Dynamic UAV swarm identity authentication key negotiation method

Abstract

The present invention provides a dynamic drone group identity authentication key negotiation method, comprising the following steps: when the number of drones is less than 2 k Supplement 2 k n drones participate in the network as virtual nodes, k represents the number of authentication rounds, n represents the current number of drones; the UAV numbered x in the i-th authentication round x Direction number x‑2 i‑1 The drone #imgabs0# sends authentication information for authentication; after the authentication is passed, the authentication information is parameter aggregated and the next round of authentication is performed; after the kth round of authentication is passed, a negotiation key is generated. The present invention uses Latin square design to supplement the drone group by supplementing virtual nodes, and through the form of multiple rounds of authentication, a large number of different combinations can be covered in relatively few tests, thereby improving the efficiency of identity authentication.

Description

Technical Field

[0001] The present invention relates to the technical field of drone group identity authentication, and in particular to a dynamic drone group identity authentication key negotiation method. Background Art

[0002] In recent years, drones have been widely used in logistics, disaster relief, farmland mapping and other fields, providing a new and feasible means for the efficient execution of complex and dangerous tasks. However, the ability of a single drone to perform tasks is limited. The collaborative execution of multiple drones can effectively improve execution efficiency, task coverage and system reliability. In addition, with the diversification of tasks and the improvement of customer requirements, it has become urgent to ensure that the drone swarm can change dynamically, that is, the drone swarm can accept new drones to join during the execution of tasks. The security of communication between multiple drones is an important guarantee to ensure the smooth execution of tasks by drone swarms. Usually, the method of identity authentication and key negotiation between drones is used to obtain reliable keys for encrypted communication.

[0003] At present, the communication protocol between multiple drones cannot effectively resist attacks such as man-in-the-middle attacks, replay attacks, and impersonation attacks. Traditional security authentication schemes are not applicable to drone communication networks with limited resources, and most drone identity authentication schemes use centralized authentication key negotiation methods with high computing overhead and high storage cost. Not only do they not consider the development trend of decentralized drone groups, but they also cannot meet the security protection scheme's requirements for high authentication efficiency and low communication overhead. Summary of the invention

[0004] The present invention proposes a dynamic drone swarm identity authentication key negotiation method to solve the technical problems of high computational overhead and high storage cost of drone swarm identity authentication schemes in the prior art.

[0005] In order to solve the above technical problems, the present invention provides a dynamic drone group identity authentication key negotiation method, comprising the following steps:

[0006] When the number of drones is less than 2 k Supplement 2 k -n drones participate in the network as virtual nodes, k represents the number of authentication rounds, n represents the current number of drones; the UAV numbered x in the i-th authentication round x Towards number x-2 i-1 Drones Send authentication information for authentication; after authentication, perform parameter aggregation on the authentication information and proceed to the next round of authentication; after the kth round of authentication passes, generate a negotiated key.

[0007] Preferably, the authentication information includes:

[0008]

[0009] In the formula, Indicates the signature result of drone x in round i. When i=1, When i≠1, it indicates the signature result of drone x after the i-th round of aggregation. Indicates that through sk_b x H(ID x ) to sign, sk_b x Indicates that drone x generates a private key for BLS signature based on G1, H(ID x ) indicates the ID x Perform hash calculation and take the point on the elliptic curve as the result according to the hash value. If the corresponding point cannot be found, H(ID x ||1)、H(ID x ||2) is the final result; Indicates the hash value used for the identity authentication of drone x after the i-th round of aggregation. When i=1, When i≠1, Represents the hash value used for the identity authentication of drone x in round i after aggregation; represents the public key of drone x in round i. When i=1, Indicates that through sk_b x The public key generated by signing g2; g2 represents the generator of G2. When i≠1, it represents the public key of drone x after the i-th round of aggregation; T represents the current time; ID x represents the identity serial number of the drone numbered x; G1 represents the multiplication cyclic group with generator g1 and order p; represents the key negotiation parameters of the i-th round of drone x. When i=1, r x represents the random number generated by the drone numbered x, G represents the base point of the drone's built-in parametric elliptic curve, when i≠1, represents the key negotiation parameters after the i-th round of aggregation of drone x; represents the temporary key of the i-th round of drone x; enc() represents the SM4 symmetric encryption operation; hash() represents the SM3 hash operation.

[0010] Preferably, the temporary key The expression is:

[0011]

[0012] In the formula, Indicates the number is x-2 i-1 The public key generated by the drone based on the ECC algorithm, dx Indicates the private key generated by the drone numbered x based on the ECC algorithm.

[0013] Preferably, the method for performing authentication includes:

[0014] 1) Drones Receive authentication information Then first use the current time T n Check T n -T<Δt is true, if so, it passes the verification and proceeds to the next step, Δt represents the set threshold;

[0015] 2) Drones HA was calculated according to the following formula: ver If HA ver and If they are the same, the verification is passed, otherwise it fails;

[0016]

[0017] 3) If the following equation is true, the verification is passed, otherwise it fails:

[0018] e(sign x i , g2) = e(Hash x i , Pk_b x i)

[0019] Where e() represents a bilinear mapping.

[0020] Preferably, the expression for parameter aggregation is:

[0021]

[0022] Preferably, the expression for generating the negotiation key is:

[0023]

[0024] In the formula, G se Indicates the built-in parameters of the drone group. Indicates drone x-2 k-1 The key negotiation parameters of the kth round are obtained by aggregating the key negotiation parameters.

[0025] Preferably, when a new UAV new When joining a drone group, the parameters of the kth round are aggregated and then authenticated, completing the identity authentication of the new UAV. new Join the certification.

[0026] Preferably, when a new UAV newWhen joining a drone group, the methods for generating negotiation keys include: new UAV for communication old To UAV new Send messageMag old , InformationMag old The content is {sign old , H old , Pk_b old , CT old ,T,ID old , HA old};

[0027]

[0028] vk odd =P old +P new *d old ;

[0029] HA old = hash(sign old , H old , Pk_b old , CT old ,T,ID old );

[0030] P old UAV old Based on the public key generated by the ECC algorithm, P new Indicates UAV UA new The public key generated based on the ECC algorithm, d old UAV old Private key generated based on ECC algorithm;

[0031] Then UAV old Perform aggregation operation according to the following formula, old 、Hash old , R old ,,Pk_b old To update:

[0032]

[0033] And sign new 、Hash new ,Pk_b new , R new Broadcast to other drones in the drone group, and other drones will also be updated and follow tkx old =(R new +R old)*G updates the negotiation key; G represents the base point of the drone’s built-in parameter elliptic curve, R old UAV old The key negotiation parameter, R new Indicates new UAV new The key negotiation parameters.

[0034] The beneficial effects of the present invention include at least: the present invention complements the drone group by supplementing virtual nodes through Latin square design, and through multiple rounds of authentication, a large number of different combinations can be covered in relatively few tests, thereby improving the efficiency of identity authentication. Compared with the traditional one-by-one verification method, the Latin square design can determine the identity of each drone more quickly; minimize the number of trials and resource investment required, and effectively reduce the number of communications required for drone group identity authentication key negotiation from Q(n 2 ) is reduced to Q(n*log n), which means that the time, manpower and money required in the certification process will be reduced, improving the efficiency of resource utilization; ensuring that various possible situations and combinations are covered in the certification process, thereby improving the comprehensiveness and reliability of certification. This can better ensure that the identity of each drone can be effectively confirmed, ensure the safety and stability of the drone system, and reduce potential safety risks.

[0035] As an additional technical feature, based on the BLS algorithm, the ECDH algorithm is combined with the Latin square design to realize the identity authentication and key negotiation of drone nodes in a dynamic drone swarm. It can realize the exit and joining of legitimate drone nodes in the drone swarm during the mission execution, and can effectively resist common attack methods such as replay attacks and counterfeit attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 A schematic diagram of a method flow of an embodiment of the present invention;

[0037] Figure 2 This is a schematic diagram of the first round of authentication in an embodiment of the present invention;

[0038] Figure 3 This is a schematic diagram of the second round of authentication in an embodiment of the present invention;

[0039] Figure 4 Schematic diagram of the k-th round of authentication according to an embodiment of the present invention. DETAILED DESCRIPTION

[0040] The following is a clear and complete description of the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work belong to the protection scope of the present invention.

[0041] like Figure 1 As shown, the embodiment of the present invention provides a dynamic drone group identity authentication key negotiation method, including the following steps: when the number of drones is less than 2 k Supplement 2 k -n drones participate in the network as virtual nodes, k represents the number of authentication rounds, n represents the current number of drones; the UAV numbered x in the i-th authentication round x Towards number x-2 i-1 Drones Send authentication information for authentication; after authentication, perform parameter aggregation on the authentication information and proceed to the next round of authentication; after the kth round of authentication passes, generate a negotiated key.

[0042] Specifically, the identity authentication key negotiation method can be divided into two stages: an initialization stage and an authentication stage.

[0043] In the initialization phase, it is mainly completed before the drone group takes off. The specific steps are as follows:

[0044] 1) All drones that need to participate in the network will be given relevant parameters during the initialization phase. Assuming there are n drones in total, if the number of drones is less than 2 k Supplement 2 k -n frames participate in the network as virtual nodes, with the UAV numbered x x For example, it needs to be given parameters {P x , d x , ID x , G1, G2, g1, g2, G, G se} and parameters The specific meanings of the parameters here and in the subsequent authentication process are shown in Table 1:

[0045] Table 1

[0046]

[0047]

[0048] 2) UAV x Generate a private key for BLS signature based on G1 And calculate the public key based on the following formula That is, use Sign g2:

[0049]

[0050] 3), calculate H(ID x ), and calculate the signature result sign according to the following formula i :

[0051]

[0052] 4) UAV x Generate random numbers And generate it according to the following formula

[0053]

[0054] In the certification stage, the drone needs to undergo k rounds of certification. Here we explain in detail the processes of the first, second and kth rounds of certification.

[0055] The first round of certification process is as follows Figure 2 shown.

[0056] Step 1-1, UAV x according to Calculate temporary key Where x represents UAV x Number, 1 represents the first round, use As a key pair Perform SM4 symmetric encryption calculations

[0057] Step 1-2, UAV x HA was calculated according to the following formula;

[0058] hash refers to the SM3 hash algorithm, where

[0059] Steps 1-3, UAV x To UAV x-1 Send M (x，x-1) , except for some drones, such as UAV1, which needs to be send in

[0060] Steps 1-4, UAV x-1 Received M (x，x-1) Then first use the current time T n Check T n -T<Δt holds true. If so, the verification is successful.

[0061] Steps 1-5, UAV x-1 HA was calculated according to the following formula: ver If HA ver If it is the same as HA, it passes the verification, otherwise it fails;

[0062]

[0063] UAV x-1 Verify the drone's identity. If the following equation holds, the verification passes, otherwise it fails.

[0064]

[0065] Where e is a bilinear mapping.

[0066] Steps 1-6, UAV after verification x-1 Calculate according to the following formula and use Use the key to decrypt CT according to the SM4 algorithm get

[0067]

[0068] Steps 1-7, UAV x-1 Perform aggregation operations according to the following formula:

[0069]

[0070] The aggregation result is used as the parameter for the next round of authentication.

[0071] The second round of certification process is as follows Figure 3 shown.

[0072] Step 2-1, during this round of authentication, the UAV x The temporary key is calculated as follows As UAV x The temporary key of the second round is calculate The 2 in the figure represents the second round.

[0073]

[0074] Step 2-2, UAV x HA was calculated according to the following formula 2 , HA 2 The superscript 2 refers to the second round of certification;

[0075]

[0076] Step 2-3, such as Figure 3 As shown, UAV x To UAV x-2 Send M (x，x-2) , except for some drones, such as UAV1, which needs to be send

[0077]

[0078] Steps 2-4, UAV x-2 Received M (x，x-2) Then use the current time T n Check T n -T<Δt is true, if true, it passes the verification, and is calculated according to the following formula if With HA 2 If they are the same, the verification is passed, otherwise it fails;

[0079]

[0080] Step 2-5, UAV x-2 Verify the drone's identity. If the following equation is true, the drone passes the verification, otherwise it fails.

[0081] e(sign x 2 , g2) = e(Hash x 2 , Pk_b x 2 );

[0082] Step 2-6, after passing the verification, UAV x-2 Calculate according to the following formula And calculate get

[0083]

[0084] Step 2-7, UAV x-2 Perform aggregation operations according to the following formula:

[0085]

[0086] The kth round of certification is Figure 4 shown.

[0087] Step k-1, UAV x The temporary key is calculated as follows according to CT stands for encrypted information. The k in represents the kth round of calculation;

[0088]

[0089] Step k-2, UAV x HA was calculated according to the following formula k ;

[0090]

[0091] Step k-3, such as Figure 4 As shown, UAV x Towards send For example Send to UAV1 Some drones are exceptions. The content is as follows:

[0092]

[0093] Step K-4, Drone receive Then first use the current time T n Check T n -T<Δt is true, Δt refers to the set threshold parameter used to check whether it is subject to replay attack. If it is true, it passes the verification, and then it is calculated according to the following formula

[0094]

[0095] if With HA K If they are the same, the verification is passed, otherwise it fails.

[0096] Step k-5, Verify the drone's identity. If the following equation is true, the drone passes the verification, otherwise it fails:

[0097] e(sign x k , g2) = e(Hash x k , Pk_b x k );

[0098] Step k-6, after verification Calculate vk as follows ver ,

[0099]

[0100] And calculate get The negotiated key is calculated as follows:

[0101]

[0102] The following explains the joining and exiting of legal nodes. new represents the number of the newly joined drone, old represents the number of the drone communicating with it in the drone group, and ex represents the number of the legal drone node that needs to exit the drone group.

[0103] 1) Legitimate drone node exits

[0104] The UAV node that needs to exit the UAV cluster ex Based on the encrypted communication channel established after the authentication phase, it broadcasts its initial R value R to other drone nodes in the cluster. ex_in Based on the encrypted communication channel established after the authentication phase, the initial R value is broadcast to other drone nodes in the cluster. ex_in After that, the other drone nodes in the drone cluster use UAV y For example, according to the formula: tkx y =(R y +(-1)*R st_in )*G se Calculate a new session key.

[0105] 2) Legal drone nodes join

[0106] Step 1: If you have a new UAV new To join the drone group, the following parameters should be given during the initialization phase, including {Pk new ,sk new , ID new , G se , G1, G2, g1, g2, G, Pk old}, where Pk old Refers to the need to communicate with UAV in the drone group new The drone public key for communication;

[0107] Step 2, UAV new Generate the private key sk_b for BLS signature based on G1 new , and calculate the public key Pk_b based on the following formula new ;

[0108]

[0109] Step 3: Calculate Hash new =H(ID new ), and calculate the signature result sign according to the following formula new;

[0110]

[0111] Step 4, UAV new Generate a random number r new And generate R according to the following formula new ;

[0112] R new =r new *G;

[0113] Step 5, UAV new Follow vk new =P old +P old *d new Calculate the temporary key vk new According to CT new =enc(R new , vk new ) Calculate CT new ;

[0114] Step 6, and calculate HA according to the following formula new ;

[0115] HA new = hash(sign new , H new , Pk_b new , CT new ,T,ID new );

[0116] Step 7, UAV new To UAV old Send the message Mag, the content of the message Mag is {sign new , Hash new , Pk_b new , CT new ,T,ID new , Pnw, HA new};

[0117] Step 8: UAV old After receiving Mag, first use the current time T n , T n For variables, check T n -T<Δt whether it holds, if so, the verification is passed.

[0118] Step 9, UAV old HA was calculated according to the following formula: odd If HA odd With HA newIf they are the same, the verification is passed, otherwise it fails;

[0119] HAadd=hash(sign new , H new , Pk_b new , CT new ,T,ID new , P new );

[0120] UAV old The drone identity is verified according to the following formula. If it is true, it passes the verification, otherwise it fails.

[0121] e(sign new , g2) = e(Hash new , Pk_b new );

[0122] Step 10: UAV passes verification old Calculate ukadd according to the following formula and calculate dec(CT new , vk add )(Use vk add As key pair CT new Decrypted according to the SM4 algorithm), we get R new ;

[0123] vk add =P old +P new *d old ;

[0124] Step 11, UAV old To UAV new Send messageMag old , InformationMag old The content is {sign old , H old , PK_b old , CT old ,T,ID old , HA old},in, HA old = hash(sign old , H old , Pk_b old , CT old ,T,ID old ), followed by UAV old Perform aggregation operation according to the following formula, old 、Hash old ,Pk_b old , Rold Update and sign new 、Hash new ,Pk_b new , R new Broadcast to other drones in the drone group, and other drones are also updated according to the following formula and follow tkx old =(R new +R old )*GUpdate key.

[0125]

[0126] Step 12, UAV new Receive UAV old Sent Mag old Then, the timestamp is verified to effectively prevent replay attacks.

[0127] Step 13, UAV new The integrity of the message is then checked, i.e., the HA old Perform verification to ensure message integrity;

[0128] Step 14, UAV new The drone identity is verified according to the following formula. If it is true, it passes the verification, otherwise it fails.

[0129] e(sign old , g2) = e(Hash old , Pk_b old ).

[0130] Step 15: UAV passes verification new Calculate dec(CT old , vk new ), that is, use vk new As key pair CT new Decrypt according to the SM4 algorithm and get R old . Then, follow tkx new =(R new +R old )*G se Calculate the new negotiated key tkx new .

[0131] By combining the ECDH algorithm with the Latin square design through the above method, the identity authentication and key negotiation of drone nodes in a dynamic drone swarm are realized. The exit and joining of legitimate drone nodes in the drone swarm can be realized during the mission execution, and it can effectively resist common attack methods such as replay attacks and counterfeit attacks.

[0132] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. Only the preferred embodiments of the present invention are expressed. The description is more specific and detailed, but it cannot be understood as limiting the scope of the patent of the present invention. As long as there is no contradiction in the combination of these technical features, they should be considered as the scope recorded in this specification.

[0133] It should be noted that, for those skilled in the art, several modifications and improvements can be made without departing from the concept of the present invention, which all belong to the protection scope of the present invention. Therefore, the protection scope of the patent of the present invention shall be subject to the attached claims.

Claims

1. A dynamic drone group identity authentication key negotiation method, characterized by: The following steps are involved: When the number of drones is less than 2 k Supplement 2 k -n drones participate in the network as virtual nodes, k represents the number of authentication rounds, n represents the current number of drones; the UAV numbered x in the i-th authentication round x Towards number x-2 i-1 Drones Send authentication information for authentication; After the authentication is passed, the authentication information is aggregated and the next round of authentication is performed; after the kth round of authentication is passed, the negotiation key is generated; The authentication information includes: In the formula, Indicates the signature result of drone x in round i. When i=1, When i≠1, it indicates the signature result of drone x after the i-th round of aggregation. Indicates that through sk_b x H(ID x ) to sign, sk_b x Indicates that drone x generates a private key for BLS signature based on G1, H(ID x ) indicates ID x Perform hash calculation and take the point on the elliptic curve as the result according to the hash value. If the corresponding point cannot be found, H(ID x ||1)、H(ID x ||2) is the final result; Indicates the hash value used for the identity authentication of drone x after the i-th round of aggregation. When i=1, When i≠1, Represents the hash value used for the identity authentication of drone x in round i after aggregation; represents the public key of drone x in round i. When i=1, Indicates that through sk_b x The public key generated by signing g2; g2 represents the generator of G2. When i≠1, it represents the public key of drone x after the i-th round of aggregation; T represents the current time; ID x represents the identity serial number of the drone numbered x; G1 represents the multiplication cyclic group with generator g1 and order p; represents the key negotiation parameters of the i-th round of drone x. When i=1, r x represents the random number generated by the drone numbered x, G represents the base point of the drone's built-in parametric elliptic curve, when i≠1, represents the key negotiation parameters after the i-th round of aggregation of drone x; represents the temporary key of the i-th round of drone x; ennc() represents the SM4 symmetric encryption operation; hash() represents the SM3 hash operation; The expression for parameter aggregation is:

2. A dynamic drone group identity authentication key negotiation method according to claim 1, characterized in that: The temporary key The expression is: In the formula, Indicates the number is x-2 i-1 The public key generated by the drone based on the ECC algorithm, d x Indicates the private key generated by the drone numbered x based on the ECC algorithm.

3. A dynamic drone group identity authentication key negotiation method according to claim 1, characterized in that: Methods for authentication include: 1) Drones Receive authentication information Then first use the current time T n Check T n -T<Δt is true, if so, it passes the verification and proceeds to the next step, Δt represents the set threshold; 2) Drones HA was calculated according to the following formula: ver If HA ver and If they are the same, the verification is passed, otherwise it fails; 3) If the following equation is true, the verification is passed, otherwise it fails: e(sign x i ,g2)=e(Hash x i ,Pk_b x i ); Where e() represents a bilinear mapping.

4. A dynamic drone group identity authentication key negotiation method according to claim 1, characterized in that: The expression for generating the negotiated key is: In the formula, G se Indicates the built-in parameters of the drone group. Indicates drone x-2 k-1 The key negotiation parameters of the kth round are obtained by aggregating the key negotiation parameters.

5. A dynamic drone group identity authentication key negotiation method according to claim 1, characterized in that: When a new UAV new When joining a drone group, the parameters of the kth round are aggregated and then the identity authentication is completed. new Join the certification.

6. A dynamic drone group identity authentication key negotiation method according to claim 5, characterized in that: When a new UAV new When joining a drone swarm, the methods for generating a negotiation key include: Need to be connected with UAV new UAV for communication old To UAV new Send messageMag old , InformationMag old The content is {sign old , Hash old , Pk_b old , CT old ,T,ID old , HA old }; vk add =P old +P new *d old ; HA old =hash(sign old ,Hash old ,Pk_b old ,CT old ,T,ID old ); P old UAV old Based on the public key generated by the ECC algorithm, P new UAV new The public key generated based on the ECC algorithm, d old UAV old Private key generated based on ECC algorithm; Then UAV old Perform aggregation operation according to the following formula, old 、Hash old , R old ,Pk_b old To update: And sign new 、Hash new ,Pk_b new , R new Broadcast to other drones in the drone group, and other drones will also be updated and follow tkx old =(R new +R old )*G updates the negotiation key; G represents the base point of the drone’s built-in parameter elliptic curve, R old UAV old The key negotiation parameter, R new Indicates new UAV new The key negotiation parameters.

Images