Unmanned aerial vehicle identity authentication method based on timely generation and update of authentication information

Abstract

This invention discloses a drone identity authentication method based on timely generation and updating of authentication information. The steps are as follows: A Physical Layer Anti-cloning Function (PUF) is used to generate unique identity information for each drone. The authentication message is constructed by combining the ID generated by the ground station for the drone with the identity information generated by the PUF. A lightweight hash algorithm is used as the hash function to encrypt the authentication message, and the drone's identity information is updated after each authentication. Both the ground station and the drone to be authenticated use the same lightweight hash algorithm to encrypt the authentication message, completing the generation and integrity authentication of the hash values ​​of all authentication messages during the protocol process. The corresponding final session key is generated through this algorithm. This invention has low computational complexity, reducing the computational cost and hardware implementation cost of the method, and improving the reliability of drone identity authentication.

Description

Technical Field

[0001] This invention belongs to the field of telecommunications technology, and further relates to a drone identity authentication method based on timely generation and updating of authentication information in the field of data information security technology. This invention employs a Physically Unclonable Function (PUF) to authenticate the identity of outdoor-deployed drones via a ground station. Background Technology

[0002] As the application of drones continues to expand, ensuring secure communication between drones and ground stations or swarms is crucial. Existing communication protocols are insufficient to completely defend against security threats to drones, including man-in-the-middle attacks, replay attacks, node capture, and tampering attacks. Although traditional internet communication has mature security authentication schemes that use stored encryption keys for node authentication, drones deployed outdoors are vulnerable to device capture attacks, leading to key leaks. Most existing drone communication protocols employ computationally and storage-intensive authentication protocols or introduce expensive dedicated security processors, which not only increase the computational burden and hardware footprint of drones but also significantly raise costs. Traditional authentication methods fail to adequately balance security and efficiency.

[0003] Xi'an University of Electronic Science and Technology proposed a dual authentication method for UAVs (UAVs) based on location cryptography, titled "A Method for UAV Identity Authentication and Key Negotiation Based on Location Cryptography" (Application No.: 202210816177.3, Publication No.: CN 115150828 A). This method utilizes physically unclonable functions (PFCs) and location cryptography to achieve dual authentication of UAV identity and location. When a UAV initiates an authentication request, it sends a random number, a PUF response, and location information to a ground station using a SHA-1 function to generate a hash value. When the ground station verifies the UAV's identity, it compares the received information with a pre-stored hash value of the location information. If the verification is successful, the ground station combines its own ID, the random number, and the pre-stored PUF response to recalculate the hash value and sends it to the UAV. The UAV then verifies the information again. If the verification is successful, both parties generate a session key using the random number generated from the two authentications combined with the PUF response, thus completing the authentication process. This technology uses location cryptography and unclonable functions to authenticate the UAV's identity, possessing the characteristic of being unforgeable, thereby ensuring the security of UAV communication. However, this method still has three shortcomings: First, although the method uses the location information of the UAV to participate in the authentication process, and the location cryptography technology is used to encrypt the transmission of authentication information, which protects the UAV's aerial location information to a certain extent, the GPS positioning signal is unstable and susceptible to interference, and may even fail to receive the signal, causing the identity authentication process to fail or terminate due to abnormal interference. Second, for UAV devices, this method uses the SHA-1 function as the hash function and a random number generator to ensure the freshness of the message. When facing large-scale UAV authentication, frequent hash calculations will increase the amount of computation. This method has a large amount of computation and requires a large amount of hardware area, which increases the hardware implementation cost. Summary of the Invention

[0004] The purpose of this invention is to address the shortcomings of the existing technology by proposing a drone identity authentication method based on timely generation and updating of authentication information. This method aims to solve the problems of existing GPS location information being easily interfered with during the authentication process, as well as the high computational load and hardware implementation cost.

[0005] The technical approach to achieving the objectives of this invention is as follows: This invention utilizes the Physical Layer Anti-cloning Function (PUF) to generate unique identity information for each drone. Since the identity information generated by the PUF is generated in real-time by a delayed circuit, this identity information is not stored on the drone, thus preventing the acquisition of the drone's identity information through physical capture. This invention uses the drone's identity information to perform mutual authentication and session key negotiation with the ground station. The authentication message participating in the authentication process is constructed from the drone's ID and the PUF-generated identity information, requiring no other information. This invention updates the drone's identity information after each authentication, including the drone's ID and the challenge-response pair generated by the PUF. Because the authentication message is constructed based on the identity information, the freshness of the authentication messages is guaranteed. Both the ground station and the drone to be authenticated use the same lightweight hash algorithm as the hash function to encrypt the authentication messages, completing the generation and integrity authentication of the hash values ​​of all authentication messages during the protocol process. This algorithm also generates the corresponding final session key. Because the lightweight hash algorithm has low computational cost, it reduces the hardware implementation cost.

[0006] The specific steps to achieve the objective of this invention are as follows:

[0007] Step 1: The ground station uses the UAV's PUF function to register each UAV and stores it in the ground station database;

[0008] Step 2: The drone uses the same method as in Step 1 to generate a response requesting drone authentication.

[0009] Step 3: Using a lightweight hash function, the drone encrypts the drone information to be sent for authentication; the drone then sends the authentication message to the ground station via a public channel.

[0010] Step 4: The ground station matches the authentication message and obtains the matching response generated by the UAV's PUF function; the ground station generates the UAV's identity identifier after matching; the ground station uses a lightweight hash function to encrypt the authentication request information to be sent; the ground station sends the authentication message to the UAV through a public channel.

[0011] Step 5: The UAV matches the authentication message and obtains the matching identity identifier generated by the ground station; the UAV updates its own temporary identity identifier to the matching identity identifier and updates the stored PUF function; the UAV sends an authentication success message to the ground station.

[0012] Step 6: After receiving the authentication success message sent by the UAV, the ground station updates the UAV's identity identifier stored in the database with the UAV's matched identity identifier, updates the UAV's PUF function stored in the database with the matching response generated by the UAV's PUF function, and retains the UAV's identity identifier in the database before the update.

[0013] Step 7: Generate a shared symmetric key between the ground station and the drone. The ground station and the drone communicate using the generated symmetric key.

[0014] Compared with the prior art, the present invention has the following advantages:

[0015] First, this invention utilizes a lightweight hash algorithm as the hash function for encrypting authentication messages. Because lightweight hash algorithms offer high security and have very low computational cost and implementation cost, they effectively reduce the computational burden of generating numerous authentication message hash values ​​and performing integrity verification during the identity authentication process. This overcomes the shortcomings of existing technologies, such as high authentication algorithm complexity and computational costs mismatched with the computing power of drones. Therefore, this invention boasts the advantages of being lightweight, having low computational cost, and low complexity in the identity authentication process.

[0016] Secondly, after the UAV matches the authentication message and obtains the new identity identifier generated by the ground station, both the UAV and the ground station update their identity information. The UAV's location information is not required to participate in the authentication process. This overcomes the shortcomings of the prior art, which is prone to abnormal termination of the identity authentication process due to the instability and susceptibility of GPS location information. This invention improves the reliability of UAV identity authentication. Attached Figure Description

[0017] Figure 1 This is a flowchart of the present invention. Detailed Implementation

[0018] To make the technical solution of the present invention clearer, the following description is in conjunction with the appendix. Figure 1 The present invention will be further described below. Embodiments of the present invention are implemented according to the following steps.

[0019] Step 1: The ground station uses the UAV's PUF function to register each UAV and store it in the ground station database.

[0020] The UAV (Unmanned Aerial Vehicle) node is the entity whose identity information needs to be verified. The ground station (GS) is a trusted entity that verifies the integrity of the UAV's identity information and stores a database of trusted UAV identity information. Each UAV registers with the ground station before deployment. UAV registration requires the UAV node to register its PUF (Programmer's Authentication Function) and other information in the ground station's feature database via a secure channel. This serves as the credential for subsequent mutual authentication between the UAV and the ground station.

[0021] The ground station uses the PUF function, and the registration steps for each UAV are as follows:

[0022] The first step is for the ground station to select a 32-bit random number C for the i-th drone to be registered. i The input is fed into the PUF function of the drone to be registered, and the response R of the drone to be registered is obtained. i , will C i With R i The challenge-response pair constituting the drone to be registered (C i R i ).

[0023] The second step involves the ground station generating a temporary identifier (TUID) for each drone to be registered. This TUID, combined with the ground station's permanent identifier (GID), forms the identity triplet for each drone to be registered: {TUID, GID, GID}. i R i} and stored at the ground station, the drone to be registered stores the triple {TUID, C i ,GID}.

[0024] Step 2: The drone uses the same method as in Step 1 to generate a response requesting drone authentication.

[0025] The response generated by the drone is specifically as follows:

[0026] The drone generates a response using a stored stimulus C.

[0027] The drone then generates the excitation C′, which is produced through its own PUF function.

[0028] Construct using responses R and R′

[0029] Step 3: Using a lightweight hash function, the drone encrypts the drone information to be sent for authentication; the drone then sends the authentication message MSG2 to the ground station via a public channel.

[0030] The lightweight hash algorithm can be implemented using any one of the following algorithms: ASCON-128, Quark hash algorithm, SPONGENT-128, and PHOTON-128.

[0031] In the embodiments of the present invention, the lightweight hash algorithm used is the ASCON-128 function.

[0032] The encryption of the drone information to be sent for authentication is accomplished by the following formula:

[0033] M1 = Hash(TUID||T||R)

[0034] Where M1 represents the encrypted digest of the authentication request information to be sent by the UAV, Hash(·) represents a lightweight hash function, TUID represents a temporary identity generated by the ground station for the UAV during the registration phase, ||·|| represents a character concatenation operation, T represents the result of XORing R with R′, R represents the registration response generated by the PUF function when the ground station registers the UAV, and R′ represents the new output response of the UAV's PUF function.

[0035] The authentication message MSG1 consists of TUID, T, and M1.

[0036] Step 4: The ground station matches the authentication message to obtain the newly generated matching response from the UAV's PUF function. The ground station generates a new identity identifier for the UAV after matching; the ground station uses a lightweight hash function to encrypt the authentication request information to be sent; the ground station sends the authentication message MSG2 to the UAV through a public channel.

[0037] The ground station's matching of authentication messages refers to the process whereby the ground station searches its database for a temporary identity identifier generated by the ground station for the registered drone based on the TUID in the authentication message MSG1. If no match is found, the matching fails. If a match is found, the ground station will locate the corresponding TUID drone's information in its database, calculate and verify the hash value. If the hash value verification fails, authentication fails, indicating that the message source is illegal. The ground station will handle packet loss and terminate the process, recording the TUID and network address and setting an authentication attempt limit. If the limit is exceeded, authentication data from that address will no longer be processed. If authentication is successful, it means the message originated from this drone and has not been tampered with. The ground station generates a temporary identity identifier for the registered drone and obtains the registration response generated by the PUF function when the drone was registered. Based on the T in the authentication message, the ground station calculates... Used to update the identity fingerprint for the next authentication.

[0038] The drone encrypts the ground station authentication request information to be sent according to the following formula:

[0039] M2 = Hash(r)

[0040]

[0041] Where M2 represents the encrypted digest of the ground station's request for authentication information sent by the ground station, m represents the ground station's request for authentication information to be sent, and r represents the random number selected by the ground station. The XOR operation is represented by TUID′, which represents a temporary identity newly generated by the ground station for the drone requesting authentication, and GID, which represents the permanent identity of the ground station.

[0042] The authentication message MSG2 consists of TUID′, m, and M2.

[0043] Step 5: The drone matches the authentication message and obtains a new identity identifier generated by the ground station after matching. The drone updates its own temporary identity identifier to the new identity identifier after matching and updates the stored PUF function. The drone will then send an authentication success message to the ground station.

[0044] The matching of authentication messages by the UAV refers to the UAV calculating and verifying the hash value using a lightweight hash function based on the TUID′ in the authentication message MSG2, the ground station identifier GID stored in the UAV itself, and the response R′ newly output by the UAV's PUF function. If the hash value verification is incorrect, the authentication fails, indicating that the message source is illegal, and the UAV will process the packet loss and terminate the process; if the authentication is successful, it means that the message comes from this ground station and has not been tampered with.

[0045] Step 6: The ground station receives the authentication success message sent by the UAV. The ground station updates the temporary identity of the UAV stored in the database with the new identity after the UAV is matched, updates the PUF function of the UAV stored with the newly generated matching response of the UAV's PUF function, and retains the previous temporary identity of the UAV in the database; that is, the UAV information is updated to {TUID′,(C′,R′)}.

[0046] Step 7: The ground station and the drone jointly generate a symmetric key for encrypted communication. The ground station and the drone then use the generated symmetric key SK. i To conduct communication.

[0047] The symmetric key for encrypted communication, jointly generated by the ground station and the drone to be registered, is obtained by the following formula:

[0048] SK i =Hash(R′||r||R)

[0049] Among them, SK i This represents the symmetric key between the ground station and the i-th drone to be registered.

Claims

1. A method for drone identity authentication based on timely generation and updating of authentication information, characterized in that, A lightweight hash algorithm is used as the hash function to encrypt the authentication message, and the drone's identity information is updated after each authentication. The authentication method includes the following steps: Step 1: The ground station uses the UAV's PUF function to register each UAV and stores it in the ground station database; Step 2: The drone uses the same method as in Step 1 to generate a response requesting drone authentication. Step 3: Using a lightweight hash function, the drone encrypts the drone information to be sent for authentication; the drone then sends the authentication message to the ground station via a public channel. Step 4: The ground station matches the authentication message and obtains the matching response generated by the UAV's PUF function; the ground station generates the UAV's identity identifier after matching; the ground station uses a lightweight hash function to encrypt the authentication request information to be sent; the ground station sends the authentication message to the UAV through a public channel. Step 5: The UAV matches the authentication message and obtains the matching identity identifier generated by the ground station; the UAV updates its own temporary identity identifier to the matching identity identifier and updates the stored PUF function; the UAV sends an authentication success message to the ground station. Step 6: After receiving the authentication success message sent by the UAV, the ground station updates the UAV's identity identifier stored in the database with the UAV's matched identity identifier, updates the UAV's PUF function stored in the database with the matching response generated by the UAV's PUF function, and retains the UAV's identity identifier in the database before the update. Step 7: Generate a shared symmetric key between the ground station and the drone. The ground station and the drone communicate using the generated symmetric key.

2. The drone identity authentication method based on timely generation and updating of authentication information according to claim 1, characterized in that, The steps for the ground station to register each UAV using the UAV's PUF function in step 1 are as follows: The first step is for the ground station to select a 32-bit random number C for the i-th drone to be registered. i The input is fed into the PUF function of the drone to be registered, and the response R of the drone to be registered is obtained. i , will C i With R i The challenge-response pair constituting the drone to be registered (C i ,R i ); The second step involves the ground station generating a temporary identifier (TUID) for each drone to be registered. This TUID, combined with the ground station's permanent identifier (GID), forms the identity triplet for each drone to be registered: {TUID, GID, GID, GID}. i ,R i } and stored at the ground station, the drone to be registered stores the triple {TUID, C i ,GID}.

3. The drone identity authentication method based on timely generation and updating of authentication information according to claim 1, characterized in that, The lightweight hash function mentioned in step 3 is any one of ASCON-128, Quark hash algorithm, SPONGENT-128, and PHOTON-128 algorithm.

4. The drone identity authentication method based on timely generation and updating of authentication information according to claim 1, characterized in that, The encryption of the drone information to be sent for authentication in step 3 is accomplished by the following formula: M1 = Hash(TUID||T||R) Where M1 represents the encrypted digest of the authentication request information to be sent by the UAV, Hash(·) represents a lightweight hash function, TUID represents a temporary identity generated by the ground station for the UAV during the registration phase, ||·|| represents a character concatenation operation, T represents the result of R XORing R', R represents the registration response generated by the PUF function when the ground station registers the UAV, and R' represents the new output response of the UAV's PUF function.

5. The drone identity authentication method based on timely generation and updating of authentication information according to claim 4, characterized in that, The authentication message mentioned in step 3 is {TUID,T,M1}.

6. The drone identity authentication method based on timely generation and updating of authentication information according to claim 1, characterized in that, The matching of authentication messages by the ground station in step 4 refers to the ground station searching the database for the temporary identity identifier generated by the ground station for the registered drone based on the TUID in the authentication message. If no match is found, the matching fails. If a match is found, the ground station verifies the hash value based on the information of this registered drone in the database. If the hash value cannot be verified, the authentication fails. If the authentication is successful, the ground station generates a temporary identity identifier for this registered drone and obtains the registration response generated by the PUF function when the drone was registered.

7. The drone identity authentication method based on timely generation and updating of authentication information according to claim 4, characterized in that, The encryption of the authentication request information to be sent by the ground station using a lightweight hash function in step 4 is achieved by the following formula: M2 = Hash(r) Where M2 represents the encrypted digest of the ground station's request for authentication information to be sent by the ground station, m represents the ground station's request for authentication information to be sent, and r represents the random number selected by the ground station. The XOR operation is indicated by TUID', which represents a temporary identity generated by the ground station for the drone requesting authentication, and GID, which represents a permanent identity of the ground station.

8. The drone identity authentication method based on timely generation and updating of authentication information according to claim 6, characterized in that, In step 4, the UAV sends an authentication message to the ground station via a public channel, which is {TUID',m,M2}.

9. The drone identity authentication method based on timely generation and updating of authentication information according to claim 7, characterized in that, The matching of the authentication message by the UAV in step 5 refers to the UAV calculating and verifying the hash value using a lightweight hash function based on the TUID' in the authentication message, the ground station identifier GID stored in the UAV, and the response R' newly output by the UAV's PUF function. If the hash value verification is incorrect, the authentication fails, indicating that the message source is illegal; if the authentication is successful, it means that the message comes from this ground station and has not been tampered with.

10. The drone identity authentication method based on timely generation and updating of authentication information according to claim 7, characterized in that, The symmetric key mentioned in step 7 is obtained by the following formula: SK i =Hash(R'||r||R) Among them, SK i This represents the symmetric key between the ground station and the i-th drone to be registered.

Images