, the encryption algorithm randomly selects a first random number. And according to the current time The ciphertext header is calculated as follows: (3) Finally, the encryption algorithm outputs the initial ciphertext. .

[0047] Furthermore, after the drone uploads the initial ciphertext to the cloud platform via air-to-ground communication, the agent, as the initial sharer, can share the data. Specifically, for the aforementioned step S203, when the agent decrypts the initial ciphertext based on its own identity private key to obtain the drone's operational data, it can adopt methods including but not limited to the following: First, calculate a symmetric key based on public parameters, the initial ciphertext, and the agent's identity information; then, decrypt the initial ciphertext based on the symmetric key to obtain the plaintext of the drone's operational data.

[0048] In practice, the agent can utilize decryption algorithms. Decrypt This enables the initial sharing of drone operational data. Specifically, it involves providing publicly available parameters. Initial ciphertext and the identity private key of the initial sharer The decryption algorithm recovers the symmetric key. As shown below: (4) (5) Then, use the key If decryption is successful, output: Otherwise, if decryption fails, invalid plaintext will be output. .

[0049] In one implementation, the aforementioned sharing system can also achieve multi-subject sharing, firstly through a re-encryption key generation algorithm. Generate a re-encryption key: Specifically, the following methods may be used, including but not limited to: First, calculate intermediate parameters based on public parameters, the master public key, the agent's private key, the identity information of the multi-subject sharing group, and a randomly generated second random number; wherein, the multi-subject sharing group includes multiple data sharers; then, calculate the re-encryption key based on a randomly generated third random number and the intermediate parameters.

[0050] In practical implementation, publicly available parameters are given. Master key Multi-entity shared group and the agent's identity private key The re-encryption key generation algorithm first randomly selects a second random number. And calculate intermediate parameters ,in, (6) Finally, the re-encryption key generation algorithm selects a third random number. Calculate and output the re-encryption key ,in, (7) Furthermore, the cloud platform re-encrypts the initial ciphertext based on the re-encryption key to generate re-encrypted ciphertext, including: calculating the initial ciphertext header to obtain the re-encrypted ciphertext based on the public parameters, the initial ciphertext, and the re-encryption key.

[0051] In practice, the cloud platform runs a re-encryption algorithm. The initial ciphertext is re-encrypted to generate re-encrypted ciphertext: Specifically, given the public parameters Initial ciphertext and re-encryption key Recalculate the initial ciphertext header to obtain ,in, (8) Finally, the re-encryption algorithm outputs the re-encrypted ciphertext as follows: .

[0052] Furthermore, data sharers in a multi-entity sharing group can obtain the re-encrypted ciphertext from the cloud platform for decryption, thereby achieving multi-entity data sharing. Specifically, for the aforementioned step S205, when a multi-entity sharer decrypts the re-encrypted ciphertext based on its own identity private key to obtain the UAV's operational data, the following methods can be used, including but not limited to: First, based on the public parameters and the data sharer's identity information, calculate the data sharer's hash value, and obtain the generator corresponding to the data sharer's hash value from the re-encryption key; if the data sharer belongs to a multi-entity sharing group, obtain the symmetric key based on the generator corresponding to the data sharer's hash value and the data sharer's identity private key; finally, decrypt the re-encrypted ciphertext based on the symmetric key to obtain the plaintext of the UAV's operational data.

[0053] In practical implementation, the multi-party sharing end can run a re-encryption and decryption algorithm. The decrypted runtime data is obtained: This enables multi-entity sharing of drone operation data. Specifically, given publicly available parameters... The re-encrypted ciphertext is Identity information of a data sharer and the corresponding identity private key The encryption / decryption algorithm first calculates the hash value of the data sharer. And re-encrypt the key Find the generator corresponding to the hash value of the data sharer: If the data sharer belongs to a multi-subject sharing group, that is... Then let The re-encryption and decryption algorithm further recovers the symmetric key. As shown below: (9) (10) (11) Finally, use a symmetric key. Decryption successful, output Otherwise, if decryption fails, invalid plaintext will be output. .

[0054] This invention provides a method for securely sharing low-altitude unmanned aerial vehicle (UAV) operational data, comprising three stages: an initialization stage, an initial sharing stage, and a multi-entity sharing stage. In the initialization stage, LATM (Low Altitude Transmission Technology) is primarily responsible for calculating and generating the parameters of the entire scheme, including the scheme's public parameters, the master key pair, and each user's private key. In the initial sharing stage, the UAV first selects an initial sharer (also known as an agent), then uses that sharer's identity to encrypt the operational data to obtain initial ciphertext, and finally uploads the ciphertext to the cloud. In the multi-entity sharing stage, the agent establishes a sharing group and generates a re-encryption key for the initial ciphertext, sending it to the cloud platform. The cloud platform re-encrypts the initial ciphertext, and only users in the sharing group can decrypt the re-encrypted ciphertext using their own private keys, thereby achieving secure multi-entity sharing of UAV operational data.

[0055] See Figure 3 As shown, during the initialization phase, LATM first runs... Algorithm generates public parameters Initialize the entire sharing scheme. Then, LATM runs. Algorithm for generating master public key and the master private key The master public key is made public, while the master private key is kept private. In this embodiment of the invention, all system users are required to send their identity information to LATM. Request authentication and registration. After successful authentication, LATM will run. Algorithms for identity Generate the corresponding identity private key And send it to the corresponding user through a secure channel.

[0056] See Figure 4 As shown, in the initial sharing phase, the drone sets the initial sharer (also known as the agent) as... (If configured as a drone ground control station), the agent's responsibility is to further implement and manage the multi-stakeholder sharing strategy for drone operational data. Given a set of operational data... Drones use agent identities run The algorithm encrypts the data to obtain the initial ciphertext. The drone then uploads the initial ciphertext to the cloud platform via air-to-ground communication. As the initial sharer, the agent can then use their private key... run The algorithm decrypts the ciphertext, enabling peer-to-peer data sharing.

[0057] See Figure 5 As shown, in the multi-subject sharing phase, assuming the agent sets... n Individual users can access drone operation data, creating a multi-entity shared group. Then, the agent run Algorithm generates re-encryption key And send the key to the cloud platform. Received After that, the cloud platform runs. The algorithm on the initial ciphertext Perform re-encryption to generate re-encrypted ciphertext. At this point, any legitimate identity within a shared group, i.e. All can be used to run using their identity private key The algorithm decrypts and re-encrypts the ciphertext.

[0058] The method provided in this invention offers two sharing modes: point-to-point sharing (initial sharing phase) and point-to-multipoint sharing (multi-subject sharing phase). These two sharing modes can be executed in parallel to reduce latency in multi-subject data sharing. For example, an agent can generate a re-encryption key in advance according to the access policy and store it in the cloud. After receiving the initial ciphertext uploaded by the drone, the cloud can directly perform re-encryption, thereby achieving low-latency multi-subject data sharing. Furthermore, this invention can flexibly adjust different sharing modes according to different drone scenarios (such as communication conditions and sharing needs) to further reduce data sharing latency: 1) The drone directly sends the initial ciphertext to the initial sharer, who then performs re-encryption and shares it with multiple users. 2) The drone itself acts as the initial sharer, directly performing re-encryption to achieve multi-subject sharing without relying on an intermediate agent.

[0059] Compared with the prior art, the advantages and positive effects of the present invention are as follows: (1) The ciphertext body of the present invention uses symmetric encryption, while the ciphertext header uses identity-based broadcast proxy re-encryption technology to encrypt the symmetric key. This hybrid encryption mechanism requires managing only a small number of asymmetric keys and dynamically generating symmetric keys, thus significantly reducing the key management burden. Simultaneously, by utilizing efficient symmetric encryption to process the data body, the encryption and decryption process of the ciphertext body is accelerated, effectively reducing computational overhead (especially when dealing with large amounts of data).

[0060] (2) Based on the actual operating scenario, the present invention supports the use of different symmetric keys in each ciphertext by the UAV to enhance data security, and also allows the symmetric key to be updated at fixed time intervals, thereby further reducing the computational overhead of the ciphertext header while ensuring security.

[0061] (3) The present invention does not require pre-setting the capacity of the sharing group when realizing point-to-multipoint data sharing, and the computational overhead of the master key generation algorithm is constant, which can effectively improve the scalability of UAV operation data sharing.

[0062] (4) According to the present invention Algorithm, identity private key Independent of other users' private keys. Therefore, when the sharing group changes, members of the sharing group do not need to update their identity keys. In the re-encryption and decryption algorithm, the sharer only needs to locate itself based on its own identity. No mathematical operations need to be performed for other members of the group. Therefore, this invention implements a stateless receiver attribute, which can effectively guarantee the security and efficiency of point-to-multipoint sharing processes.

[0063] (5) The present invention can flexibly adjust different sharing modes according to different scenarios of the UAV (such as communication conditions and sharing needs) to further reduce data sharing delay.

[0064] It should be noted that the system provided in the embodiments of the present invention has the same implementation principle and the same technical effects as the method embodiments. For the sake of brevity, any parts not mentioned in the system embodiments can be referred to the corresponding content in the method embodiments.

[0065] This invention also provides an electronic device, specifically, the electronic device includes a processor and a storage device; the storage device stores a computer program, and the computer program, when run by the processor, executes the method described in any of the above embodiments.

[0066] Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. The electronic device 100 includes: a processor 60, a memory 61, a bus 62, and a communication interface 63. The processor 60, the communication interface 63, and the memory 61 are connected through the bus 62. The processor 60 is used to execute executable modules, such as computer programs, stored in the memory 61.

[0067] The memory 61 may include high-speed random access memory (RAM) or non-volatile memory, such as at least one disk storage device. Communication between this system network element and at least one other network element is achieved through at least one communication interface 63 (which can be wired or wireless), such as the Internet, wide area network, local area network, metropolitan area network, etc.

[0068] Bus 62 can be an ISA bus, PCI bus, or EISA bus, etc. The bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 6 The symbol is represented by a single double-headed arrow, but this does not mean that there is only one bus or one type of bus.

[0069] The memory 61 is used to store programs. After receiving an execution instruction, the processor 60 executes the program. The method executed by the device for defining the flow process disclosed in any of the foregoing embodiments of the present invention can be applied to the processor 60 or implemented by the processor 60.

[0070] Processor 60 may be an integrated circuit chip with signal processing capabilities. In implementation, each step of the above method can be completed by the integrated logic circuitry in the hardware of processor 60 or by instructions in software form. Processor 60 can be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it can also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this invention. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this invention can be directly embodied in the execution of a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software modules can reside in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. The storage medium is located in memory 61. Processor 60 reads the information in memory 61 and, in conjunction with its hardware, completes the steps of the above method.

[0071] The computer program product of the readable storage medium provided in the embodiments of the present invention includes a computer-readable storage medium storing program code. The instructions included in the program code can be used to execute the methods described in the foregoing method embodiments. For specific implementation, please refer to the foregoing method embodiments, which will not be repeated here.

[0072] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, essentially, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0073] Finally, it should be noted that the above-described embodiments are merely specific implementations of the present invention, used to illustrate the technical solutions of the present invention, and not to limit it. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments within the technical scope disclosed in the present invention, or make equivalent substitutions for some of the technical features; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for securely sharing operational data of low-altitude unmanned aerial vehicles (UAVs), characterized in that, A data security sharing system for low-altitude unmanned aerial vehicle (UAV) operations is applied, the system comprising: a low-altitude traffic management platform, UAVs, a cloud platform, agent terminals, and multi-entity sharing terminals; the method includes: The low-altitude traffic management platform initializes the low-altitude UAV operation data security sharing system, generating public parameters, a master key, and the user's private key; wherein, the master key includes: a master public key and a master private key; The drone encrypts its operational data based on the identity information of the agent to obtain an initial ciphertext, and then uploads the initial ciphertext to the cloud platform. The agent decrypts the initial ciphertext based on its own identity private key to obtain the drone's operating data, generates a re-encryption key, and uploads the re-encryption key to the cloud platform. The cloud platform re-encrypts the initial ciphertext based on the re-encryption key to generate re-encrypted ciphertext. The multi-entity sharing terminal decrypts the re-encrypted ciphertext based on its own identity private key to obtain the drone's operational data.

2. The method according to claim 1, characterized in that, The low-altitude traffic management platform initializes the low-altitude UAV operation data security sharing system, generating public parameters, a master key, and the user's private key, including: Based on pre-defined security parameters and randomly generated prime numbers, a bilinear mapping group system is constructed, and two hash functions are constructed. Based on the hash functions and a symmetric encryption / decryption algorithm, two generators are selected from the bilinear mapping group system to obtain public parameters. A random integer and a multiplicative cyclic group generator are generated, and the master key is obtained by calculation based on the public parameters, the integer, and the multiplicative cyclic group generator. Based on the public parameters, the master private key, and the user's identity information, the user's identity private key is generated.

3. The method according to claim 1, characterized in that, The drone encrypts its operational data based on the identity information of the agent to obtain initial ciphertext, including: Based on the publicly available parameters, the master public key, the identity information of the drone, the identity information of the agent terminal, the identity information of the cloud platform, and a randomly generated symmetric key, the plaintext of the running data is encrypted to obtain the ciphertext body; Calculate the ciphertext header based on the first randomly generated random number and the current time; Based on the ciphertext body and the ciphertext header, the initial ciphertext is obtained.

4. The method according to claim 3, characterized in that, The agent decrypts the initial ciphertext using its own private key to obtain the drone's operational data, including: The symmetric key is calculated based on the publicly available parameters, the initial ciphertext, and the identity information of the agent. The initial ciphertext is decrypted using the symmetric key to obtain the plaintext of the UAV's operational data.

5. The method according to claim 1, characterized in that, Generate a re-encryption key, including: Based on the public parameters, the master public key, the agent's private key, the identity information of the multi-subject sharing group, and a randomly generated second random number, intermediate parameters are calculated; wherein, the multi-subject sharing group includes multiple data sharers; The re-encryption key is calculated based on the randomly generated third random number and the intermediate parameters.

6. The method according to claim 1, characterized in that, The cloud platform re-encrypts the initial ciphertext based on the re-encryption key to generate re-encrypted ciphertext, including: Based on the publicly available parameters, the initial ciphertext, and the re-encryption key, the initial ciphertext header is calculated to obtain the re-encrypted ciphertext.

7. The method according to claim 5, characterized in that, The multi-subject sharing terminal decrypts the re-encrypted ciphertext based on its own identity private key to obtain the drone's operational data, including: Based on the publicly available parameters and the identity information of the data sharer, calculate the hash value of the data sharer, and obtain the generator corresponding to the hash value of the data sharer from the re-encryption key; If the data sharer belongs to the multi-subject sharing group, then a symmetric key is obtained based on the generator corresponding to the hash value of the data sharer and the private key of the data sharer's identity. The re-encrypted ciphertext is decrypted using the symmetric key to obtain the plaintext of the drone's operational data.

8. A low-altitude unmanned aerial vehicle (UAV) operation data security sharing system, characterized in that, include: Low-altitude traffic management platform, drones, cloud platform, agent terminal, and multi-entity sharing terminal; The low-altitude traffic management platform initializes the low-altitude UAV operation data security sharing system, generating public parameters, a master key, and the user's private key; wherein, the master key includes: a master public key and a master private key; The drone encrypts its operational data based on the identity information of the agent to obtain an initial ciphertext, and then uploads the initial ciphertext to the cloud platform. The agent decrypts the initial ciphertext based on its own identity private key to obtain the drone's operating data, generates a re-encryption key, and uploads the re-encryption key to the cloud platform. The cloud platform re-encrypts the initial ciphertext based on the re-encryption key to generate re-encrypted ciphertext. The multi-entity sharing terminal decrypts the re-encrypted ciphertext based on its own identity private key to obtain the drone's operational data.

9. An electronic device, characterized in that, The method includes a processor and a memory, the memory storing computer-executable instructions executable by the processor, the processor executing the computer-executable instructions to implement the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program thereon, characterized in that, The computer program is executed by the processor to perform the steps of the method described in any one of claims 1 to 7.

Images