Low-altitude networked unmanned aerial vehicle safety management and control method

Abstract

The application discloses a kind of low-altitude networked unmanned plane safety control methods, belong to unmanned plane technical field, including unmanned plane sends identity information and public key to regulatory platform, and regulatory platform generates unmanned plane certificate according to the identity information and public key of unmanned plane;Unmanned plane and regulatory platform exchange unmanned plane certificate and regulatory platform certificate and carry out verification, regulatory platform is verified by authentication message and digital signature, and random session key is obtained by regulatory platform decryption K ;Unmanned plane periodically collects unmanned plane situation data, combines external constraint information, carries out multidimensional abnormality determination in local and obtains multidimensional determination result, when meeting trigger condition, the trusted takeover module of unmanned plane controls unmanned plane to enter advanced control mode, realizes highest priority control, shields remote controller, data transmission module and networked control channel of unmanned plane, and then unmanned plane executes control instruction.The application improves the safety, controllability and supervisability of low-altitude networked unmanned plane.

Description

Technical Field

[0001] This invention belongs to the field of unmanned aerial vehicle (UAV) technology, specifically relating to a safety management method for low-altitude networked UAVs. Background Technology

[0002] With the rapid development of the low-altitude economy and the drone industry, drone operations are evolving from primarily short-range, line-of-sight, and point-to-point remote control to wide-area, cross-regional, and cross-network networked operations. This involves remote control, data transmission, cloud-based task management, and multi-entity collaboration through public cellular mobile networks or internet infrastructure. While this open, networked architecture breaks down physical distance limitations, it also introduces security threats from the internet domain. On one hand, the lack of authentication and encryption protection in communication and control links can lead to attacks such as command injection, link hijacking, replay attacks, and eavesdropping, potentially causing drones to lose control, fly out of bounds, or have their missions tampered with. On the other hand, security constraints such as positioning signals and geofencing can be deceived or interfered with, and the current lack of real-time anomaly detection for drone sensors and flight data leads to security risks when drones illegally enter sensitive areas or are in abnormal flight states. In addition, issues such as unauthorized flights (referring to drones operating illegally in low-altitude airspace without legal registration, declaration, authorization or permission), spoofing, and identity theft exist in low-altitude scenarios, making it difficult for regulatory authorities to effectively manage and enforce the takeover of drones.

[0003] Therefore, there is a need for a security management solution for low-altitude networked UAVs that can systematically compensate for the deficiencies in networked low-altitude operations, such as weak identity trust, insecure communication control links, difficulty in timely detection of anomalies, and inability to enforce disposal strategies. Summary of the Invention

[0004] To address the aforementioned problems in the existing technology, this invention provides a method for the safe management and control of low-altitude networked unmanned aerial vehicles (UAVs).

[0005] The technical problem to be solved by this invention is achieved through the following technical solution: This invention provides a method for the safety management and control of low-altitude networked unmanned aerial vehicles (UAVs), comprising: Step 1: The drone generates its own identity information locally and sends the drone's identity information and public key to the monitoring platform for verification. After successful verification, the monitoring platform generates a drone certificate based on the drone's identity information and public key, and sends the drone certificate, monitoring platform certificate, CA public key, and session public key to the drone. Step 2: The drone exchanges drone certificates and the monitoring platform certificates with the monitoring platform and verifies them. After successful verification, the monitoring platform verifies the authentication message and its digital signature. After successful verification, the drone uses the monitoring platform's public key to set a random session key. K After encryption, the data is sent to the monitoring platform for decryption to obtain a random session key. K ; Step 3: The UAV periodically collects UAV situational data and combines it with external constraint information obtained from the monitoring platform. The UAV performs multi-dimensional anomaly judgment locally through the anomaly judgment unit to obtain multi-dimensional judgment results, and executes the trusted management and control process for the UAV according to Step 4. Step 4: When the triggering conditions are met, the trusted takeover module of the UAV controls the UAV to enter the advanced control mode. After the control command is verified, the trusted takeover module sends a mode switching request to the flight control system of the UAV to achieve the highest priority control and disables the UAV's remote controller, data transmission module and network control channel. Then the UAV executes the control command.

[0006] Compared with the prior art, the beneficial effects of the present invention are as follows: This invention proposes a security management method for low-altitude networked unmanned aerial vehicles (UAVs). This method uses a unified authentication center on the regulatory side as the root of trust. It extracts identity elements such as radio frequency fingerprints, manufacturing model numbers, and hardware trust metrics from the UAV side for authentication, establishing a unified identity management mechanism. Furthermore, it achieves end-to-end secure communication through certificate-based two-way authentication and session key negotiation, reducing the risks of eavesdropping, tampering, and hijacking. Simultaneously, it continuously collects operational data such as UAV data, flight status, and flight trajectory, enabling online real-time anomaly detection and comprehensive analysis on the UAV side, and supporting cloud-based retraining of the anomaly detection model. Finally, in two scenarios—anomaly triggering or direct control command issuance—the method enables the UAV to acquire dynamically updated emergency response strategies and forcibly triggers advanced control modes. By updating configurations and implementing traffic control, it filters ordinary control channels to ensure that control commands have the highest priority, thus forming a "certification-perception-takeover-response" security management capability, improving the security, controllability, and regulatory oversight of low-altitude networked UAVs in open network environments.

[0007] The present invention will now be described in further detail with reference to the accompanying drawings. Attached Figure Description

[0008] Figure 1 This is a flowchart illustrating a method for the safety management and control of low-altitude networked unmanned aerial vehicles (UAVs) provided in an embodiment of the present invention. Detailed Implementation

[0009] The present invention will be further described in detail below with reference to specific embodiments, but the implementation of the present invention is not limited thereto.

[0010] Example 1 Currently, existing technical solutions have the following four technical problems: First, there is a weak foundation of trust in the identity of low-altitude networked drones: In scenarios where low-altitude networked drones are controlled and interact with data through public cellular mobile communication networks, regulators often find it difficult to uniformly authenticate and effectively distinguish the drones' identities, and lack reliable means to detect and handle illegal drones. Existing methods typically rely on easily forged and altered information such as appearance, serial numbers, or network identifiers, leading to regulatory loopholes such as identity theft, disguised access, or using a legitimate guise to carry out illegal activities.

[0011] Secondly, there is the problem of untrusted network communication control links, which are easily tampered with and hijacked: Low-altitude networked UAVs face cybersecurity risks. Attackers may tamper with or hijack the UAV through the communication link, causing consequences such as loss of control or collisions. If the existing control and data transmission links lack encryption mechanisms, it is difficult to ensure both confidentiality and integrity of commands and status data during transmission, thereby amplifying the attack surface for hijacking and replay attacks.

[0012] Third, there is a lack of lightweight situational awareness during operation: The status, trajectory, and mission of UAVs change rapidly during low-altitude operations. Without continuous data collection and comprehensive analysis capabilities, it is difficult to detect abnormal behaviors such as deviations from the trajectory, violations of temporary area control, or illegal missions in a timely manner. Furthermore, the various subsystems of UAVs are closely interconnected, and fluctuations from a single sensor often fail to accurately reflect the system-level health level. Relying solely on single-point monitoring can easily lead to missed detections or false alarms, making it difficult to form a usable basis for determining the normality of flight status.

[0013] Fourth, there is a lack of safety control in abnormal or temporary aircraft control scenarios: When an anomaly is detected or a no-fly zone or temporary air control requirement is encountered, relying solely on remote control or data transmission control channels cannot guarantee the highest priority execution of regulatory instructions, and may even be circumvented or bypassed by attackers or illegal operators. Furthermore, the existing anomaly handling mechanism cannot be enforced on the drone side.

[0014] Therefore, this invention provides a method for the safe management and control of low-altitude networked unmanned aerial vehicles (UAVs). Please refer to [link to relevant documentation]. Figure 1 , Figure 1 This is a flowchart illustrating a safety management method for low-altitude networked unmanned aerial vehicles (UAVs) provided by an embodiment of the present invention. The safety management method for low-altitude networked UAVs provided by the present invention includes: Step 1: The drone generates its own identity information locally and sends the drone's identity information and public key to the monitoring platform for verification. After successful verification, the monitoring platform generates a drone certificate based on the drone's identity information and public key, and sends the drone certificate, monitoring platform certificate, CA public key, and session public key to the drone.

[0015] In one specific embodiment, the drone's identity registration is completed through step 1, which may specifically include: Step 1.1: The regulatory platform generates and stores the root CA (Certificate Authority)'s public and private keys, as well as the regulatory platform's public and private keys locally. It also generates and stores session public and private keys for session encryption. The regulatory platform's identity information and public key are combined to obtain combined data. The combined data is digitally signed using the CA's private key to obtain a digital signature. The regulatory platform certificate is obtained based on the regulatory platform's identity information, public key, and digital signature of the combined data.

[0016] Specifically, the regulatory platform uses the Ed25519 algorithm locally to generate and store the root CA's public and private keys, as well as the regulatory platform's public and private keys. Simultaneously, it uses the RSA encryption algorithm to generate and store session public and private keys for session encryption. The platform combines the regulatory platform's identity information and public key, and uses the CA's private key to digitally sign the combined data, thus using the regulatory platform's identity information, public key, and digital signature of the combined data as the regulatory platform certificate.

[0017] In this embodiment, the root CA is the top-level certificate authority created and acted upon by the regulatory platform, responsible for issuing and verifying all digital certificates. The regulatory platform's identity information is used to identify the platform and may include its generic name / domain name / public IP address, organization name / unit, and even its geographical location.

[0018] Step 1.2: The drone generates and stores its public and private keys locally, extracts the drone's radio frequency fingerprint, manufacturing model, and hardware trust measurement value as the drone's identity information, and sends the drone's public key and identity information to the monitoring platform.

[0019] Specifically, the drone's trusted takeover module initiates the identity registration process. The drone uses the Ed25519 algorithm locally to generate and store the drone's public key and private key, extracts the drone's radio frequency fingerprint, manufacturing model, and hardware trust measurement value as the drone's identity information, and sends the drone's public key and identity information to the regulatory platform.

[0020] In this embodiment, the radio frequency fingerprint is a physical layer signal, and different hardware models have different radio frequency fingerprints. This embodiment can use the response value of the Physically Unclonable Function (PUF) as a hardware trust metric.

[0021] Step 1.3: After receiving the drone's public key and identity information, the monitoring platform verifies the drone's identity information using the drone identity database. If the verification is successful, the monitoring platform uses the CA private key to digitally sign the drone's public key and identity information to generate a drone certificate. Afterward, the monitoring platform sends the drone certificate, the monitoring platform certificate, the CA public key, and the session public key to the drone.

[0022] Specifically, after receiving the drone's public key and identity information, the monitoring platform analyzes and compares the drone's identity information with its pre-stored drone identity database to verify the drone's legitimacy. If the drone's RFID fingerprint matches the pre-stored RFID features in the drone identity database, its manufacturing model matches the pre-stored standard encoding format, and the Hamming distance between the hardware trust metric and the baseline value in the drone identity database is less than a preset fault tolerance threshold, then the drone is considered legitimate. If the drone's legitimacy verification passes, the monitoring platform uses the CA's private key to digitally sign the drone's public key and identity information, generating a drone certificate containing the drone's identity information, public key, and digital signature. The monitoring platform then returns the drone certificate, the monitoring platform certificate, the CA's public key, and the session public key to the drone.

[0023] In this embodiment, the drone identity database is a structured data set used by the regulatory platform to store, manage, and compare the identity information and legality of drones.

[0024] Step 1.4: The drone stores the drone certificate, the monitoring platform certificate, the CA public key, and the session public key locally.

[0025] Step 2: The drone exchanges drone certificates and regulatory platform certificates with the regulatory platform and verifies them. After successful verification, the regulatory platform verifies the authentication message and its digital signature. Upon successful verification, the drone uses the regulatory platform's public key to set a random session key. K After encryption, the data is sent to the monitoring platform for decryption, resulting in a decrypted random session key. K .

[0026] In one specific embodiment, the drone's identity authentication is completed through step 2, which may specifically include: Step 2.1: The drone generates random numbers. u And send a connection request and a random number to the regulatory platform.u .

[0027] Specifically, after the drone is started, its trusted takeover module initiates an identity authentication process, and the drone generates high-quality random numbers. u And send a connection request and a random number to the regulatory platform. u .

[0028] Step 2.2: After receiving the connection request, the monitoring platform generates a high-quality random number. g and will regulate platform certificates and random numbers g Send to the drone.

[0029] Step 2.3: After receiving the regulatory platform certificate, the drone verifies the certificate using the CA public key. If the verification is successful, it constructs a sequence containing a random number. u and random numbers g The drone certificate, the authentication message, and the digital signature of the authentication message are sent to the regulatory platform.

[0030] Specifically, after receiving the regulatory platform certificate, the drone uses its local CA public key to verify the certificate, checking if the digital signature is correct, valid, and if the domain name and purpose match. If all verifications pass, a random number containing the drone's information is constructed. u Random numbers from regulatory platforms g The system sends the authentication message and digitally signs the authentication message using the local drone private key. Then, it sends the drone certificate, the authentication message, and the digital signature of the authentication message to the regulatory platform.

[0031] Step 2.4: After receiving the drone certificate, the monitoring platform sequentially verifies the digital signature in the drone certificate, the drone public key and drone identity information in the drone certificate, the digital signature of the authentication message, and the random number in the authentication message. u and random numbers g After successful verification, a verification success message is generated and returned to the drone.

[0032] In an optional embodiment, step 2.4 includes: After receiving the drone certificate, the monitoring platform uses the CA public key to verify the digital signature in the drone certificate. It then compares the drone public key and drone identity information from the verified certificate with the drone public key and drone identity information stored on the monitoring platform. If the verification is successful, the platform obtains the correct drone public key. The monitoring platform then uses the correct drone public key to verify whether the digital signature of the received authentication message corresponds to the received authentication message. If so, it uses the random number generated from the verified authentication message... u and random numbersg With the random number in step 2.2 u and random numbers g The verification is performed. If the verification is successful, a verification success message is constructed and returned to the drone.

[0033] Specifically, after receiving the drone certificate, the monitoring platform decrypts it using the CA public key to obtain the drone's public key and identity information. It then verifies these against the drone's public key and identity information stored on the monitoring platform. If the verification passes, the platform obtains the correct drone public key. Next, it uses the correct drone public key to verify the digital signature of the authentication message, checking if the digital signature corresponds to the authentication message received by the monitoring platform. If so, it uses the random number generated from the verified authentication message. u and random numbers g Random numbers used in previous interactions with drones and regulatory platforms u and random numbers g The system performs a comparison, and if they match, a successful verification message is constructed and returned to the drone, thus preventing replay.

[0034] Step 2.5: After receiving the successful verification message, the drone generates and stores a random session key locally. K And use the public key of the monitoring platform stored in the drone to set up a random session key. K Encryption is performed, followed by the encrypted random session key. K Send to the regulatory platform.

[0035] Specifically, after receiving the successful verification message, the drone uses the cryptographically secure random source provided by the trusted takeover module's operating system to generate a cryptographically secure random number, which is then used as a high-entropy random session key. K It is stored locally on the drone, and the public key of the monitoring platform stored locally on the drone is used to create a random session key. K It is then encrypted and sent to the regulatory platform.

[0036] Step 2.6: The monitoring platform receives the encrypted random session key. K Then, the encrypted random session key is encrypted using the private key of the monitoring platform. K Decrypt to obtain the random session key. K .

[0037] Specifically, the monitoring platform receives the encrypted random session key sent by the drone. K Then, the local monitoring platform's private key was used to encrypt the random session key. K Decrypt to obtain the random session key. KSubsequent communications can then utilize the random session key obtained after decryption by the monitoring platform. K Encrypt control commands and status data for protection.

[0038] Step 3: The UAV periodically collects UAV situational data and combines it with external constraint information obtained from the monitoring platform. The UAV performs multi-dimensional anomaly judgment locally through the anomaly judgment unit to obtain multi-dimensional judgment results, and executes the trusted management and control process for the UAV in accordance with Step 4.

[0039] In one specific embodiment, the situational awareness of the UAV is completed through step 3, which may specifically include: Step 3.1: The drone completes identity authentication and establishes a random session key with the monitoring platform. K Subsequently, the UAV's trusted takeover module periodically collects and generates UAV situational data, and uses a random session key. K Encryption and integrity protection are applied to UAV situational data to obtain protected situational data messages.

[0040] Specifically, the drone completes identity authentication and establishes a random session key. K Subsequently, the trusted takeover module enters the situational awareness data reporting mode, periodically collecting and generating UAV situational data, using a random session key. K The UAV situational awareness data is encrypted to obtain ciphertext situational awareness data, and then a random session key is used. K The message authentication code algorithm calculates a message authentication code on the ciphertext of the situation data, thereby obtaining a situation data message containing the ciphertext of the situation data and the message authentication code.

[0041] Furthermore, the collected UAV situational data includes: UAV timestamp, real-time location information (latitude / longitude), speed information, heading / attitude information, flight trajectory point sequence or trajectory increment, key sensor status (such as GNSS quality, barometer altitude, IMU health), flight control working status, link status, and mission-related status.

[0042] Step 3.2: The trusted takeover module performs preprocessing and standardized encapsulation on the UAV situational data to obtain situational feature frames. The trusted takeover module also requests and caches external constraint information from the access control module of the monitoring platform for determining the legality and safety of the UAV's flight behavior.

[0043] Specifically, the preprocessing operation involves the trusted takeover module sequentially performing missing value processing, outlier screening (physical upper and lower limits / rate upper limit), unit and coordinate system normalization, time alignment and resampling, and sliding window buffering on the UAV situational data to obtain preprocessed features. Missing value processing addresses missing data points using linear interpolation. Outlier screening filters out obviously unreasonable or physically impossible data by setting physical upper and lower limits and rate upper limits. Unit and coordinate system normalization unifies all data to the same metric standard and spatial reference system. Time alignment and resampling resolve issues of different data acquisition frequencies and incomplete timestamp synchronization, generating a set of regularized data under the same time reference. Sliding window buffering converts continuous data into fixed-length, chronologically ordered data blocks using a preset window and sliding step size. After preprocessing the UAV situational data, the preprocessed data is packaged into a fixed-format data packet, which becomes the situational feature frame. Furthermore, the trusted takeover module needs to request the necessary external constraint information for judgment from the access control module of the monitoring platform and cache it on the UAV.

[0044] Furthermore, external constraint information includes authorized airspace resource information corresponding to the UAV's identity, access policy information (access control rules bound to the UAV's identity), task constraints (specific restrictions on the tasks currently authorized for the UAV to perform), policy parameters and anomaly thresholds (specific parameters and thresholds used for various anomaly detection algorithms (such as flight status, trajectory deviation), and the model version number of the anomaly detection model. Authorized airspace resource information includes permitted flight areas, permitted flight altitude ranges, permitted flight time windows, permitted flight routes, and temporary aircraft control areas.

[0045] Step 3.3: Send the situation feature frame and external constraint information to the anomaly determination unit in the trusted takeover module. The anomaly determination unit performs multi-dimensional anomaly determination and obtains multi-dimensional determination results.

[0046] Specifically, the situation feature frames and external constraint information are forwarded together to the anomaly detection unit in the trusted takeover module. The anomaly detection unit uses the AI ​​development board to perform various anomaly detections on the drone locally, so as to avoid uploading the full situation data to the monitoring platform and causing latency and link dependence.

[0047] Before the drone is launched, the anomaly detection model needs to be pre-trained and deployed for subsequent flight status normalization determination. Drone situational data from multiple normal flight missions performed by the same model of drone is collected as the model baseline dataset. The baseline data is preprocessed, standardized, and sliced ​​using a sliding window to construct temporal feature samples. A Bi-LSTM model is used as the anomaly detection model, with the training objective being to minimize the mean squared error between the predicted value and the true value at the next time step until the Bi-LSTM model converges. The trained Bi-LSTM model parameter file and the corresponding standardized parameters (mean / standard deviation) are packaged and deployed to the AI ​​development board.

[0048] Furthermore, the multi-dimensional anomaly determination includes airspace boundary violation determination, flight status normality determination, trajectory consistency and mission anomaly determination, and may also include other anomaly determinations; the multi-dimensional determination results include airspace boundary violation determination results, flight status normality determination results, trajectory consistency and mission anomaly determination results, and may also include other anomaly determination results.

[0049] In an optional embodiment, the method for determining airspace boundary crossing includes: establishing a UAV situational awareness determination baseline based on external constraint information; converting the UAV's real-time position or flight trajectory point sequence to a unified coordinate system; calculating the spatial relationship between the UAV situational awareness determination baseline and the UAV situational awareness determination baseline; and when the calculation result indicates that the UAV has triggered an abnormal condition, the airspace boundary crossing determination result is that an airspace boundary crossing abnormal event has occurred.

[0050] Specifically, the trusted takeover module establishes a drone situational awareness judgment baseline through external constraint information. This baseline refers to a set of reference standards or rules used to determine whether the drone's current flight status is compliant. The trusted takeover module then performs airspace boundary violation judgment. Specifically, by obtaining external constraint information from the access control module of the regulatory platform, it forms the regulatory constraints required for drone situational awareness judgment. These regulatory constraints refer to specific restrictive rules extracted from the external constraint information that apply to the drone's current flight. For example, your permitted flight area is a rectangle formed by points A and B, the permitted altitude is 50-150 meters, and the permitted time is 14:00-16:00. Then, by parsing, transforming, and instantiating the regulatory constraints, a specific, calculable set of judgment standards and rules that the program can directly use is formed, i.e., the drone situational awareness. The perception and judgment baseline: After the trusted takeover module converts the real-time position or flight trajectory point sequence of the UAV to a unified coordinate system, it calculates the spatial relationship with the UAV situational perception and judgment baseline. When the calculation result indicates that the UAV has triggered abnormal conditions (such as the position point being in a no-fly zone or exceeding the boundary of the authorized area, the altitude exceeding the upper or lower limit of the authorized altitude, or the flight time exceeding the authorized time window), it indicates an airspace boundary violation anomaly. The airspace boundary violation judgment result is that an airspace boundary violation anomaly event has occurred, and an airspace boundary violation anomaly event is generated. The airspace boundary violation anomaly event includes the boundary violation type, occurrence time, boundary violation point, boundary violation duration, and boundary violation trend.

[0051] In another optional embodiment, the method for determining the normality of flight status includes: constructing a flight status feature vector based on UAV situational data; performing rule-based determination on the flight status feature vector; if the rule-based determination detects an anomaly, the flight status normality determination result is an abnormal flight status; if the rule-based determination does not detect an anomaly, then continuing to use a pre-trained Bi-LSTM model to perform model-based determination on the flight status feature vector; when the model-based determination detects an anomaly, the flight status normality determination result is an abnormal flight status. Here, rule-based determination involves detecting whether the flight status feature vector exceeds a preset physical safety threshold or whether there is a logical conflict; model-based determination involves determining the first... h The theoretical value of the flight state at time +1 and the first h Whether the Manhattan distance between the actual observations at time +1 is greater than the adaptive distance threshold.

[0052] Specifically, the trusted takeover module performs flight status normality determination. First, it constructs a flight status feature vector based on UAV situational data. This feature vector is a numerical vector composed of multi-dimensional parameters directly or indirectly related to the UAV's flight status, used to quantitatively describe the UAV's current flight characteristics and system health. The trusted takeover module first performs rule-based determination on the flight status feature vector, checking whether it exceeds a preset physical safety threshold or whether there is a logical conflict. If the flight status normality determination result is an abnormal flight status, otherwise, model determination continues. For example, if the UAV's speed exceeds a preset speed safety threshold or its flight attitude exceeds a preset attitude safety threshold, it indicates an abnormal flight status. A logical conflict also indicates an abnormal flight status. In this embodiment, a logical conflict refers to a situation where, although a single data item does not exceed its respective physical upper or lower limit, there is a semantic or physical inconsistency between it and other fields, temporal relationships, flight status, control commands, or coordinate references. For example, an abnormal GNSS quality but a rapid change in position constitutes a logical conflict. When performing model determination, the AI ​​development board runs a pre-trained Bi-LSTM model locally, using a sliding window mechanism to select the most recently trained data. h The flight state feature vector at time step i is input into the pre-trained Bi-LSTM model to obtain the i-th time step. h The theoretical value of the flight state at time +1 is used to calculate the th... h The theoretical value of the flight state at time +1 and the first h The Manhattan distance between the actual observations at time +1 is used as the anomaly score. The Manhattan distance is then compared in real time with the adaptive distance threshold derived from the normal flight baseline. If the anomaly score exceeds the adaptive distance several times, the flight status is determined to be abnormal, thus effectively detecting slow drift, concealed anomalies, and multivariate coupling anomalies.

[0053] Furthermore, the flight state feature vector includes velocity, acceleration, vertical velocity, attitude angle and angular velocity, heading rate of change, GNSS quality indicators, key sensor consistency indicators (such as the difference between GNSS altitude and barometric altitude and its rate of change), power / battery status, flight control health status, link latency and packet loss.

[0054] In another optional embodiment, the method for determining trajectory consistency and task anomaly includes: when the monitoring platform has authorized flight routes or task constraints, calculating the deviation between the actual flight route of the UAV and the authorized flight route; if the deviation is greater than the trajectory deviation threshold, triggers a temporary control area, or has illegal task characteristics, then the trajectory consistency and task anomaly determination result is trajectory consistency and task anomaly.

[0055] Specifically, the trusted takeover module performs trajectory consistency and mission anomaly determination. When the monitoring platform has authorized flight paths or mission constraints, it calculates the deviation between the UAV's actual flight path and the authorized flight path (the deviation can be calculated through lateral offset, heading deviation, or timing deviation of arrival at key waypoints), and dynamically updates the constraints in conjunction with real-time temporary airspace control information. If trajectory deviation occurs, a temporary aircraft control area is triggered (the UAV enters a dynamically designated no-fly / restricted-fly zone), or illegal mission characteristics are present (the UAV's actual behavior violates mission constraints), the trajectory consistency and mission anomaly determination result is trajectory consistency and mission anomaly, and a corresponding anomaly event is formed.

[0056] In another optional embodiment, the method for scalable determination of other anomalies includes: the monitoring platform uniformly maps multiple preset anomaly types into a standardized set of anomaly features including multidimensional numerical vectors; the trusted takeover module obtains the standardized set of anomaly features and analyzes and evaluates the multidimensional numerical vectors in the standardized set of anomaly features to identify unknown anomalies or anomalies composed of multiple anomalies, and obtains other anomaly determination results.

[0057] Specifically, the trusted takeover module performs scalable judgments on other anomalies. The monitoring platform establishes and maintains an anomaly type library containing various anomaly types, including link anomalies, data anomalies (such as forgery / replay / abnormal frequency), suspected sensor spoofing, control behavior anomalies, and sudden changes in the operating environment. The monitoring platform maps various anomaly types in the anomaly type library into a standardized set of anomaly features through a judgment plugin interface. This standardized set of anomaly features is a multi-dimensional numerical vector, where each dimension represents a normalized quantification index of an anomaly feature. This normalized quantification index can be a numerical range or a probability. The UAV's trusted takeover module obtains the standardized set of anomaly features through the judgment plugin interface, analyzes the multi-dimensional values ​​in the anomaly feature set locally on the UAV, and uses intelligent methods (machine learning or AI algorithms) to evaluate the analysis results in real time to identify unknown anomalies or combined anomalies composed of multiple anomalies, thereby improving the ability to identify unknown anomalies and combined anomalies.

[0058] Step 3.4: The trusted takeover module fuses the multi-dimensional judgment results to generate anomaly confidence and risk score. When the anomaly confidence is greater than the confidence threshold, it continues to judge whether the risk score is greater than the high-risk threshold or whether it hits a high-risk anomaly rule. If so, the trusted takeover module uses a random session key to process the anomaly event information. K After encryption and integrity protection, the data is sent to the regulatory platform for online processing.

[0059] Specifically, the Trusted Takeover module performs comprehensive analysis and triggers tiered responses. It integrates the results of airspace boundary violations, flight status normality assessments, trajectory consistency, and mission anomaly assessments (and may also include other anomaly assessments if applicable) to generate a total anomaly confidence level, risk score, and response level, and outputs a situational awareness conclusion. Specifically, the confidence level of each judgment result is calculated separately, and then the anomaly confidence level is obtained by weighting them according to preset weights. The risk score is a quantitative value used to measure the severity of the anomaly. The risk score can be set according to actual usage needs. For example, the calculation formula of the risk score is R=100×(αC+βS+γI+δT+εM), where R is the risk score, C is the anomaly confidence level, S is the anomaly severity, I is the scope of impact, T is the duration or frequency, M is the mission criticality or airspace sensitivity level, and α, β, γ, δ, and ε are all weights. The handling level is the priority of handling based on the risk score (such as low, medium, and high risk). For example, if the risk score is 40-60, the handling level is low risk; if the risk score is 60-80, the handling level is medium risk; and if the risk score is higher than 80, the handling level is high risk.

[0060] After determining the anomaly confidence level and risk score, the relationship between the anomaly confidence level and the confidence threshold is assessed. If the anomaly confidence level is greater than the confidence threshold, the risk score is further assessed to see if it exceeds the high-risk threshold or if the rule is determined to be a high-risk anomaly rule. If the risk score exceeds the high-risk threshold or the rule is determined to be a high-risk anomaly rule, the anomaly is assessed as a high-level risk, and the trusted takeover module uses a random session key. K Abnormal event information is encrypted and protected for integrity before being sent to the monitoring platform. The monitoring platform then triggers subsequent trusted control processes, issuing high-level risk handling strategies or control commands to the drone for online handling. For other non-high-level risks, the trusted takeover module can directly obtain and execute handling strategies from its local emergency response strategy library.

[0061] High-risk anomaly rules include: drones entering no-fly zones or sensitive airspaces, continuously and seriously crossing boundaries, suspected GNSS deception / interference, and obvious track deviation or unreliable navigation, and abnormal flight status that has affected safety control, such as abnormal attitude, abnormal speed and control instability occurring simultaneously.

[0062] Step 3.5: The monitoring platform collects confirmed abnormal situational data and false alarm situational data uploaded by the UAV. The false alarm situational data is added to the positive sample training set for incremental training or fine-tuning of the Bi-LSTM model. The confirmed abnormal situational data is used as the validation and test set to evaluate the current Bi-LSTM model, complete the update of the Bi-LSTM model, and distribute the updated Bi-LSTM model to the UAV through an encrypted channel for replacement and update.

[0063] Specifically, the regulatory platform iteratively optimizes the Bi-LSTM model using logs (real records of anomalous events). The trusted takeover module records situational awareness results and necessary summary logs locally, and can subsequently upload the results and logs to the regulatory platform in batches as needed for auditing and model optimization. The regulatory platform collects confirmed anomalous situational data and false alarm situational data uploaded by UAVs. For false alarm situational data, it is added to the positive sample training set for incremental training or fine-tuning of the Bi-LSTM model, enabling it to learn to predict such extreme situations and thus reduce prediction errors. For confirmed anomalous situational data, it is used as a validation and test set for sensitivity assessment and threshold calibration before the Bi-LSTM model is released, ensuring that the new Bi-LSTM model reduces the false alarm rate without reducing its ability to detect known threats. The regulatory platform distributes the trained and validated Bi-LSTM model parameters and threshold configurations to the UAV side via an encrypted channel for replacement and updates.

[0064] Step 4: When the triggering conditions are met, the trusted takeover module of the UAV controls the UAV to enter the advanced control mode. After the control command is verified, the trusted takeover module sends a mode switching request to the flight control system of the UAV to achieve the highest priority control and disables the UAV's remote controller, data transmission module and network control channel. Then the UAV executes the control command.

[0065] Step 4.1 When any one of the three triggering conditions occurs, the trusted takeover module of the drone triggers the trusted management process to enter the advanced control mode. The first triggering condition is that the regulatory platform initiates takeover. The second triggering condition is that the multi-dimensional judgment result determines that the drone has a high-level risk and reports it to the regulatory platform. The third triggering condition is that the multi-dimensional judgment result determines that the drone has a non-high-level risk.

[0066] Specifically, the trusted takeover module triggers the trusted management process to enter advanced control mode. During the initialization phase, a local baseline version of the local emergency response strategy library is pre-loaded. This library contains standard action mapping tables for different risk levels and anomaly types. During operation, the trusted takeover module periodically checks the strategy version information released by the regulatory platform or responds to strategy update notifications issued by the platform. It downloads incremental update packages through an encrypted channel, hot-updating the new rules to the local emergency response strategy library and making them effective immediately. This ensures that the drone can execute actions according to the latest regulatory rules when subsequent control is triggered. The trusted takeover module triggers the trusted management process to enter the preset control mode when any of the following triggering conditions occur: the first triggering condition is that the regulatory platform proactively initiates takeover based on the airspace control or key target protection needs of temporary activities; the second triggering condition is that step 3 determines that the drone has a high-level risk, and the drone reports the abnormal event information to the regulatory platform; the third triggering condition is that step 3 determines that the drone has a non-high-level risk, in which case the drone can directly obtain the response strategy from the local emergency response strategy library.

[0067] In addition, to avoid false triggering, the trusted takeover module needs to perform the following verification steps before entering advanced control mode: For control commands issued by the monitoring platform, verify the current random session key. K Whether the event is valid, whether the control instructions sent by the monitoring platform are complete, and whether the abnormal event is valid and has not been revoked; for events triggered locally by the drone, verify the persistence of the abnormal event and its policy matching degree. Policy matching degree compares the various attributes of the abnormal event with the applicable scope of policies in the local emergency response policy library, such as field matching and threshold matching. Field matching includes, for example, ensuring consistency between the applicable anomaly type and whether the policy is applicable in the current task stage. Threshold matching includes, for example, ensuring that the risk score reaches the minimum value applicable to the policy and the airspace requirements for running the policy. At the same time, an audit record for this takeover event needs to be generated locally on the drone. The audit record includes the event trigger source, timestamp, anomaly level, summary evidence, and policy version number.

[0068] Step 4.2: In advanced control mode, the trusted takeover module receives control commands. If the control command is issued by the monitoring platform, the trusted takeover module receives the command via a random session key. K The encrypted control command is then decrypted and its integrity is verified sequentially. If the integrity verification passes, the control command undergoes semantic validity verification and security boundary verification. If the verification passes, step 4.3 is executed. If the control command is issued locally by the UAV, semantic validity verification and security boundary verification are performed on the control command. If the verification passes, the corresponding action sequence is retrieved from the local emergency response strategy database according to the control command issued locally by the UAV, and step 4.3 is executed.

[0069] Specifically, the trusted takeover module obtains and verifies the control command based on the trigger source. If the control command is issued by the regulatory platform, the received command is a randomized session key. K The encrypted control commands are then decrypted, and the resulting random session key is used. K Integrity verification is performed. If the integrity verification passes, semantic legality verification and security boundary verification are performed on the control instructions issued by the monitoring platform. If the verification fails, execution is rejected and the reason for the control failure is returned to the monitoring platform. If the verification succeeds, step 4.3 is executed in advanced control mode. If the control instruction is triggered locally by the drone, semantic legality verification and security boundary verification are performed directly on the control instruction. If the verification fails, execution is rejected and the reason for the control failure is returned to the monitoring platform. If the verification succeeds, the corresponding action sequence is retrieved from the local emergency response strategy library according to the control instruction issued locally by the drone in advanced control mode, and step 4.3 is executed.

[0070] Furthermore, semantic legality verification includes whether the instruction type is within the allowed set and whether the instruction format conforms to the standard. Safety boundary verification includes whether the target altitude, speed, and heading are within the safe range, whether they conflict with the constraints of the current temporary aircraft control area, and whether they are compatible with the current flight phase (takeoff / route / landing) of the UAV.

[0071] Step 4.3: The trusted takeover module sends a mode switching request to the UAV's flight control system, enabling the UAV to enter a preset mode that accepts external control targets. This places the control targets provided by the supervisory platform through the trusted takeover module at the upper-level entry point of the flight control system's control loop. In the preset mode, the trusted takeover module continuously sends target setpoints to the flight control system at fixed control cycles, causing the flight control system to generate low-level outputs to the motors or control surfaces, thereby achieving the highest priority control from the supervisory platform.

[0072] Specifically, the UAV switches modes and establishes a top-level control loop. The trusted takeover module sends a mode switching request to the UAV's flight control system to enable the UAV to enter a preset mode that accepts external control targets, such as GUIDED mode. This places the control targets provided by the supervisory platform through the trusted takeover module at the upper-level entry point of the flight control system's control loop. This upper-level entry point is the input / command injection terminal of the control loop. The control target refers to the target control state that the supervisory platform sets and hopes the UAV will ultimately achieve. The control targets include several targets, such as at least one of position, speed, acceleration, heading, and heading angular velocity. Each target corresponds to a setpoint that needs to be achieved. Therefore, the trusted takeover module continuously sends the target setpoint to the flight control system at a fixed control cycle, so that the controller inside the flight control system can directly control and generate the low-level output to the motors or control surfaces. That is, after receiving the upper-level control command, the flight control system calculates through its internal control algorithm (such as a PID controller) and finally generates the original electrical signal that can directly drive the physical actuators (motors, servos / control surfaces), thereby realizing the supervisory platform's highest-priority control over the flight control system.

[0073] In addition, to ensure the continuity and controllability of control, when using speed or acceleration setpoints, the trusted takeover module retransmits the target quantity at a frequency no less than required by the flight control technical documents to prevent the flight control system from stopping or entering hold and braking behavior due to timeout.

[0074] Furthermore, the target setpoint is that at least one of position, velocity, acceleration, heading, and heading angular velocity needs to reach the target value set by the control target.

[0075] Step 4.4: The trusted takeover module uses MAVLink (Micro Air Vehicle Link) control messages to encapsulate the target settings and applies constraints to all target settings. When a target setting exceeds the constraint range, the trusted takeover module trims the target setting to the constraint range.

[0076] Specifically, the trusted takeover module encapsulates the target setpoint using the MAVLink communication protocol, enabling the control of the target setpoint to fall into any of the following three categories: 1) Target position, velocity, acceleration, and heading control based on the local NED coordinate system (North-East-Down coordinate system). For example, SET_POSITION_TARGET_LOCAL_NED is used to send target setpoints based on the local NED coordinate system for position, velocity, acceleration, or heading control. The effective field is selected via type_mask (type_mask is a key bitmask field used for control messages in the MAVLink communication protocol). SET_POSITION_TARGET_LOCAL_NED is a specific message type defined in the MAVLink communication protocol, used to send target setpoints based on the local NED coordinate system to the UAV. 1) Position, velocity, acceleration, or heading control of the target in the D coordinate system; 2) Target position, velocity, and heading control based on global coordinates and altitude, such as using SET_POSITION_TARGET_GLOBAL_INT. SET_POSITION_TARGET_GLOBAL_INT is a specific message type defined in the MAVLink communication protocol, used to send the UAV position, velocity, acceleration, or heading control target based on the global coordinate system; 3) Target attitude and climb rate or thrust control when there is no GPS or attitude takeover is required, such as using SET_ATTITUDE_TARGET, and configuring the type_mask according to its field constraints. SET_ATTITUDE_TARGET is a specific message type defined in the MAVLink communication protocol, used to send target attitude and thrust control commands to the UAV.

[0077] In addition, to avoid secondary risks caused by takeover orders, the trusted takeover module imposes limiting constraints on all target settings. These constraints are amplitude and speed limits, including maximum horizontal speed, maximum vertical speed, maximum acceleration, maximum rate of change of heading, minimum safe altitude, and boundary constraints consistent with temporary airspace control. When a target setting exceeds the limiting constraints, the trusted takeover module automatically trims the target setting to the limiting constraints and records the differences and reasons before and after the trimming in the audit log.

[0078] Step 4.5: After disabling the drone's remote controller, data transmission module, and network control channel, execute control commands. Once the drone's abnormal state is eliminated or the monitoring platform lifts its control, the trusted takeover module exits the advanced control mode.

[0079] Step 4.51: Disable the output of the RC receiver by using the flight control parameter RC_OPTIONS to block the drone's remote controller, block the drone's data transmission module by stopping bidirectional communication and GCS identity constraints, and block the drone's network control channel by filtering network traffic.

[0080] In one specific embodiment, disabling the drone's remote controller by using the flight control parameter RC_OPTIONS to disable the output of the RC receiver (RemoteControl receiver) includes: After entering advanced control mode, bit 0 of the flight control parameter RC_OPTIONS configured in the trusted takeover module is set so that the flight control system ignores the output of all connected RC receivers, and bit 1 of the flight control parameter RC_OPTIONS is set to ignore RC_override from the ground station, thereby disabling the remote controller.

[0081] Specifically, to prevent the flight control system's autonomous fault protection mechanism (such as automatic return to home or landing) from being mistakenly triggered due to signal blocking, the trusted takeover module first configures the flight control parameters (i.e., the parameters of the flight control system) via MAVLink commands, setting FS_THR_ENABLE (remote controller failure protection) and FS_GCS_ENABLE (ground station failure protection) to 0. This temporarily disables the flight control system's autonomous response capability to the loss of remote control and data transmission links, ensuring that the monitoring platform obtains sole and absolute control. After entering advanced control mode, the trusted takeover module blocks the remote controller's control channels by configuring the flight control parameter RC_OPTIONS. The flight control parameter RC_OPTIONS is a configurable parameter in the flight control system used to control behaviors related to the RC receiver. Specifically, setting bit 0 of the flight control parameter RC_OPTIONS (i.e., setting bit 0 of the flight control parameter RC_OPTIONS to 1) allows the flight control system to ignore the output of any connected RC receiver, thereby blocking the remote controller's output from affecting control channels such as attitude, throttle, and mode on the flight control system side. Meanwhile, to prevent unauthorized ground stations from interfering with control through RC overlay, bit 1 in the flight control parameter RC_OPTIONS can be set (i.e., the first bit of the flight control parameter RC_OPTIONS is set to 1) to ignore RC overlay from the ground station and disable such RC overlay control.

[0082] In one specific embodiment, the data transmission module of the UAV is shielded by stopping bidirectional communication and GCS (Ground Control Station) identity constraints, including: After entering advanced control mode, the trusted takeover module stops forwarding the flight control system's status information to the data transmission module, and also stops receiving control messages transmitted by the data transmission module. It then configures the flight control parameter SYSID_MYGCS to the MAVLink ground control station ID, enabling the flight control system to form the desired GCS identity. After that, it enables SYSID_ENFORCE, forcing the flight control system to accept data packets only from the MAVLink ground control station ID.

[0083] Specifically, upon entering advanced control mode, the trusted takeover module proactively stops forwarding flight control system status information to the airborne port of the data transmission module. This means it stops outputting telemetry data and status streams to the corresponding serial port and ceases receiving control messages from the airborne port of the data transmission module. This reduces the opportunity for external data transmission links to continuously acquire and reuse the flight control system's status information. Simultaneously, the trusted takeover module configures the flight control parameter SYSID_MYGCS to represent the MAVLink ground control station ID of the supervisory platform, enabling the flight control system to establish the desired GCS identity. The flight control parameter SYSID_MYGCS is a system parameter in the flight control system used to specify the identity of the legitimate ground control station, and the MAVLink ground control station ID is a numerical identifier in the MAVLink communication protocol used to uniquely identify the ground control station. Furthermore, enabling SYSID_ENFORCE forces the flight control system to accept only data packets from the desired MAVLink ground control station ID, rejecting control messages originating from other system IDs at the protocol level. This disables or significantly weakens the control of the non-supervisory platform's data transmission module. SYSID_ENFORCE is a flight control parameter used to control whether the flight control system enforces source system ID checks for MAVLink messages.

[0084] In one specific embodiment, filtering network traffic to block the drone's network control channel includes: After entering advanced control mode, configure traffic forwarding rules and firewall rules in the trusted takeover module, set the default inbound policy, outbound policy and forwarding policy to drop, and then only add whitelist rules that allow access to the monitoring platform IP and monitoring platform port, as well as rules that allow local loopback interface communication, and configure the flight control parameter NET_ENABLE to disable the network protocol stack function of the flight control system.

[0085] Specifically, upon entering advanced control mode, the trusted takeover module executes network blocking policies to cut off all network control paths from non-supervisory platforms. First, the trusted takeover module configures local traffic forwarding rules and firewall rules (such as iptables). Traffic forwarding rules are a set of policies configured within the trusted takeover module to control how the module handles packets arriving at the module when the destination address is not the local machine (whether to forward the packet to another network interface / next hop, drop the packet, or perform other operations). The default inbound (INPUT), outbound (OUTPUT), and forwarding (FORWARD) policies are set to drop, thus prohibiting all external network traffic from entering or leaving the module. Based on this, only whitelist rules allowing access to the supervisory platform's IP address and port, as well as rules allowing communication via the local loopback interface (localhost), are added to ensure that only the encrypted channel with the supervisory platform remains connected. Second, the trusted takeover module forcibly disables the flight control system's own network protocol stack by configuring the flight control parameter NET_ENABLE, preventing the flight control system from establishing unauthorized UDP / TCP connections directly through the Ethernet port or WiFi module.

[0086] Step 4.52: Execute control commands. Once the abnormal state of the UAV is eliminated or the monitoring platform releases control, the trusted takeover module exits the advanced control mode.

[0087] Specifically, after completing the above steps, the drone can execute the received control commands. Once the drone's abnormal state is correctly eliminated or the monitoring platform actively releases control, the trusted takeover module exits the advanced control mode and restores the drone to its state before entering the advanced control mode.

[0088] Before executing the trusted management process, the trusted takeover module records various parameters and flight-related information locally on the UAV. At the end of the trusted management process, the trusted takeover module, according to preset recovery policies and critical configurations such as firewall rules, revokes or restores key parameters such as FS_THR_ENABLE, FS_GCS_ENABLE, RC_OPTIONS, SYSID_MYGCS, SYSID_ENFORCE, and NET_ENABLE based on the records, restores necessary telemetry forwarding, and then stops the injection of target setpoints. Simultaneously, key event information during the takeover period is archived into audit logs, such as triggering reasons, execution sequence, key parameters, duration, and final state, to support post-event review and accountability.

[0089] The low-altitude networked unmanned aerial vehicle (UAV) safety management method provided by this invention has the following four significant advantages: First, the unified identity authentication mechanism effectively identifies illegal drones to prevent identity theft. This invention extracts multi-element identity information strongly bound to the device, such as RFID fingerprints, manufacturing model numbers, and hardware trust metrics, and binds this information to the drone's public key. This information is then submitted to a monitoring platform, where the root CA issues a drone certificate after verification, serving as the basis for unified identity authentication. Compared to existing technologies that rely solely on easily forged serial numbers or network identifiers, this invention constructs a tamper-proof, strongly bound unified certificate-based identity system, significantly improving the ability to identify spoofed access and identity cloning, and enhancing the effectiveness of identifying and tracing responsibility for illegal drones.

[0090] Secondly, an end-to-end secure communication control link ensures resistance to link hijacking and tampering. This invention implements two-way authentication based on certificates, resists replay and impersonation through random number challenges and signature verification, and establishes a random session key after authentication. K This technology is used for subsequent end-to-end encryption and integrity protection. Compared with existing technologies that lack authentication or only use static keys, this invention can reduce the risk of attacks such as link hijacking and tampering, ensure the confidentiality, integrity and availability of the network control link, and improve communication reliability and anti-attack capabilities.

[0091] Third, the invention combines real-time situational awareness, tiered response, and cloud-based model iterative optimization on the edge, balancing real-time monitoring, accuracy, and adaptability. This invention collects and preprocesses situational data through a trusted takeover module on the UAV side, obtains external constraint information from the monitoring platform, and uses an AI development board to perform comprehensive judgments on the UAV regarding airspace incursions, flight status normality, trajectory consistency, mission anomalies, and scalable anomalies. This reduces latency and link dependence caused by full data uploads and improves real-time response. The judgment results are fused and assessed into three risk levels: high, medium, and low. High-risk anomaly information is encrypted and reported to the monitoring platform to trigger takeover. Medium and low-risk events are directly executed by the local emergency response strategy library, realizing a complete mechanism of edge-side judgment—tiered triage—control and response. Simultaneously, it supports an iterative mechanism of cloud-based retraining and timely updates on the edge, continuously optimizing the anomaly detection model using false positive and false negative samples. Compared with existing technologies that rely solely on the full data being sent to the platform for judgment or rely solely on position verification for boundary crossings, the present invention has a wider coverage of anomaly judgment, lower response latency, comprehensive identification and real-time alarm capabilities for multi-dimensional anomalies, and can also adapt to new flight anomalies and environmental noise through continuous learning.

[0092] Fourth, the forced takeover and dynamic policy updates under advanced control mode significantly enhance the determinism of regulatory command execution and its resistance to attacks. This invention constructs an advanced control mode by adding a trusted takeover module to the UAV side. It uses the GUIDED mode and sends target setpoints to achieve the highest priority control over the flight control system. Furthermore, it disables the remote controller via RC-related parameters, blocks data transmission ports and disables unauthorized data transmission control by configuring SYSID-related parameters, filters network traffic and disables other network-connected controls by configuring NET-related parameters, thereby shielding all ordinary control channels outside the regulatory platform. By shielding ordinary control channels outside the regulatory platform through these means, the forced execution of control commands is guaranteed. Compared to existing technologies that lack a forced execution mechanism or are easily bypassed, the combination of setpoint control and multi-channel shielding in this invention provides security control with resistance to bypassing, attacks, and forced execution, effectively addressing malicious manipulation and control struggle scenarios. Simultaneously, this invention supports incremental updates to the local policy library to adapt to dynamic regulatory rules, ensuring real-time compliance and effective implementation of control rules.

[0093] It should be noted that the terms "first," "second," etc., are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Rather, they are merely examples of apparatuses and methods consistent with some aspects of the invention.

[0094] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Furthermore, those skilled in the art can combine and integrate the different embodiments or examples described in this specification.

[0095] The above description, in conjunction with specific preferred embodiments, provides a further detailed explanation of the present invention. It should not be construed that the specific implementation of the present invention is limited to these descriptions. For those skilled in the art, various simple deductions or substitutions can be made without departing from the concept of the present invention, and all such modifications and substitutions should be considered within the scope of protection of the present invention.

Claims

1. A method for safety management and control of low-altitude networked unmanned aerial vehicles (UAVs), characterized in that, include: Step 1: The drone generates its own identity information locally and sends the drone's identity information and public key to the monitoring platform for verification. After successful verification, the monitoring platform generates a drone certificate based on the drone's identity information and public key, and sends the drone certificate, monitoring platform certificate, CA public key, and session public key to the drone. Step 2: The drone exchanges drone certificates and the monitoring platform certificates with the monitoring platform and verifies them. After successful verification, the monitoring platform verifies the authentication message and its digital signature. After successful verification, the drone uses the monitoring platform's public key to set a random session key. K After encryption, the data is sent to the monitoring platform for decryption to obtain a random session key. K ; Step 3: The UAV periodically collects UAV situational data and combines it with external constraint information obtained from the monitoring platform. The UAV performs multi-dimensional anomaly judgment locally through the anomaly judgment unit to obtain multi-dimensional judgment results, and executes the trusted management and control process for the UAV according to Step 4. Step 4: When the triggering conditions are met, the trusted takeover module of the UAV controls the UAV to enter the advanced control mode. After the control command is verified, the trusted takeover module sends a mode switching request to the flight control system of the UAV to achieve the highest priority control and disables the UAV's remote controller, data transmission module and network control channel. Then the UAV executes the control command.

2. The method for safety management and control of low-altitude networked unmanned aerial vehicles according to claim 1, characterized in that, Step 1 includes: Step 1.1: The regulatory platform generates and stores the root CA's public key and private key, as well as the regulatory platform's public key and private key locally. It also generates and stores a session public key and private key for session encryption. The platform combines the regulatory platform's identity information and the regulatory platform's public key to obtain combined data. The platform uses the CA private key to digitally sign the combined data to obtain a digital signature of the combined data. Finally, the platform obtains a regulatory platform certificate based on the regulatory platform's identity information, the regulatory platform's public key, and the digital signature of the combined data. Step 1.2: The drone generates and stores a public key and a private key locally, extracts the drone's radio frequency fingerprint, manufacturing model, and hardware trust metric as the drone's identity information, and sends the drone's public key and identity information to the monitoring platform. Step 1.3: After receiving the drone public key and the drone's identity information, the monitoring platform verifies the drone's identity information using the drone identity database. If the verification is successful, the monitoring platform uses the CA private key to digitally sign the drone public key and the drone's identity information to generate a drone certificate. Afterward, the monitoring platform sends the drone certificate, the monitoring platform certificate, the CA public key, and the session public key to the drone. Step 1.4: The drone stores the drone certificate, the monitoring platform certificate, the CA public key, and the session public key locally.

3. The method for safety management and control of low-altitude networked unmanned aerial vehicles according to claim 1, characterized in that, Step 2 includes: Step 2.1: The drone generates random numbers. u and send a connection request and the random number to the regulatory platform. u ; Step 2.2: After receiving the connection request, the monitoring platform generates a random number. g and the regulatory platform certificate and the random number g Send to the drone; Step 2.3: After receiving the regulatory platform certificate, the drone verifies the regulatory platform certificate using the CA public key. If the verification is successful, it constructs a sequence containing the random number. u and the random number g The drone certificate, the authentication message, and the digital signature of the authentication message are sent to the monitoring platform. Step 2.4: After receiving the drone certificate, the monitoring platform sequentially verifies the digital signature in the drone certificate, the drone public key and drone identity information in the drone certificate, the digital signature of the authentication message, and the random number in the authentication message. u and random numbers g The verification is performed, and once all verifications are successful, a verification success message is constructed and returned to the drone. Step 2.5: After receiving the successful verification message, the drone generates and stores a random session key locally. K and use the public key of the monitoring platform stored in the drone to access the random session key. K Encryption is performed, followed by the encrypted random session key. K Send to the aforementioned regulatory platform; Step 2.6: The monitoring platform receives the encrypted random session key. K Then, the encrypted random session key is encrypted using the private key of the monitoring platform. K Decrypt to obtain the random session key. K .

4. The method for safety management and control of low-altitude networked unmanned aerial vehicles according to claim 2, characterized in that, Step 2.4 includes: After receiving the drone certificate, the monitoring platform uses the CA public key to verify the digital signature in the drone certificate. It then verifies the drone public key and drone identity information in the verified drone certificate against the drone public key and drone identity information stored on the monitoring platform. If the verification is successful, the platform obtains the correct drone public key. The monitoring platform then uses the correct drone public key to verify whether the digital signature of the received authentication message corresponds to the received authentication message. If so, it uses the random number generated from the verified authentication message... u and random numbers g With the random number in step 2.2 u and random numbers g The verification is performed, and if the verification passes, a verification success message is constructed and returned to the drone.

5. The method for safety management and control of low-altitude networked unmanned aerial vehicles according to claim 1, characterized in that, Step 3 includes: Step 3.1: The drone completes identity authentication and establishes a random session key with the monitoring platform. K Subsequently, the trusted takeover module of the UAV periodically collects and generates UAV situational data, and uses the random session key. K Encrypt and protect the integrity of UAV situational data to obtain protected situational data messages; Step 3.2: The trusted takeover module performs preprocessing and standardized encapsulation on the UAV situational data to obtain situational feature frames, and the trusted takeover module requests and caches external constraint information for determining the legality and security of the UAV's flight behavior from the access control module of the monitoring platform. Step 3.3: Send the situation feature frame and the external constraint information to the anomaly determination unit in the trusted takeover module. The anomaly determination unit performs multi-dimensional anomaly determination and obtains multi-dimensional determination results. Step 3.4: The trusted takeover module fuses the multi-dimensional judgment results to generate anomaly confidence and risk score. When the anomaly confidence is greater than the confidence threshold, it continues to determine whether the risk score is greater than the high-risk threshold or whether it hits a high-risk anomaly rule. If so, the trusted takeover module uses a random session key to process the anomaly event information. K After encryption and integrity protection, the data is sent to the regulatory platform for online processing.

6. The method for safety management and control of low-altitude networked unmanned aerial vehicles according to claim 5, characterized in that, The multi-dimensional anomaly determination includes airspace boundary crossing determination, flight status normality determination, trajectory consistency determination, and mission anomaly determination. The multi-dimensional judgment results include airspace boundary crossing judgment results, flight status normality judgment results, trajectory consistency and mission anomaly judgment results; The method for determining airspace boundary crossing includes: establishing a UAV situational awareness determination baseline based on the external constraint information; converting the UAV's real-time position or flight trajectory point sequence to a unified coordinate system; calculating the spatial relationship between the UAV situational awareness determination baseline and the UAV; and when the calculation result indicates that the UAV has triggered an abnormal condition, the airspace boundary crossing determination result is an airspace boundary crossing anomaly. The method for determining the normality of flight status includes: constructing a flight status feature vector based on the UAV situational data; performing rule-based determination on the flight status feature vector; if the rule-based determination detects an anomaly, the flight status normality determination result is an abnormal flight status; if the rule-based determination does not detect an anomaly, then using a pre-trained Bi-LSTM model to perform model-based determination on the flight status feature vector; when the model-based determination detects an anomaly, the flight status normality determination result is an abnormal flight status. The rule-based determination involves detecting whether the flight status feature vector exceeds a preset physical safety threshold or whether there is a logical conflict; the model-based determination involves determining the first... h The theoretical value of the flight state at time +1 and the first h Whether the Manhattan distance between the actual observations at time +1 is greater than the adaptive distance threshold; The method for determining trajectory consistency and task anomaly includes: when the monitoring platform has authorized flight routes or task constraints, calculating the deviation between the actual flight route of the UAV and the authorized flight route; if the deviation is greater than the trajectory deviation threshold, triggers a temporary control area, or has illegal task characteristics, then the determination result of trajectory consistency and task anomaly is trajectory consistency and task anomaly.

7. The method for safety management and control of low-altitude networked unmanned aerial vehicles according to claim 6, characterized in that, Following step 3.4, the following is also included: Step 3.5: The monitoring platform collects the confirmed abnormal situational data and false alarm situational data uploaded by the UAV. The false alarm situational data is added to the positive sample training set to incrementally train or fine-tune the Bi-LSTM model. The confirmed abnormal situational data is used as the validation set and test set to evaluate the current Bi-LSTM model, complete the update of the Bi-LSTM model, and send the updated Bi-LSTM model to the UAV through an encrypted channel for replacement and update.

8. The method for safety management and control of low-altitude networked unmanned aerial vehicles according to claim 1, characterized in that, Step 4 includes: Step 4.1 When any one of the three triggering conditions occurs, the trusted takeover module of the drone triggers the trusted management process to enter the advanced control mode. The first triggering condition is that the monitoring platform initiates takeover. The second triggering condition is that the multi-dimensional judgment result determines that the drone has a high-level risk and reports it to the monitoring platform. The third triggering condition is that the multi-dimensional judgment result determines that the drone has a non-high-level risk. Step 4.2: In the advanced control mode, the trusted takeover module receives a control command. If the control command is issued by the monitoring platform, the trusted takeover module receives the command via a random session key. K The encrypted control command is then decrypted and its integrity is verified sequentially. After the integrity verification is passed, the control command undergoes semantic validity verification and security boundary verification. After the verification is passed, step 4.3 is executed. If the control command is issued locally by the UAV, the control command undergoes semantic validity verification and security boundary verification. After the verification is passed, the corresponding action sequence is retrieved from the local emergency response strategy library according to the control command issued locally by the UAV, and step 4.3 is executed. Step 4.3: The trusted takeover module sends a mode switching request to the UAV's flight control system, causing the UAV to enter a preset mode that accepts external control targets. This places the control target provided by the monitoring platform through the trusted takeover module at the upper-level entry of the flight control system's control loop. In the preset mode, the trusted takeover module continuously sends target setpoints to the flight control system at a fixed control cycle, causing the flight control system to generate low-level outputs to the motors or control surfaces, thereby achieving the highest priority control of the monitoring platform. Step 4.4: The trusted takeover module encapsulates the target setting value using the MAVLink communication protocol and applies constraints to all the target setting values. When the target setting value exceeds the constraint range, the trusted takeover module trims the target setting value to the constraint range. Step 4.5: After disabling the drone's remote controller, data transmission module, and network control channel, execute the control command. When the drone's abnormal state is eliminated or the monitoring platform releases control, the trusted takeover module exits the advanced control mode.

9. The method for safety management and control of low-altitude networked unmanned aerial vehicles according to claim 8, characterized in that, Step 4.5 includes: Step 4.51: Disable the output of the RC receiver by using the flight control parameter RC_OPTIONS to block the remote controller of the UAV, block the data transmission module of the UAV by stopping bidirectional communication and GCS identity constraints, and block the network control channel of the UAV by filtering network traffic; Step 4.52: Execute the control command. When the abnormal state of the UAV is eliminated or the monitoring platform releases control, the trusted takeover module exits the advanced control mode.

10. The method for safety management and control of low-altitude networked unmanned aerial vehicles according to claim 9, characterized in that, Step 4.51 includes: After entering advanced control mode, bit 0 of the flight control parameter RC_OPTIONS configured in the trusted takeover module is set so that the flight control system ignores the output of all connected RC receivers, and bit 1 of the flight control parameter RC_OPTIONS is set to ignore RC_override from the ground station, thereby shielding the remote controller from control. After entering advanced control mode, the trusted takeover module stops forwarding the status information of the flight control system to the data transmission module, and also stops receiving control messages transmitted by the data transmission module. It configures the flight control parameter SYSID_MYGCS as the MAVLink ground control station ID, so that the flight control system forms the desired GCS identity. Then, it enables SYSID_ENFORCE, forcing the flight control system to only accept data packets from the MAVLink ground control station ID. After entering advanced control mode, configure traffic forwarding rules and firewall rules in the trusted takeover module, set the default inbound policy, outbound policy and forwarding policy to drop, and then add only whitelist rules that allow access to the monitoring platform IP and monitoring platform port, as well as rules that allow local loopback interface communication, and configure the flight control parameter NET_ENABLE to disable the network protocol stack function of the flight control system.

Images