A method and system for secure communication of power inspection drone cluster

Abstract

The present invention relates to a secure communication method for a cluster of electric power inspection drones, and belongs to the field of encryption communication technology. Unicast and multicast communications are used between clusters of electric power inspection drones to transmit electric power inspection tasks and control instruction messages; when a sending drone sends a message through unicast communication, the message is encrypted using the Signal protocol, and an extended triple Diffie-Hellman calculation is used to generate a shared key, and after double ratcheting the message is encrypted, the encrypted message is sent; when communicating through multicast, the sending drone uses online / offline attribute-based encryption (CP-ABE) to encrypt the message, and the dispatch center partially decrypts the message. When the receiving drone is online, the receiving message is completely decrypted. The present invention prevents the illegal theft of electric power inspection data by adopting a more efficient encryption method in unicast and multicast communications, reduces the calculation amount of the drone, and improves the security of drone cluster communication.

Description

Technical Field

[0001] The present invention relates to the field of unmanned aerial vehicle (UAV) communications, and in particular to a method for secure communication of a cluster of electric power inspection UAVs. Background Art

[0002] The transmission and distribution network of the power system is an important national facility. Its lines are distributed across regions, with many points and wide areas. The power inspection operation is difficult, the standards are complicated, the efficiency is low, and there are many blind spots. As an emerging line inspection tool, drones have many advantages such as flexibility, efficiency, and safety, and have become one of the important means of power system inspection. By carrying various sensors and corresponding data processing systems, drones can conduct high-altitude inspections, image capture, data collection and real-time monitoring of transmission lines, realizing comprehensive and accurate perception and evaluation of the status of transmission lines. They have been widely used in power grids and achieved good results. With the rapid development of drone technology, the massive data transmission brought by drone inspections is a huge amount of engineering work. It is necessary to use efficient 5G networks for real-time data transmission. In the process of data transmission, it is inevitable to face threats such as illegal theft and hacker attacks, which can easily cause power data leakage and damage. The resulting power safety issues cannot be ignored. In addition, power inspection drones usually perform power inspection tasks in the form of clusters and conduct cluster communications. Due to the power limit of drones, drones in the same cluster often switch between online and offline.

[0003] Therefore, developing a secure communication method for drone clusters that can overcome these limitations has important practical significance and application value for improving the data transmission efficiency and security of power inspections. Summary of the invention

[0004] In order to make up for the shortcomings of the existing technology, the core of the present invention is to provide a secure communication method for a cluster of power inspection drones, select the corresponding encryption method according to the unicast communication or multicast communication method, implement an efficient encryption method, prevent the power inspection data from being illegally stolen, and greatly improve the security of drone communications.

[0005] A first aspect of the present invention provides a method for secure communication of a power inspection drone cluster, wherein the drone cluster includes a plurality of sending and receiving drones, wherein the plurality of sending and receiving drones use unicast and multicast communication methods to transmit power inspection tasks and control instruction messages between the cluster and / or a dispatch center; unicast and multicast communication are selected according to the state of the drone and the task requirements;

[0006] The drone cluster includes multiple sending and receiving drones, and the multiple sending and receiving drones select unicast and multicast communication modes according to their respective states and task requirements to transmit power inspection tasks and control instruction messages between the cluster and / or the dispatch center;

[0007] When sending a message via unicast, the sending drone uses the Signal protocol to encrypt the message, wherein the use of the Signal protocol to encrypt the message includes that the two parties in the encrypted message communication use Extended Triple Diffie-Hellman (X3DH) to calculate and generate a shared key. After the authentication server verifies the identity of the drone, the message is encrypted using the double ratchet algorithm and sent to the dispatch center. When the offline receiving drone comes online again, the message is queried and decrypted from the dispatch center.

[0008] In some possible implementations of the first aspect, the power inspection drone cluster includes multiple drones of the same model, which are equipped with power inspection equipment to perform power inspection tasks; each drone is set with a unique number, and the drone number includes the cluster code of the drone cluster and the model code of the drone model.

[0009] In some possible implementations of the first aspect, the sending of messages via unicast communication includes, when an online sending drone needs to send a message to another specific online or offline receiving drone, using the Signal protocol to encrypt the message; if the receiving drone is offline, the sending drone uses the ExtendedTriple Diffie-Hellman (X3DH, Extended Triple Diffie-Hellman, or Triple Extended Diffie-Hellman) in the Signal protocol to negotiate a key to encrypt the message, and sends the encrypted message to the dispatch center; when the offline receiving drone comes back online, it can query and decrypt the message from the dispatch center.

[0010] In some possible implementations of the first aspect, the communication via multicast includes: when a drone needs to send a message to a group of other drones with the same attributes, the message will be encrypted using online / offline attribute-based encryption (CP-ABE). If the receiving drone is online, it directly uses CP-ABE to decrypt the message. If the receiving drone is offline, the dispatch center uses CP-ABE to partially decrypt the encrypted message, and stores the partially decrypted message. When the offline receiving drone comes back online and sends its identity information to the dispatch center, the dispatch center verifies and sends the partially decrypted message to the receiving drone to complete the decryption of the message.

[0011] In some possible implementations of the first aspect, the sending of the message via unicast includes step 1: sending a drone to send an authentication request to a dispatch center, wherein the authentication request carries its public identity key to verify the identity.

[0012] Step 2: The dispatch center queries the pre-stored pre-key package of the receiving drone and sends it to the sending drone.

[0013] Step 3: The receiving drone uses its private key to decrypt the pre-key package, generate a temporary key pair, and perform an extended triple Diffie-Hellman (X3DH) key agreement to generate a shared key.

[0014] Step 4: The sending drone calculates the shared key, encrypts the message using the double ratchet algorithm and stores it in the dispatch center.

[0015] Step 5: After the receiving drone comes online, the dispatch center verifies its identity and forwards the pre-key package. The receiving drone decrypts the pre-key package, performs X3DH calculation, calculates the shared key, and decrypts the encrypted message forwarded by the dispatch center to obtain the original message content. At the same time, the one-time pre-key OPKb3s used is deleted.

[0016] In some possible implementations of the first aspect, encrypting the message using the double ratchet algorithm includes:

[0017] Step 101: The sending drone and the receiving drone initialize sending and receiving ratchets, and the sending ratchet of the sending drone generates a temporary key pair based on its root key, wherein the key pair includes a temporary public key and a private key;

[0018] Step 102: The sending drone sends its temporary public key to the receiving drone. The receiving drone generates its own temporary key pair and sends the temporary public key to the sending drone. Both parties use the other party's temporary public key and their own private key to perform Diffie-Hellman key exchange to generate a shared session key. The sending drone uses the session key to encrypt the message and send it.

[0019] Step 103, after receiving the encrypted message, the receiving drone uses the receiving ratchet to generate the key required to decrypt the message based on the root key and the temporary public key in the key exchange, and uses the key to decrypt the received message, and updates its root key and temporary key pair according to the double ratchet algorithm to prepare for the next encrypted communication.

[0020] In some possible implementations of the first aspect, encrypting a message using online / offline attribute-based encryption (CP-ABE) includes the following steps:

[0021] Step 201: The key generation center (KGC) defines the attribute set and access structure, generates a corresponding key for each attribute, and generates a private key for each drone based on its attribute;

[0022] Step 202: The sending drone encrypts the message using the encryption key and access structure provided by the KGC; the encrypted message is sent to the dispatch center, which distributes the message to the online drone or generates and stores a partially decrypted message and a partially decrypted token for the offline drone based on the online / offline status of the receiving drone;

[0023] Step 203: The online drone uses its private key and the attribute-based encryption key provided by KGC to decrypt the received encrypted message. After the offline drone comes online, it requests the stored partial decrypted message and the corresponding decryption token from the dispatch center, and then uses its own private key to complete the final decryption and obtain the original message content.

[0024] The second aspect of the present invention provides a power inspection drone cluster security communication system, the system includes an authentication server, a dispatch center, and a drone cluster, the drone cluster includes multiple sending and receiving drones, and the multiple sending and receiving drones use unicast and multicast communication methods to transmit power inspection tasks and control instruction messages between the cluster and / or the dispatch center; unicast and multicast communication are selected according to the status of the drone and the task requirements;

[0025] When sending a message via unicast, the sending drone uses the Signal protocol to encrypt the message, wherein the use of the Signal protocol to encrypt the message includes that the two parties in the encrypted message communication use Extended Triple Diffie-Hellman (X3DH) to calculate and generate a shared key. After the authentication server verifies the identity of the drone, the message is encrypted using the double ratchet algorithm and sent to the dispatch center. When the offline receiving drone comes online again, the message is queried and decrypted from the dispatch center.

[0026] A third aspect of the present invention provides a power inspection drone cluster safety communication device, comprising: a drone cluster control module, for selecting unicast and multicast communication modes according to the states of the sending and receiving drones in the drone cluster and the task requirements, and for transmitting power inspection tasks and control instruction messages between the cluster and / or the dispatch center;

[0027] A unicast communication module, used to encrypt messages using the Signal protocol when sending messages in a unicast manner, wherein the use of the Signal protocol to encrypt messages includes using the Extended Triple Diffie-Hellman protocol to calculate and generate a shared key, and after the authentication server verifies the identity of the drone, using the double ratchet algorithm to encrypt the message and send the message to the dispatch center, and when the offline receiving drone comes online again, query and decrypt the message from the dispatch center;

[0028] The multicast communication module is used to encrypt messages using the online / offline attribute-based encryption (CP-ABE) protocol when communicating via multicast. The dispatch center partially decrypts the messages and temporarily stores them. When the offline receiving drone comes online again, it receives the messages from the dispatch center and completely decrypts the messages.

[0029] A fourth aspect of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and wherein the computer program implements the aforementioned method when executed by a processor.

[0030] Through the above technical scheme, compared with the prior art, the present invention has the following beneficial effects: using unicast and multicast communications between power inspection drone clusters to transmit power inspection tasks and control command messages; when the sending drone sends a message through unicast communication, the Signal protocol is used to encrypt the message, and the Diffie-Hellman calculation is used to generate a shared key, and the encrypted message is sent after double ratchet encryption; when communicating through multicast, the sending drone uses online / offline attribute-based encryption (CP-ABE) to encrypt the message, and the dispatch center partially decrypts the message. When the receiving drone is online, the message is sent so that the receiving drone can completely decrypt the message. The present invention prevents the illegal theft of power inspection data by adopting a more efficient encryption method in unicast and multicast communications, reduces the calculation amount of the drone, and improves the security of drone cluster communication. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 A schematic diagram of a power inspection drone cluster security communication system provided in Example 1 of the present invention.

[0032] Figure 2 A flowchart of the steps of a secure communication method for a power inspection drone cluster provided in Example 2 of the present invention. DETAILED DESCRIPTION

[0033] The following is a description of exemplary embodiments of the present invention in conjunction with the accompanying drawings, including various details of the embodiments of the present invention to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be appreciated by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present invention. Similarly, for clarity and simplicity, the description of well-known functions and structures is omitted in the following description. It should be noted that the embodiments of the present invention and the features in the embodiments may be combined with each other without conflict.

[0034] In recent years, as drone-related technologies continue to mature, they have gradually been applied to the field of power inspection. Drones usually perform power inspection tasks in the form of clusters and conduct cluster communication. Due to their power limitations, drones in the same cluster need to communicate or switch between drone groups. The communication methods between drone groups are divided into unicast and multicast. When drone clusters communicate in self-organizing networks, a single drone often needs to exchange data with multiple drones in the cluster, such as regularly reporting its own location, data collection, and task execution.

[0035] With the widespread application of drone swarms, the issue of communication security has gradually become a focus of attention. Drone swarm communications are mainly threatened by man-in-the-middle attacks, replay attacks, false message attacks, and GPS spoofing attacks. Among them, man-in-the-middle attacks allow attackers to intercept and possibly tamper with data during drone communication to obtain sensitive information; replay attacks involve attackers intercepting and recording legitimate data transmissions, and then resending these data at an appropriate time to deceive the system; false message attacks mislead the recipient by sending forged messages, which may lead to wrong decisions or operations; and GPS spoofing attacks mislead the drone's navigation system by sending false GPS signals, covering its location information. Therefore, it is an urgent need to establish a reliable and secure communication channel between power inspection drone swarms to ensure that encrypted messages can be safely transmitted between drones and effectively prevent potential attacks.

[0036] like Figure 1 As shown, in the specific implementation of the communication system of the present invention, in the embodiment of the present invention, a power inspection drone cluster security communication system is provided, and the system includes an authentication server, a dispatch center, and a drone cluster. The authentication server is responsible for the authentication and authorization of the drone; the dispatch center is responsible for the allocation, dispatching and monitoring of power inspection tasks, and stores the communication messages and logs of the drone cluster; and the drone cluster is composed of multiple drones of the same model, each drone has a unique number, which is composed of a cluster code and a model code; the drone can be used as a base station to provide network access by forming an integrated space-air-ground communication network, and the drone is equipped with a global positioning system (GPS) and power inspection equipment to perform inspection tasks for power network defects or fault points.

[0037] Unicast and multicast communication methods are used between drone clusters and / or dispatch centers to transmit power inspection tasks and control command messages. The drone cluster selects unicast or multicast communication methods based on task requirements, communication efficiency, security requirements, and system flexibility and scalability.

[0038] For example, if the mission requires sending personalized instructions to a specific drone or receiving its feedback, point-to-point unicast communication is more appropriate; when the mission involves synchronous operations or broadcasting instructions to the entire cluster, multicast communication can significantly improve efficiency and reduce duplicate transmissions.

[0039] like Figure 2 As shown, in a specific implementation of the method of the present invention, a secure communication method for a power inspection drone cluster is provided, wherein the drone cluster uses unicast and multicast communication to transmit power inspection tasks and control instruction messages between clusters and / or dispatch centers; unicast and multicast communication are selected according to the state of the drone and the number of drones required for the task;

[0040] When the sending drone sends a message through unicast communication, the sending drone uses the Signal protocol to encrypt the message. The use of the Signal protocol to encrypt the message includes: the two parties of the encrypted message communication use Extended Triple Diffie-Hellman (X3DH) calculation to generate a shared key. After the authentication server verifies the identity of the drone, the double ratchet encryption message is sent through the dispatch center. When the offline receiving drone comes online again, it queries and decrypts the message from the dispatch center.

[0041] The Signal protocol used in the present invention can be applied in end-to-end communication and cluster communication, and can ensure the encrypted transmission of control messages, pictures, audio, video and other files. Even if the key of a message is leaked, hackers cannot decrypt previous messages and subsequent messages, so the signal protocol can provide forward security and backward security. The X3DH key exchange protocol used in the Signal protocol is the extended Triple Diffie-Hellman key exchange protocol, which is a 3x enhanced key exchange protocol based on the Diffie-Hellman protocol, used for end-to-end encrypted communication between different devices or different users in running programs, and is part of the Signal protocol.

[0042] In this embodiment, when communicating via multicast, the sending drone uses online / offline attribute-based encryption (CP-ABE) to encrypt the message, the dispatch center partially decrypts the message and temporarily stores it, and waits for the offline drone to return, then sends the message so that the receiving drone can fully decrypt the message.

[0043] The CP-ABE (Ciphertext-Policy Attribute-Based Encryption) algorithm adopted by the present invention is an advanced encryption scheme designed to provide fine-grained access control to data. It allows data owners to define access policies so that encrypted data can only be decrypted and accessed when users meet specific attribute requirements. Compared with traditional identity-based encryption (IBE), CP-ABE is more flexible because it is not limited to policies based on user identities, allowing data owners to define complex access rules. In the encryption scheme of this CP-ABE algorithm, data is encrypted and associated with an access policy. Users must meet the conditions specified in the access policy to decrypt the data.

[0044] The Signal protocol is used in unicast communication. One of the advantages of the Signal protocol is that the receiving end can be offline, which makes it very suitable for unicast scenarios between drones. Therefore, in an embodiment of the present invention, when the sending drone sends a message through unicast communication, another embodiment includes:

[0045] Step 1: The drone sends an authentication request to the dispatch center, where the authentication request carries its public identity key to verify its identity.

[0046] Step 2: The dispatch center queries the pre-stored pre-key package of the receiving drone and sends it to the sending drone.

[0047] Step 3: The receiving drone uses its private key to decrypt the pre-key package, generate a temporary key pair, and perform an extended triple Diffie-Hellman (X3DH) key agreement to generate a shared key.

[0048] Step 4: The sending drone calculates the shared key, encrypts the message using the double ratchet algorithm and stores it in the dispatch center.

[0049] Step 5: After the receiving drone comes online, the dispatch center verifies its identity and forwards the pre-key package.

[0050] Step 6: The receiving drone decrypts the pre-key package, performs X3DH calculation, calculates the shared key, decrypts the encrypted message forwarded by the dispatch center, obtains the original message content, and deletes the one-time pre-key OPKb3s used.

[0051] Specifically, assume that the drone cluster includes UAVA and UAVB, where UAVA is the sending drone and communicates with UAVB as the receiving drone. The dispatch center is located between the two and is used to temporarily store encrypted messages and record logs. When the sending drone (UAVA) needs to send a message to an offline receiving drone (UAVB) through unicast communication, the steps for encrypted communication using the Signal protocol are as follows:

[0052] S11, Initialization phase: In the initial phase of the Signal protocol, the following keys are generated, including:

[0053] PK: Public key of the drone.

[0054] SK: Private key of the drone.

[0055] IKp, IKs: The public and private keys of the drone, which are unique.

[0056] SPKp, SPKs: The drone’s pre-signature public key and private key, generated by the X25519 curve and signed by the identity private key.

[0057] OPKi: One-time pre-key of the drone, the number of which can be set according to actual needs, for example 100.

[0058] Each participating drone’s PK, IKp, SPKp, signature (IKs, code (SPKp)) and OPK1, OPK2, ..., OPKm are sent to the dispatch center.

[0059] S12. Steps for encrypted communication:

[0060] S121. The sending drone UAVA establishes communication with the offline receiving drone UAVB and sends a request message to the dispatch center, wherein the request message includes the public identity key IKap of UAVA to verify its identity.

[0061] S122. After verifying the identity of the UAVA, the dispatch center sends the previously stored UAVB pre-key package to it. The pre-key package is set as follows:

[0062] Encrypt PKa (IKb p ∥SPK p ∥OPKb1∥OPKb2...∥OPKbm)∥

[0063] sig(IKb s ,Encode(SPKb p ))

[0064] It contains the UAVB identity public key, the signed pre-public key and the one-time pre-key.

[0065] S123. After receiving the pre-key package, UAVA uses its own private key SKa to decrypt the package and obtain IKbp, SPKbp and OPKb from it. Then, UAVA generates a temporary key pair EKap and EKas.

[0066] S124.UAVA uses IKas, EKas, IKbp, SPKbp, and a one-time prekey (e.g., OPKb3) to perform the X3DH calculation:

[0067] -DH1=DH(IKas,SPKbp)

[0068] -DH2=DH(EKas,IKbp)

[0069] -DH3=DH(EKas,SPKbp)

[0070] -DH4=DH(EKas,OPKb3)

[0071] S125. After completing the X3DH calculation, UAVA calculates the key S and related data AD, which includes the identity information of the sending drone and the receiving drone, and then applies the double ratchet algorithm to perform the operation:

[0072] S=KDF(DH1∥DH2∥DH3∥DH4)

[0073] AD=Encode(IKa p )∥Encode(IKb p )

[0074] DR(S,(EKa p ,EKa s ))

[0075] The temporary private key EKas is then deleted and the output value is calculated using Diffie-Hellman.

[0076] S126. The sending drone UAVA sends the encrypted message to the dispatch center for storage:

[0077] Encrypted message: Encrypt IKbp (EKa p ∥OPKb3)∥AEAD(message,S)

[0078] S127. When the receiving drone UAVB comes back online, it sends a request message to the dispatch center, which includes its public key IKbp. After the dispatch center verifies the identity of UAVB, it forwards the pre-key package to UAVB. The pre-key package: Encrypt IKbp (IKa p ∥EKa p ∥OPKb3)∥AEAD(message,S)

[0079] S128. The receiving drone UAVB uses its private identity key IKbs to decrypt EncryptIKbp(IKap, EKap||OPKb3), and then performs X3DH calculation.

[0080] DH1=DH(IKa p ,SPK s )

[0081] DH2=DH(EKa p ,IKb s )

[0082] DH3=DH(EKa p ,SPK s )

[0083] DH4=DH(EKa p ,OPKb3 s )

[0084] Use the double ratchet algorithm to calculate the same key S and related data AD as UAVA

[0085] S=KDF(DH1∥DH2∥DH3∥

[0086] DH4)AD=Encode(IKa p )∥

[0087] Encode(IKb p )DR(S,EKa p )

[0088] S129. Finally, UAVB uses the calculated X3DH output value, key S and related data AD to decrypt AEAD(message, S) sent by the scheduling center to obtain the original message content and delete the one-time pre-key OPKb3s used.

[0089] The present invention ensures that drones can communicate securely in both offline and online states by using the Signal protocol and the X3DH key exchange mechanism, while ensuring the confidentiality and forward secrecy of messages. In addition, the high availability and continuity of drone communications are achieved through the temporary storage and forwarding function of the dispatch center. The Double Ratchet Algorithm is used to ensure forward secrecy, ensuring that each message exchange in the conversation is protected by a unique encryption key.

[0090] In a further embodiment of the present invention, the detailed steps of encrypting a message using the double ratchet algorithm include: Step 101: Key generation and ratchet initialization

[0091] Step 101, the sending drone and the receiving drone initialize the sending and receiving ratchets, and the sending ratchet of the sending drone generates a temporary key pair based on its root key, and the key pair includes a temporary public key and a private key; the temporary key pair is used to perform a one-time Diffie-Hellman key exchange with the public key of the UAVB to generate a session key.

[0092] Step 102: Key exchange and message encryption

[0093] The sending drone UAVA sends its temporary public key to the receiving drone UAVB, and UAVB generates its own temporary key pair and sends the temporary public key to UAVA. Both parties use the other party's temporary public key and their own temporary private key to perform Diffie-Hellman key exchange and generate a shared session key.

[0094] UAVA uses the session key to encrypt the message to be sent. Then, UAVA sends the encrypted message and necessary metadata (e.g., a sequence number or timestamp for key identification) to UAVB.

[0095] Step 103: Message reception, decryption and ratchet update

[0096] After UAVB receives the encrypted message, it uses its root key and the receive ratchet mechanism, as well as the temporary key from the Diffie-Hellman key exchange with UAVA, to generate the key required to decrypt the message.

[0097] UAVB uses the key to decrypt the received message and updates its root key and temporary key pair according to the double ratchet algorithm to prepare for the next encrypted communication.

[0098] If UAVB replies to the message, it encrypts the reply message with the updated key and sends it to UAVA. At the same time, UAVB's sending ratchet will also update its key status.

[0099] By using the double ratchet algorithm to encrypt messages in the Signal protocol, strong security is provided for drone communications, ensuring the confidentiality of messages and the security of communications.

[0100] In another embodiment of the present invention, when communicating via multicast, the sending drone uses an online / offline attribute-based encryption (CP-ABE) protocol to encrypt the message. After receiving the encrypted message, the dispatch center partially decrypts the encrypted message and temporarily stores it, waiting for the offline drone to return and then sending the partially decrypted message to the receiving drone for it to completely decrypt the message.

[0101] The communication by multicast also includes that when a drone needs to send a message to a group of other drones with the same attributes, it will use online / offline attribute-based encryption (CP-ABE) to encrypt the message. If the receiving drone is online, it directly uses CP-ABE to decrypt the message. If the receiving drone is offline, the dispatch center uses CP-ABE to partially decrypt the encrypted message, and the partially decrypted message is stored. When the offline receiving drone comes back online and sends its identity information to the dispatch center, the dispatch center verifies and sends the partially decrypted message to the receiving drone to complete the decryption of the message. Encrypting a message using the online / offline attribute-based encryption (CP-ABE) protocol includes the following steps:

[0102] Step 201: The key generation center (KGC) defines the attribute set and access structure, generates a corresponding key for each attribute, and generates a private key for each drone based on its attribute;

[0103] Step 202: The sending drone encrypts the message using the encryption key and access structure provided by the KGC; the encrypted message is sent to the dispatch center, which distributes the message to the online drone or generates and stores a partially decrypted message and a partially decrypted token for the offline drone based on the online / offline status of the receiving drone;

[0104] Step 203: The online drone uses its private key and the attribute-based encryption key provided by KGC to decrypt the received encrypted message. After the offline drone comes online, it requests the stored partial decrypted message and the corresponding decryption token from the dispatch center, and then uses its own private key to complete the final decryption and obtain the original message content.

[0105] In another embodiment of the present invention, the message is encrypted using the online / offline attribute-based encryption (CP-ABE) algorithm protocol as follows:

[0106] S1, Multicast communication setup phase (Setup):

[0107] S11. System parameter selection: Select global system parameters, including the cyclic multiplication group G and the corresponding bilinear mapping target group G T The generator g of G and the hash functions H and H1 are as follows, where H maps a binary string of arbitrary length to an element in the group G, and H1 maps an element in H1 to a binary string of fixed length.

[0108] H:(0,1) * →G,H1:G T →(0,1) logp

[0109] S12. Key Generation Center (KGC) Operations:

[0110] -KGC selects random index r1, r2, And generate public system parameters, namely the public key PK KGC and the master key MK KGC .

[0111]

[0112]

[0113] -KGC is the Dispatch Center (ID DC ) Generate public key PK DC and the master key MK DC .

[0114] PK DC =g t

[0115] MK DC =H(ID DC ) t ,in

[0116] S13. Unmanned aerial vehicle (UAVs) identity registration: The identity IDx of all UAVs in the cluster is sent to the dispatch center.

[0117] S2, key generation phase (KeyGen): KeyGen (MK KGC ,T),T is the attribute set

[0118] S21. Each drone selects a random number r∈Zp.

[0119] S22. For each attribute m in the attribute set T, KGC selects a random number r m ∈Zp,m∈T. and calculate the drone's key

[0120]

[0121] S23.KGC outputs and distributes the calculated key to the corresponding drones.

[0122] S3 encryption stage (Encryption):

[0123] S31. Send the drone to select a random number s∈Z p ,q R (0)=s,

[0124] And calculate the encryption constant C0 = h s ,

[0125] S32. The sender generates a key KDC and an encryption token C" between it and the dispatch center.

[0126] S33. Construct an encrypted message CT based on the access structure A.

[0127] S34. The sender packages the encrypted message CT together with other necessary information (such as C0, C′, C″, etc.) and sends it to the dispatch center.

[0128] The specific process of the encryption phase is to use (PKKGC, PKDC, M, A), where M represents the message and A represents the access structure, which defines which drones can decrypt the message. It involves the use of attribute-based encryption (ABE) scheme, in which the message is encrypted in a form that only allows receivers that meet a specific set of attributes to decrypt. The sending drone only needs to encrypt the message once, regardless of whether the receiving drone is online or offline. The dispatch center performs corresponding processing based on whether the receiving drone is online or offline. The detailed process is: only when x is a leaf node, define the function att(x). When x is a leaf node in the access structure A, att(x) is defined. The leaf node here represents a specific attribute, such as the location, type, or permission level of the drone. The function of att(x) is to map each leaf node to an attribute, which is the attribute or identity information of the drone associated with the leaf node. For example, if the access structure includes a leaf node x, then att(x) may return the type of the drone or its geographic location coordinates.

[0129] The sending drone selects a random number s∈Zp for the encryption process. Let R be the root node and set qR(0)=s. Then the sender calculates C0=h s , C′=Me(g,g) r1s .

[0130] The sending drone continues to select a random number σ∈Zp and then generates a key K between the drone and the dispatch center. DCand C″. Because KSDC is used to perform blind operations on them, the key generation center (KGC) cannot decrypt C″.

[0131] K DC =e((g t ) σ ,H(ID DC ))

[0132] C″=C′·K S_DC

[0133] Assume that F is the set of leaf nodes in the access structure A. The calculated ciphertext is as follows

[0134]

[0135] Then send the drone to send IDsender,g σ ,CT to the dispatch center.

[0136] The above steps can be used to implement the specific process of using online / offline attribute-based encryption (CP-ABE) for encryption when sending and receiving drones in a drone cluster, and when multicasting between the key generation center (KGC) and the dispatch center (Dispatch Center).

[0137] S4 Token Generation Phase (TokenGen):

[0138] S41.KGC generates a token TK using the sender's identity and access structure.

[0139] In the token generation phase, the token is TokenGen(SK,S), where the token is generated based on the input key SK and the access structure S. The specific steps are as follows:

[0140] S411. When the key generation center (KGC) obtains the IDsender from the sender, g σ , after CT, it generates: where gσ is a bilinear pairing of random numbers chosen by the sender, D″m is the blinding key portion associated with attribute m, H(m) is the hash value of attribute m, and r2 is one of the system parameters.

[0141] S412. The token is derived as follows:

[0142] TK=H1(β m ),D m ,D′ m

[0143] In the token generation phase, KGC uses the recipient's attributes to generate a token, which is used in the subsequent decryption process. The TK token contains enough information so that the receiving drone can verify its authority and decrypt the message. It ensures that only drones with the correct set of attributes can successfully decrypt the message, while protecting the confidentiality and integrity of the message. Since the token is generated at the KGC and relies on the access structure, it can ensure that only drones that meet specific conditions can access the encrypted data. First, for each attribute m, KGC calculates βm, which is a shared key based on Diffie-Hellman as part of the derived token. H1 is a hash function used to map the shared βm to a fixed value for subsequent processing. The token TK consists of a hash value and the key components Dm and D′m associated with the attribute. The token assists the online or offline receiving drone to complete the final decryption process after obtaining the partially decrypted message.

[0144] S5 Dispatch Center Decryption Phase:

[0145] S51. The dispatch center uses MKDC and KDC to partially decrypt the encrypted message and stores the partially decrypted content. When the receiving drone returns or goes online, the partially decrypted content is sent to the receiving drone. The following are the specific steps for partial decryption:

[0146] S511. Assume that the leaf node f comes from the access structure A, α=att(f).

[0147] S512. If α∈S, which means the receiving drone has the right to access this information, the dispatch center will continue to perform partial decryption steps:

[0148]

[0149] S513. The dispatch center calculates the key required for partial decryption:

[0150] K S_DC C=e(g β ,MK DC )

[0151] S514. Part of the ciphertext includes:

[0152]

[0153] Partial decryption is performed at the dispatch center to help the offline receiving drone to complete the final decryption process when it returns to the online state.

[0154] In the above process, first, if node f is a leaf node in the access structure, the dispatch center uses the attribute value α to perform calculations. Then, the dispatch center uses the recipient's attributes to calculate an intermediate result, which is used in the subsequent decryption steps. The dispatch center then uses the dispatch center's private key MK DC The public key gσ provided by the sender is used to calculate the session key KS shared with the receiver. DC The dispatch center generates a partially decrypted ciphertext CT', which includes KS in the denominator. DC C1, as well as the root hash value C0 and access structure A, and prepare for the recipient to continue the decryption process when he returns online.

[0155] S6, UAVs Decryption:

[0156] When the offline receiving drone comes back online, it sends an identity request to the dispatch center. The partially decrypted message stored in the dispatch center is sent to the receiving drone. The receiving drone uses its own key to finally decrypt the partially decrypted message to obtain the original message. In the drone decryption stage, when the receiving drone returns and sends its identity IDreceiver to the dispatch center for verification, the dispatch center sends the partially decrypted message CT′ to the receiving drone for complete decryption. After the receiving drone comes online again, the decrypted message is calculated:

[0157]

[0158] The drone decryption phase is the final step in the online / offline attribute-based encryption (CP-ABE) scheme of the present invention, where the dispatch center confirms the identity of the receiving drone and the previously stored partially decrypted message CT′ is sent to the receiving drone. The receiving drone uses its key SK and the partially decrypted ciphertext CT′, the receiving drone’s private key D and the partially decrypted C1 value, as well as the root hash value C0 and the access structure A to calculate the original message M. Finally, the receiving drone is able to recover the original message M, completing the entire decryption process. The above steps ensure that even in an offline state, the drone can securely receive and decrypt messages when it returns online.

[0159] In addition, for the access structure A, in the online / offline CP-ABE scheme, the access structure A is used as part of the encryption strategy. When the system is initialized, the global access structure is defined. In the key generation phase (KeyGen): the corresponding key is generated for each user according to the access structure to ensure that only users with the correct attribute set can decrypt the data; in the encryption phase (Encryption): when the data is encrypted, the access structure is embedded in the encrypted metadata to define which users' attribute sets can access the data; in the decryption phase (Decryption): when the user tries to decrypt the data, the system checks whether the user's attributes meet the authorization set conditions defined in the access structure.

[0160] The present invention can perform partial decryption at the dispatch center, using the computing power of the dispatch center to reduce the amount of calculations that the drone needs to perform after going online. It is particularly suitable for situations where drones may be offline due to power constraints, allowing them to quickly complete the decryption of messages when they go online, thereby saving computing resources and power. By performing partial decryption at the dispatch center, the drone can quickly complete the remaining decryption work after going online, thereby saving computing resources and power consumption. At the same time, this method also ensures the security of communications because even if the security of the dispatch center is compromised, the full decryption capability will not be directly exposed.

[0161] The core of the present invention is to provide a secure communication method for a cluster of power inspection drones. Through the above steps of the present invention, a safe and efficient communication method is provided for the drone group. At the same time, taking into account the power supply and computing limitations that the drones may encounter, a more efficient encryption method is adopted in unicast and multicast communications to reduce the computing burden of the drones. The communication process is optimized through the participation of the dispatching center to prevent the illegal theft of power inspection data, thereby greatly improving the security of drone communications.

[0162] A second aspect of the present invention provides a power inspection drone cluster security communication device, which includes a memory, a processor, and a computer program stored on the memory and run on the processor, wherein the processor executes the computer program and implements a power inspection drone cluster security communication method as described in the aforementioned embodiment.

[0163] The third aspect of the present invention also provides a power inspection drone cluster security communication device, including: a drone cluster control module, which is used to select unicast and multicast communication modes according to the respective states of the sending and receiving drones in the drone cluster and the task requirements, and transmit power inspection tasks and control instruction messages between the cluster and / or the dispatch center; a unicast communication module, which is used to encrypt messages using the Signal protocol when sending messages via unicast, wherein the use of the Signal protocol to encrypt messages includes using the Extended Triple Diffie-Hellman protocol to calculate and generate a shared key, after the authentication server verifies the identity of the drone, using the double ratchet algorithm to encrypt the message, and sending the message to the dispatch center, when the offline receiving drone is online again, querying and decrypting the message from the dispatch center; a multicast communication module, which is used to encrypt messages using the online / offline attribute-based encryption (CP-ABE) protocol when communicating via multicast, the dispatch center partially decrypts the message and temporarily stores it, and when the offline receiving drone is online again, receives the message from the dispatch center and completely decrypts the message.

[0164] The technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described in the above method. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system and device can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0165] The fourth aspect of the present invention provides a power inspection drone cluster security communication system, the system includes an authentication server, a dispatching center, a drone cluster, and the above-mentioned power inspection drone cluster security communication method is executed between the drone cluster and / or the dispatching center.

[0166] In addition to the above-mentioned methods and devices, the embodiments of the present invention may also be a computer program product, which includes computer program instructions, which, when executed by a processor, enable the processor to execute the steps of the target detection method according to various embodiments of the present invention described in the above "Exemplary Method" section of this specification.

[0167] The memory mentioned in this article can be any electronic, magnetic, optical or other physical storage device that can contain or store information, such as executable instructions, data, etc. For example, the machine-readable storage medium can be: RAM (Radom Access Memory, random access memory), volatile memory, non-volatile memory, flash memory, storage drive (such as hard disk drive), solid state drive, any type of storage disk (such as CD, DVD, etc.), or similar storage medium, or a combination thereof.

[0168] In some embodiments, a machine-readable storage medium is also provided, in which machine-executable instructions are stored, and when the machine-executable instructions are executed by a processor, the method described in the above embodiments is implemented. For example, the machine-readable storage medium can be a ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage device, etc.

[0169] The embodiment of the present application also provides a computer program product, which stores a computer program and, when a processor executes the computer program, prompts the processor to execute the method described above.

[0170] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise one..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0171] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A method for secure communication of a power inspection drone cluster, characterized by: The drone cluster includes multiple sending and receiving drones, and the multiple sending and receiving drones select unicast and multicast communication modes according to their respective states and task requirements to transmit power inspection tasks and control instruction messages between the cluster and / or the dispatch center; When sending a message by unicast, the sending drone uses the Signal protocol to encrypt the message, wherein the use of the Signal protocol to encrypt the message includes that the communicating parties use the extended triple Diffie-Hellman protocol to calculate and generate a shared key, and after the authentication server verifies the identity of the drone, the double ratchet algorithm is used to encrypt the message and send it to the dispatch center. When the offline receiving drone comes online again, the dispatch center is queried and decrypted. When communicating via multicast, the sending drone encrypts the message using the online / offline attribute-based encryption (CP-ABE) protocol, the dispatch center partially decrypts the message and temporarily saves it, and when the offline receiving drone comes online again, it receives the message from the dispatch center and fully decrypts the message.

2. According to the method described in claim 1, the power inspection drone cluster includes multiple drones of the same model, each of which is equipped with power inspection equipment to perform power inspection tasks; each drone is set with a unique number, and the drone number includes the cluster code of the drone cluster and the model code of the drone model.

3. The method according to claim 1, characterized in that The sending of the message by unicast includes step 1, sending the drone to send an identity authentication request to the dispatch center, wherein the authentication request carries its public identity key to verify the identity; Step 2: The dispatch center queries the pre-stored pre-key package of the receiving drone and sends it to the sending drone; Step 3: The receiving drone uses its private key to decrypt the pre-key package, generate a temporary key pair, and perform an extended triple Diffie-Hellman key agreement to generate a shared key; Step 4: The sending drone calculates the shared key, encrypts the message using the double ratchet algorithm and stores it in the dispatch center; Step 5: After the receiving drone comes online, the dispatch center verifies its identity and forwards the pre-key package. The receiving drone decrypts the pre-key package, performs X3DH calculation, calculates the shared key, and decrypts the encrypted message forwarded by the dispatch center to obtain the original message content. At the same time, the one-time pre-key OPKb3s used is deleted.

4. The method according to claim 3, characterized in that The message encryption using the double ratchet algorithm includes: Step 101: The sending drone and the receiving drone initialize sending and receiving ratchets, and the sending ratchet of the sending drone generates a temporary key pair based on its root key, wherein the key pair includes a temporary public key and a private key; Step 102: The sending drone sends its temporary public key to the receiving drone. The receiving drone generates its own temporary key pair and sends the temporary public key to the sending drone. Both parties use the other party's temporary public key and their own private key to perform an extended triple Diffie-Hellman key exchange to generate a shared session key. The sending drone uses the session key to encrypt the message and sends it. Step 103, after receiving the encrypted message, the receiving drone uses the receiving ratchet to generate the key required to decrypt the message based on the root key and the temporary public key in the key exchange, and uses the key to decrypt the received message, and updates its root key and temporary key pair according to the double ratchet algorithm to prepare for the next encrypted communication.

5. The method according to claim 1, characterized in that: Encrypting a message using the Online / Offline Attribute-Based Encryption (CP-ABE) protocol involves the following steps: Step 201: The key generation center (KGC) defines the attribute set and access structure, generates a corresponding key for each attribute, and generates a private key for each drone based on its attribute; Step 202: The sending drone encrypts the message using the encryption key and access structure provided by the KGC; the encrypted message is sent to the dispatch center, which distributes the message to the online drone or generates and stores a partially decrypted message and a partially decrypted token for the offline drone based on the online / offline status of the receiving drone; Step 203: The online drone uses its private key and the attribute-based encryption key provided by KGC to decrypt the received encrypted message. After the offline drone comes online, it requests the stored partial decrypted message and the corresponding decryption token from the dispatch center, and then uses its own private key to complete the final decryption and obtain the original message content.

6. A power inspection drone cluster security communication system, the system includes an authentication server, a dispatch center, and a drone cluster, the drone cluster includes multiple sending and receiving drones, the multiple sending and receiving drones select unicast and multicast communication according to their respective states and task requirements, and transmit power inspection tasks and control command messages between the cluster and / or the dispatch center; When sending a message by unicast, the sending drone uses the Signal protocol to encrypt the message, wherein the use of the Signal protocol to encrypt the message includes that the communicating parties use extended triple Diffie-Hellman to calculate and generate a shared key, after the authentication server verifies the identity of the drone, the message is encrypted using the double ratchet algorithm and sent to the dispatch center, and when the offline receiving drone comes online again, the message is queried and decrypted from the dispatch center; When communicating via multicast, the sending drone encrypts the message using the online / offline attribute-based encryption (CP-ABE) protocol, the dispatch center partially decrypts the message and temporarily saves it, and when the offline receiving drone comes online again, it receives the message from the dispatch center and fully decrypts the message.

7. A power inspection drone cluster safety communication device, characterized in that: include: The UAV cluster control module is used to select unicast and multicast communication modes according to the states of the sending and receiving UAVs in the UAV cluster and the task requirements, and to transmit power inspection tasks and control command messages between the cluster and / or the dispatch center; A unicast communication module, used to encrypt messages using the Signal protocol when sending messages in a unicast manner, wherein the use of the Signal protocol to encrypt messages includes using an extended triple Diffie-Hellman protocol to calculate and generate a shared key, and after the authentication server verifies the identity of the drone, using a double ratchet algorithm to encrypt the message and send the message to the dispatch center, and when the offline receiving drone comes online again, querying and decrypting the message from the dispatch center; The multicast communication module is used to encrypt messages using the online / offline attribute-based encryption (CP-ABE) protocol when communicating via multicast. The dispatch center partially decrypts the messages and temporarily stores them. When the offline receiving drone comes online again, it receives the messages from the dispatch center and completely decrypts the messages.

8. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 5 is implemented.

Images