Method and device for verifying state information of aircraft

Abstract

The invention discloses a method and device for verifying aircraft state information. According to at least one embodiment of the present disclosure, a method performed by a UAM aircraft for verifying aircraft state information may include: receiving first state information of a first UAM aircraft; verifying the first state information; when the first state information does not pass verification, abnormal condition information of the first UAM aircraft is sent to a ground control system (GCS); receiving rule set update information from the GCS when the GCS determines that the first state information is information sent by an attacker; and updating the rule set based on the rule set update information.

Description

Technical Field

[0001] The present disclosure, in some embodiments, relates to methods and apparatus for verifying aircraft state information. More specifically, the present disclosure relates to methods and apparatus for verifying state information received by a ground control system (GCS) from an aircraft. Background Art

[0002] Urban Air Mobility (UAM) is a three-dimensional urban air traffic system that connects the ground and the air. It is the next generation of transportation system capable of transporting people and goods in urban areas. As the UAM market expands, UAM vehicles will provide a new means of transportation for the public, away from urban traffic congestion. In addition, a new area will begin to open up and reuse major urban land that has been occupied by traditional necessary facilities, such as numerous roads and parking lots that allow ground traffic to flow.

[0003] As the use of aircraft increases, aircraft will become more vulnerable. Therefore, ensuring the flight safety of aircraft is crucial to the successful commercialization of UAM. For example, a third person (not the pilot) who invades the cockpit of the aircraft may be able to take over the control, thereby risking a collision with other air vehicles. In addition, because aircraft are exposed to cyber attacks from external sources, an attacker sending distorted information such as the location of other aircraft to the aircraft will cause the control and management system of the aircraft to malfunction. Therefore, it is necessary to verify the aircraft status information in order to systematically manage the aircraft. Summary of the invention

[0004]

Technical issues

[0005] The present disclosure seeks, in some embodiments, to provide a method and apparatus for receiving and validating status information from an Urban Air Mobility (UAM) aircraft.

[0006] The present disclosure also seeks to provide a method and apparatus for determining false information from an external attacker.

[0007] Furthermore, the present disclosure is directed to providing a method and apparatus for validating data by comparing previous state information with current state information of a UAM aircraft.

[0008] Furthermore, the present disclosure is directed to providing a method and apparatus for protecting a plurality of UAM aircraft from external attackers.

[0009]

Methods to solve the problem

[0010] At least one aspect of the present disclosure provides a method for verifying aircraft status information performed by an urban air traffic (UAM) aircraft, the method comprising: receiving first status information of a first UAM aircraft; verifying the first status information; when the first status information fails to be verified, sending abnormal status information of the first UAM aircraft to a ground control system (GCS); when the GCS determines that the first status information is sent by an attacker, receiving rule set update information from the GCS; and updating the rule set based on the rule set update information.

[0011] Another aspect of the present disclosure provides a method for verifying aircraft status information performed by a GCS, the method comprising: receiving first status information of a first UAM aircraft; acquiring second status information present in a storage unit; obtaining verification information based on a difference between the first status information and the second status information; verifying the first status information based on the verification information and a flight plan of the first UAM aircraft; and when the first status information fails to be verified, determining whether the first status information corresponds to information sent by an attacker.

[0012] Another aspect of the present disclosure provides a method for verifying aircraft status information performed by a GCS, the method comprising: when one or more first UAM aircraft receive first status information of a second UAM aircraft, and the first status information is not verified by the one or more first UAM aircraft, receiving abnormal status information of the second UAM aircraft from the one or more first UAM aircraft; and determining whether the one or more first UAM aircraft erroneously sent the abnormal status information.

[0013] Yet another aspect of the present disclosure provides a ground control system (GCS) comprising a memory and at least one processor, wherein the at least one processor may be configured to: receive first status information of a first UAM aircraft; obtain second status information present in a storage unit; obtain verification information based on a difference between the first status information and the second status information; verify the first status information based on the verification information and a flight plan of the first UAM aircraft; and when the first status information fails to be verified, determine whether the first status information corresponds to information sent by an attacker, and wherein the second status information may correspond to information received before receiving the first status information.

[0014]

Beneficial Effects

[0015] As described above, one aspect of the present disclosure may provide a method and apparatus for receiving and verifying status information from a UAM aircraft.

[0016] The present disclosure may also provide a method and apparatus for determining error information from an external attacker.

[0017] Additionally, the present disclosure may provide a method and apparatus for validating data by comparing previous state information of a UAM aircraft with current state information.

[0018] Additionally, the present disclosure may provide a method and apparatus for protecting multiple UAM aircraft from external attackers.

[0019] The effects of the present disclosure are not limited to the above-mentioned effects, and other effects not mentioned will be apparent to those of ordinary skill in the art from the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 is a diagram showing communication link types for Urban Air Mobility (UAM) services.

[0021] Figure 2 is a diagram showing the architecture of UAM aircraft networks and systems.

[0022] Figure 3A and Figure 3B is a diagram showing a system for remotely controlling a UAM aircraft.

[0023] Figure 4 is a diagram showing the relationship between UAM aircraft, attackers, and external entities.

[0024] Figure 5 is a diagram showing the threat posed by an attacker to a transport.

[0025] Figure 6 is a diagram showing the threat caused by the attacker's impersonation.

[0026] Figure 7 is a diagram illustrating the relationship between an Urban Air Mobility (UAM) aircraft, a Ground Control System (GCS), and an attacker, in accordance with at least one embodiment of the present disclosure.

[0027] Figure 8 is a diagram illustrating a configuration of a GCS that receives status information of a UAM aircraft, according to at least one embodiment of the present disclosure.

[0028] Fig. 9 is a diagram illustrating GCS operation steps according to at least one embodiment of the present disclosure.

[0029] Fig.10 is a schematic diagram illustrating the relationship between multiple UAM aircraft, a GCS, and an attacker according to at least one embodiment of the present disclosure.

[0030] Fig.11is a diagram illustrating a configuration of another UAM aircraft receiving status information from a plurality of UAM aircraft in accordance with at least one embodiment of the present disclosure.

[0031] Fig.12 is a diagram illustrating operational steps of a GCS and UAM aircraft for receiving status information of a plurality of UAM aircraft in accordance with at least one embodiment of the present disclosure.

[0032] Fig.13 is a diagram illustrating a method performed by one or more UAM aircraft for verifying state information of a UAM aircraft in accordance with at least one embodiment of the present disclosure.

[0033] Fig.14 is a diagram illustrating a method performed by a GCS for verifying status information of a UAM aircraft in accordance with at least one embodiment of the present disclosure.

[0034] Fig.15 is a diagram illustrating a method for verifying status information of a UAM aircraft performed by a GCS according to another embodiment of the present disclosure. DETAILED DESCRIPTION

[0035] The present disclosure may be modified in many ways, and the present disclosure has many embodiments, examples of which will be described in detail with reference to the accompanying drawings. However, the present disclosure is not limited thereto, although the exemplary embodiments may be interpreted as including all modifications, equivalents or substitutes within the technical concept and technical scope of the present disclosure. Similar reference numerals refer to the same or similar functions in different aspects. In the accompanying drawings, the shapes and sizes of the elements may be magnified for clarity. In the following detailed description of the present disclosure, reference is made to the accompanying drawings, which illustrate specific embodiments in which the present disclosure can be practiced by way of illustration. These embodiments are described in sufficient detail to enable those skilled in the art to implement the present disclosure. It should be understood that the various embodiments of the present disclosure, although different, are not necessarily mutually exclusive. For example, without departing from the spirit and scope of the present disclosure, the specific features, structures and characteristics described herein in conjunction with one embodiment may be implemented in other embodiments. In addition, it should be understood that the position or arrangement of the various elements in each disclosed embodiment may be modified without departing from the idea and scope of the present disclosure. Therefore, the following detailed description should not be understood as restrictive, and the scope of the present disclosure is limited only by the appended claims properly interpreted and the full range of equivalents required by the claims.

[0036] The terms used in the specification, "first", "second", etc. can be used to describe various components, but the components should not be interpreted as limited to these terms. These terms are only used to distinguish one component from other components. For example, without departing from the scope of the present disclosure, the "first" component can be named as the "second" component, and the "second" component can also be similarly named as the "first" component. The term "and / or" includes a combination of multiple items or any one of multiple terms.

[0037] It should be understood that in this specification, when an element is simply referred to as being “connected to” or “coupled to” another element rather than being “directly connected to” or “directly coupled to” another element, it can be “directly connected to” or “directly coupled to” another element, or connected or coupled to another element with another element interposed therebetween. Conversely, it should be understood that when an element is referred to as being “directly coupled to” or “directly connected to” another element, there are no intervening elements.

[0038] The components shown in the embodiments of the present disclosure are independently displayed to represent the characteristic functions that are different from each other. Therefore, this does not mean that each component is composed of a component unit of separated hardware or software. In other words, for convenience, each component includes each listed component. Therefore, at least two components of each component can be combined to form a component, or a component can be divided into multiple components to perform each function. Without departing from the essence of the present disclosure, the embodiment of combining each component and the embodiment of dividing a component are also included in the scope of the present disclosure.

[0039] The terms used in this specification are only used to describe specific embodiments, and are not intended to limit the present disclosure. Unless there is a different meaning in the context, the expression used in the singular includes the expression of the plural number. In this specification, it should be understood that terms such as "including", "having", etc. are intended to indicate the existence of features, numbers, steps, actions, elements, parts or combinations thereof disclosed in the specification, and are not intended to exclude the possibility that one or more other features, numbers, steps, actions, elements, parts or combinations thereof may exist or may be added. In other words, when a particular element is referred to as "included", elements other than the corresponding element are not excluded, but additional elements may be included in the embodiments of the present disclosure or in the scope of the present disclosure.

[0040] Certain components may not be essential components for performing the basic functions of the present disclosure, but rather selective components that only improve its performance. In addition to components for improving performance, the present disclosure may be implemented by only including components that are essential for implementing the essence of the present disclosure. In addition to selective components for only improving performance, structures that only include essential components are also included within the scope of the present disclosure.

[0041] Embodiments of the present disclosure will be described in detail below with reference to the accompanying drawings. When describing the exemplary embodiments of the present disclosure, well-known functions or configurations will not be described in detail because they may unnecessarily obscure the understanding of the present disclosure. The same constituent elements in the drawings are represented by the same reference numerals, and repeated descriptions of the same elements will be omitted.

[0042] Hereinafter, some embodiments of the present disclosure will be described in detail with reference to the accompanying drawings. In the following description, similar reference numerals preferably represent similar elements, although these elements are shown in different drawings. In addition, in the following description of some embodiments, for the purpose of clarity and brevity, detailed descriptions of related known components and functions will be omitted when these descriptions are considered to obscure the subject matter of the present disclosure.

[0043] Figure 1 is a diagram showing the types of communication links served by Urban Air Mobility (UAM). Depending on the length of the take-off and landing runways, aircraft can be classified as conventional take-off and landing (CTOL) aircraft, short take-off and landing (STOL) aircraft, and vertical take-off and landing (VTOL) aircraft. CTOL requires a long runway for take-off and landing, while both STOL and VTOL require a short runway or no runway at all. Electric vertical take-off and landing (E-VTOL) is a technology in which an aircraft takes off and lands vertically using electricity.

[0044] E-VTOL can be used for UAM or advanced air mobility (AAM) services in urban areas. E-VTOL is characterized by vertical take-off and landing, electrification of lift, rotary rotors, automatic control, semi-automatic control, and remote control. Applications can be written for UAM and AAM services to enable passenger transportation including taxis, emergency services for purposes such as rescue and first aid, recreational activities, and cargo delivery services. An unmanned aerial vehicle system (UAS) is an unmanned or remotely controlled aircraft with a specific purpose (e.g., cargo transportation, atmospheric research, or surveillance). In order to provide safe and accurate aviation and broadband communication services in the aircraft, E-VTOL can use a variety of communication links and types, including traditional air traffic communications, automatic dependent surveillance-broadcast (ADS-B), global navigation satellite system (GNSS), cellular networks, command and control (C2), and satellite communications.

[0045] Air traffic communication can be used to prevent interference between two aircraft and between an aircraft and obstacles in a maneuvering area and maintain air traffic order. ADS-B can be used to send position information to another aircraft and air traffic control stations using very high frequency (VHF) frequency bandwidth for air traffic control. Vehicle-to-vehicle (V2V) communication can be used for aircraft-to-aircraft communication to share information between two aircraft by using a cellular network and prevent collisions between them.

[0046] GNSS may correspond to a combination of global positioning, navigation, and timing determination functions, and may be used for one or more satellites. GNSS may be augmented by ground stations or geostationary satellites to improve integrity and positioning accuracy. Satellite communications (SatCom) may be used to provide broadband services in an aircraft cabin using satellite communications channels. Cellular communications may be used to provide broadband services in an aircraft cabin and provide command and control (C2) communications via a cellular network channel. Wi-Fi may be used to provide broadband services in an aircraft cabin via SatCom or a cellular network. C2 may correspond to a data link between a remotely operated aircraft and a remote pilot for flight management.

[0047] Reference Figure 1 , the control station 110 and the UAM aircraft 140 can send and receive control information, control commands and flight information via link type 1. Link type 1 can include C2, cellular communication, etc. The cellular network 120 and the UAM aircraft 140 can send and receive control information, control commands and broadband data via link type 2. Link type 2 can include cellular communication. The air traffic control station 130 and the UAM aircraft 140 can send and receive flight information via link type 3. Link type 3 can include air traffic communication. The UAM aircraft 140 can send and receive flight information to and from the aircraft 150 and the helicopter 155 via link type 4. Link type 4 can include ADS-B. The two UAM aircraft can send and receive flight information between them via link type 5. Link type 5 can include V2V and ADS-B. The UAM aircraft 140 and the satellite 160 can send and receive time information, position information, control commands, control information and broadband data to each other via link type 6. Link type 6 can include GNSS, C2 and satellite communication.

[0048] Figure 2 1 is a diagram showing a UAM aircraft network architecture and a system structure of a UAM aircraft. Various types of antennas for communicating with external entities are provided on the surface of the UAM aircraft. The UAM aircraft is internally provided with an aircraft system structure connected to a data bus.

[0049] Reference Figure 2 , UAM aircraft have various types of antennas on the surface for communicating with satellites, other UAM aircraft, air traffic control stations, maintenance computers, cellular networks, and ground control systems (GCS). UAM aircraft systems may include data buses, infotainment systems, data link systems, storage systems, flight control systems, autonomous sensors, propulsion systems, emergency systems, landing gear systems, power management systems, avionics systems, safety management terminals, and maintenance panels. Security managers aboard UAM aircraft can monitor or access UAM aircraft systems.

[0050] The data bus can be used for in-flight networking to send large amounts of data between various systems. The infotainment system can be used to provide in-cabin entertainment services. The data link system can provide communication functions inside and outside the UAM aircraft. The data link system can be communicatively connected to the control terminal to send or receive various information. The storage system can be used to manage various data storage systems used in the aircraft. The flight control system can be used for flight controls, connection links, and actuation mechanisms required to control the direction of the aircraft during flight. Autonomous sensors can be used for various cameras and sensors inside and outside the aircraft. The propulsion system can be used to control the propulsion components of the aircraft. The emergency system can be used to provide safety functions for passengers and emergencies. The landing gear system can be used for takeoff and landing of the aircraft. The power management system can control the power of the aircraft. The avionics system can include system integration, data logging, navigation assistance, and collision avoidance functions. The maintenance panel can be used for maintenance, diagnosis, and downloading flight logs and software updates.

[0051] Figure 3A and Figure 3B is a diagram showing a system for remotely controlling a UAM aircraft. A pilot can remotely control a UAM aircraft via radio communications. The remotely controlled aircraft system can handle both radio line of sight (RLOS) and radio no line of sight (BRLOS) conditions.

[0052] Reference Figure 3A , for RLOS conditions, the remote control station can control the remotely operated aircraft through the C2 link. The navigator can operate a certified UAM aircraft. The safety manager can board the UAM aircraft to serve the passengers and ensure safety. In the RLOS condition, the remotely operated aircraft can send and receive information to and from the air traffic control station by using the VHF frequency bandwidth. In the RLOS condition, the remote control station and the air traffic control station can communicate directly with the UAM aircraft and can visually check the status of the aircraft.

[0053] Reference Figure 3B, for BRLOS conditions, communications are delayed and the navigator's naked eyes may not be able to check the status of the UAM aircraft. In BRLOS conditions, the remote control station can send and receive information to and from the satellite by using the C2 link. In BRLOS conditions, the satellite can send and receive information to and from the remotely controlled aircraft by using the C2 link. In BRLOS conditions, the remotely controlled aircraft can send and receive information to and from the air traffic control station by using the VHF frequency bandwidth.

[0054] Figure 4 is a diagram showing the relationship between UAM aircraft, attackers, and external entities.

[0055] Reference Figure 4 , an attacker can eavesdrop on the communication data between the vehicle and external entities. This may expose unprotected UAM control commands, status information, update packages, etc. The attacker can obtain private data or use this data to conduct further attacks. Vehicles can include UAM aircraft, vehicles, drones, robots, etc.

[0056] Figure 5 is a diagram showing the threat posed by an attacker to a transport.

[0057] Reference Figure 5 , attackers can manipulate software to attack a transportation device as a vehicle. Attackers can modify software, such as firmware, scripts, calibration data, etc. Attackers can manipulate log data to attack vehicles. Attackers can delete or modify log data of intrusion detection systems, firewalls, and wireless systems, especially audit logs of security events. Attackers can manipulate rules in intrusion detection systems (IDS) and firewalls to attack vehicles. Attackers can manipulate rules in firewalls and IDS to ignore abnormal condition messages. Attackers can manipulate communication data. Attackers can change communication messages between vehicles and external entities.

[0058] Figure 6 is a diagram illustrating the threat through the attacker's disguise.

[0059] Reference Figure 6, attackers can pretend to be other entities, such as global communication systems, remote navigators, other vehicles, maintenance engineers, control stations, air traffic control stations, satellites, and over-the-air programming (OTA) servers to gain control of the transportation device as a vehicle. An attacker can pretend to be a GCS and issue UAM aircraft control commands to the aircraft. An attacker can pretend to be a remote navigator to send information to the vehicle. An attacker can pretend to be another UAM aircraft to send information to the vehicle. An attacker can pretend to be a maintenance engineer to send diagnostic requests and responses to the vehicle. An attacker can pretend to be a control station or an air traffic control station to send flight information to the vehicle. An attacker can pretend to be a satellite to send information to the vehicle. An attacker can pretend to be an OTA server to send update packages and reports to the vehicle. Therefore, the vehicle needs to receive information from another entity that is authenticated and trusted. Here, the transportation device as a vehicle can include UAM aircraft, vehicles, drones, robots, etc.

[0060] Figure 7 is a diagram illustrating the relationship between a UAM aircraft, a ground control system (GCS), and an attacker in accordance with at least one embodiment of the present disclosure.

[0061] Reference Figure 7 , UAM aircraft in flight can monitor their status and send status information to GCS. GCS can receive various status information from UAM aircraft to monitor abnormal conditions. In an emergency, the ground control system can remotely control the UAM aircraft. An attacker can disguise it as a legitimate UAM aircraft and send false information to GCS. This may cause confusion and increase the risk of traffic conditions.

[0062] Figure 8 is a diagram illustrating a configuration of a GCS that receives status information of a UAM aircraft, according to at least one embodiment of the present disclosure.

[0063] Reference Figure 8, the UAM aircraft 810 may periodically send status information to the GCS 830. The status information sent by the UAM aircraft 810 may include header information, payload information, global positioning system (GPS) information, and timestamp information. The attacker 820 may disguise itself as a legitimate UAM aircraft 810 and send false information to the GCS 830. The information received by the GCS 830 may be received by the communication unit 831, and the authentication unit 832 may determine whether the information is false. The authentication unit 832 may receive the status information previously received from the UAM aircraft 810 from the storage unit 833. The authentication unit 832 may verify whether the status information is false by comparing the currently received status information with the previously received status information. The authentication unit 832 may calculate the difference between the currently received status information and the previously received status information. The calculated information difference may determine whether the direction of travel, position, travel distance, and speed of the UAM aircraft 810 are reasonable compared to the flight plan.

[0064] When the authentication unit 832 determines that the current state information is not false information as a result of the verification, the storage unit 833 may store the current state information received from the authentication unit 832. When the authentication unit 832 determines that the current state information is false information as a result of the verification, the data processing unit 834 may discard the false information received from the authentication unit 832. The control unit 835 may discard the false information of the data processing unit 834, or control the processing of the current state information. The data processing unit 834 may send the current state information to the input / output unit 836. The input / output unit 836 may output the current state information to the screen of the administrator 840. The administrator may manage the GCS 830 by viewing the current state information output on the screen. The GCS 830 may determine the false information because the attacker 820 cannot know the current GPS information and the previous GPS information of the legitimate UAM aircraft 810.

[0065] Fig. 9 is a diagram illustrating GCS operation steps according to at least one embodiment of the present disclosure.

[0066] Reference Fig. 9, the UAM aircraft can send status information to the GCS (S910). The UAM aircraft can use the Android Debug Bridge (ADB) or the like to send status information to the GCS. The GCS can receive current status information from the UAM aircraft and identify GPS information and time information from the current status information (S920). Here, the time information can correspond to timestamp information. From the storage unit, the previous status information sent from the UAM aircraft can be obtained (S921). The current increment, that is, the difference between the current status information and the previous status information, can be calculated (S922). The previous increment can be obtained from the storage unit (S923). Verification data can be calculated by considering the current increment and the previous increment (S924).

[0067] It can be determined whether the verification of the current state information by the verification data is successful (S930). The flight plan can be used to determine whether the verification of the current state information is successful. When the verification is successful (S930-Yes), the current state information and the current increment can be stored in the storage unit (S940). An ACK can be sent to the UAM aircraft (S941). The UAM aircraft can receive the ACK from the GCS. The payload information can be sent to the data processing unit (S942). If the verification fails (S930-No), it can be determined whether the current state information was sent by the attacker (S950).

[0068] The GCS may periodically receive status information from the UAM aircraft. The GCS may determine whether it has received normal status information from the UAM aircraft before and after receiving the current status information that failed verification. The GCS may use this determination to determine whether the current status information that failed verification was sent by an attacker. For example, when the GCS receives normal status information from the UAM aircraft before and after the GCS receives the current status information that failed verification, the information may be determined to be information sent by the attacker. For example, when the GCS does not receive normal status information from the UAM aircraft at any time before and after receiving the current status information that failed verification, the information may be determined to be information not sent by the attacker. When the attacker sends the current status information (S950-Yes), the received false information may be recorded in a log (S951). The received false information may be discarded (S952).

[0069] If the current status information is not sent by the attacker (S950-No), emergency processing can be initiated (S953). A separate channel can be used to confirm the flight status of the UAM aircraft through the navigator or safety manager of the UAM aircraft (S954). The GCS can obtain control of the UAM aircraft. Here, the current status information may not correspond to the false information sent by the attacker. For the attacker to successfully attack, the attacker needs to know the identification information of the UAM aircraft, the flight information of the UAM aircraft (for example, position, altitude, direction, speed), and the flight trajectory and flight plan of the UAM aircraft. Therefore, the present disclosure can effectively defend against the attacker's deception attack.

[0070] Fig.10 is a diagram illustrating the relationship between multiple UAM aircraft, a GCS, and an attacker in accordance with at least one embodiment of the present disclosure.

[0071] Reference Fig.10 , multiple UAM aircraft can periodically send and receive aircraft status information to each other by using a medium such as vehicle-to-everything communications (V2X) or automatic dependent surveillance-broadcast (ADS-B). When a first UAM aircraft that receives status information from another UAM aircraft determines that the status information is abnormal, the first UAM aircraft can send the status information to the GCS. The GCS can receive a report from the first UAM aircraft about the abnormal condition of another UAM aircraft. The first UAM aircraft that sent the abnormal status information can be controlled by the GCS. An attacker can disguise it as a legitimate UAM aircraft and send false information to multiple other UAM aircraft. This may cause confusion and increase traffic risks.

[0072] Fig.11 is a diagram illustrating a configuration of another UAM aircraft receiving status information from a plurality of UAM aircraft in accordance with at least one embodiment of the present disclosure.

[0073] Reference Fig.11 , multiple UAM aircraft 1110 may periodically send status information to another UAM aircraft 1130 via a medium such as DSRC, 5G, ADS-B. The status information may include header information, payload information, GPS information, and timestamp information. The status information may be sent to any other UAM aircraft 1130 without identifying the other UAM aircraft 1130. Another UAM aircraft 1130 may send the status information to its communication unit 1131. The authentication unit 1132 of the other UAM aircraft 1130 may verify the current status information by the difference between the received current status information and the previous status information received previously.

[0074] The authentication unit 1132 may receive previous state information that has been received from the storage unit 1133. After calculating the difference between the current state information and the previous state information, the travel direction, position, travel distance, and speed may be compared with the flight plan to determine whether the current state information is reasonable. When the current state information fails to be verified, the communication unit 1131 may send the verification-failed state information to the GCS 1140. The data processing unit 1134 may discard the verification-failed information received from the authentication unit 1132. When the current state information is successfully verified, the current state information may be stored in the storage unit 1133. The control unit 1135 may control data processing by the data processing unit 1134.

[0075] The attacker 1120 can disguise as multiple legitimate UAM aircraft 1110 and send false information to another UAM aircraft 1130. The attacker 1120 does not know the current GPS information and previous GPS information of the multiple legitimate UAM aircraft 1110 currently in flight, so it cannot send legitimate information. The GCS1140 can receive reports of abnormal conditions of multiple UAM aircraft 1110 from other UAM aircraft 1130. Since the attacker 1120 will perform the attack by reporting that multiple legitimate UAM aircraft 1110 are a group of abnormal UAM aircraft, the authenticity of the report can be verified by the present disclosure. The GCS1140 can determine the identification number of the UAM aircraft reported as abnormal, and communicate with the navigator or security personnel by using a separate channel for the UAM aircraft. Through this measure, the GCS1140 can identify false information from the attacker 1120, and can install a firewall or update the rule set to instruct multiple UAM aircraft 1110 to ignore the relevant false information. The rule set can consist of system IP units and system ports inside and outside the network to be protected by the firewall.

[0076] Fig.12 is a diagram illustrating operational steps of a GCS and UAM aircraft for receiving status information of a plurality of UAM aircraft in accordance with at least one embodiment of the present disclosure.

[0077] Reference Fig.12, multiple transmitting UAM aircraft can send their status information to other nearby receiving UAM aircraft (S1210). The receiving UAM aircraft can receive status information from multiple transmitting UAM aircraft (S1220). By using the status information, the position, time, speed, etc. of multiple transmitting UAM aircraft can be verified (S1221). If the position, time, speed, etc. of multiple transmitting UAM aircraft are not verified (S1221-No), the receiving UAM aircraft can report the abnormal situation to the GCS (S1222). When the position, time, speed, etc. of multiple transmitting UAM aircraft are verified (S1221-Yes), the consistency of the previous status information and the current status information can be verified (S1223). For example, when the transmission period is 0.1 seconds and the current speed is 100km / h, but the previous speed was 10km / h, this is unrealistic and may be an abnormal situation. If the consistency verification of the previous state information and the current state information fails (S1223-No), the receiving UAM aircraft can report the abnormal situation to the GCS (S1222). When the consistency of the previous state information and the current state information is verified (S1223-Yes), the current state information can be sent to the data processing unit (S1224).

[0078] The GCS may receive an abnormal condition report (S1230). The GCS may determine whether the received abnormal condition report is a false report (S1231). An attacker may report a legitimate UAM aircraft as an abnormal UAM aircraft so that other UAM aircraft block status information from legitimate UAM aircraft. To prevent this, it may be determined whether the abnormal condition report is a false report. Communication between multiple UAM aircraft may involve periodic data transmission and reception (e.g., V2X). Multiple UAM aircraft within the range of transmitting and receiving data may receive public data. Therefore, when an attacker sends abnormal condition information, all UAM aircraft in the area may receive the same abnormal condition information. All UAM aircraft that receive the abnormal condition may report to the GCS the UAM aircraft that sent the abnormal condition. If more than one UAM aircraft reports the same abnormal condition, the GCS may determine whether the abnormal condition report is false as follows.

[0079] First, it can be determined whether the two or more UAM aircraft that reported the abnormal condition are UAM aircraft in the same area. If the two or more UAM aircraft are not UAM aircraft in the same area, the abnormal condition report may be a false report. In addition, it can be determined whether the abnormal condition report is from the same time period. If the abnormal condition report is not from the same time period, the abnormal condition report may be false. If the two or more UAM aircraft that reported the abnormal condition are UAM aircraft in the same area, and the abnormal condition report is from the same time period, the abnormal condition report may not be false.

[0080] If there is only one UAM aircraft in the same communication area, a single UAM aircraft can report an abnormal condition instead of two or more UAM aircraft reporting a common abnormal condition. In this case, the GCS and the navigator or safety manager can be connected by using a communication medium different from the communication medium of the UAM aircraft. Then, the abnormality of the received information can be verified. The data from the UAM aircraft that reported the abnormal condition can be verified to determine whether the abnormal condition report is false. In this way, in the case where multiple UAM aircraft send and receive status information between them, the position of the UAM aircraft can be a criterion for determining whether the abnormal condition report is a false report. On the other hand, if the GCS is sending status information to and receiving status information from the UAM aircraft, the position of the GCS can be fixed. Therefore, the position of the GCS may not be a criterion for determining whether the information is false.

[0081] If the received abnormal condition is a false report (S1231-Yes), the false report can be recorded in a log (S1232). The current status information can be discarded (S1233). Data can be blocked from the entity that sent the false report (S1234). When the received abnormal condition is not a false report (S1231-No), the GCS can request the receiving UAM aircraft to update its rule set to block information from the attacker (S1235). In conjunction with the rule set update, multiple UAM aircraft can send and receive status information to each other via V2X. Here, V2X can use a certificate to electronically sign the information with its certificate at the sending end, and send the signed certificate to the receiving end.

[0082] The receiving end can verify the certificate. The validity of the certificate can be determined by using a certificate revocation list (CRL). The validity of the certificate can be determined based on whether it is a revoked certificate. A CRL can be a list of serial numbers of certificates that are no longer valid for some reason. After receiving the status information, the UAM aircraft can check whether the accompanying certificate has been revoked. If any UAM aircraft has an abnormal condition, the GCS can register the UAM aircraft in the CRL and send an updated CRL to multiple other UAM aircraft. Multiple other UAM aircraft that receive the CRL can regard the UAM aircraft using the revoked certificate as an attacker and discard the status information received from the attacker. The receiving UAM aircraft can receive the corresponding request (S1236).

[0083] Fig.13 is a diagram illustrating a method performed by one or more UAM aircraft for verifying state information of a UAM aircraft in accordance with at least one embodiment of the present disclosure.

[0084] Reference Fig.13 , one or more UAM aircraft may receive first status information of a first UAM aircraft (S1310). One or more UAM aircraft may verify the first status information (S1320). The first status information may include at least one of header information, payload information, GPS information, and timestamp information. The step of verifying the first status information may include: acquiring second status information of the first UAM aircraft present in a storage unit, and verifying the first status information based on the first status information and the second status information. The second status information may be information received before receiving the first status information.

[0085] If the first state information cannot be verified, one or more UAM aircraft may send abnormal status information of the first UAM aircraft to the GCS (S1330). If the GCS determines that the first state information is sent by the attacker, one or more UAM aircraft may receive rule set update information from the GCS (S1340). One or more UAM aircraft may update the rule set based on the rule set update information (S1350). According to the updated rule set, the attacker's information can be blocked.

[0086] Fig.14 is a diagram illustrating a method performed by a GCS for verifying status information of a UAM aircraft in accordance with at least one embodiment of the present disclosure.

[0087] Reference Fig.14, the GCS may receive first state information of the first UAM aircraft (S1410). The GCS may obtain second state information present in a storage unit (S1420). The GCS may obtain verification information based on the difference between the first state information and the second state information (S1430). The GCS may verify the first state information based on the verification information and the flight plan of the first UAM aircraft (S1440). If the first state information cannot be verified, the GCS may determine whether the first state information corresponds to information sent by the attacker (S1450). If the first state information corresponds to information sent by the attacker, the GCS may discard the first state information. If the first state information does not correspond to information sent by the attacker, the GCS may gain control of the first UAM aircraft. The first state information may include at least one of header information, payload information, GPS information, and timestamp information. The second state information may correspond to information received before receiving the first state information. Whether the first state information corresponds to information sent by the attacker can be determined based on state information periodically received from the first UAM aircraft.

[0088] Fig.15 is a diagram illustrating a method for verifying status information of a UAM aircraft performed by a GCS according to another embodiment of the present disclosure.

[0089] Reference Fig.15 , when one or more first UAM aircraft receive the first status information of the second UAM aircraft, and the first status information cannot be verified by the one or more first UAM aircraft, the GCS may receive abnormal status information of the second UAM aircraft from the one or more first UAM aircraft (S1510). The GCS may determine whether the one or more first UAM aircraft have mistakenly sent the abnormal status information (S1520). The step of determining whether the one or more first UAM aircraft have mistakenly sent the abnormal status information may include: determining whether the one or more first UAM aircraft exist in the same area, and determining whether the one or more first UAM aircraft have sent the abnormal status information during the same time period. The step of determining whether the one or more first UAM aircraft have mistakenly sent the abnormal status information may include: verifying the first status information of the second UAM aircraft.

[0090] If the one or more first UAM aircraft erroneously sends abnormal condition information, the GCS may discard the abnormal condition information. The GCS may block information sent by the one or more first UAM aircraft. In the case where the one or more first UAM aircraft do not erroneously send abnormal condition information, the GCS may send rule set update information to the one or more first UAM aircraft.

[0091] In the above embodiments, the method is described based on a flowchart having a series of steps or units, but the present disclosure is not limited to the order of the steps. On the contrary, some steps can be performed simultaneously with other steps or in a different order. In addition, it should be understood by those of ordinary skill in the art that the steps in the flowchart are not mutually exclusive, and other steps can be added to the flowchart, or some of the steps can be deleted from the flowchart without affecting the scope of the present disclosure.

[0092] The embodiments include various aspects of the examples. It may not be possible to describe all possible combinations of the various aspects, but those skilled in the art will be able to recognize different combinations. Therefore, the present disclosure may include all substitutions, modifications and changes within the scope of the claims.

[0093] The embodiments of the present disclosure may be implemented in the form of program instructions, which may be executed by various computer components and recorded in a computer-readable recording medium. The computer-readable recording medium may include independent or combined program instructions, data files, data structures, etc. The program instructions recorded in the computer-readable recording medium may be specially designed and constructed for the present disclosure, or may be well known to ordinary technicians in the field of computer software technology. Examples of computer-readable recording media include magnetic recording media, such as hard disks, floppy disks, and tapes; optical data storage media, such as CD-ROMs or DVD-ROMs; magnetically optimized media, such as floppy disks; and hardware devices, such as read-only memories (ROMs), random access memories (RAMs), flash memories, etc., which are specially constructed to store and implement program instructions. Examples of program instructions include not only machine language codes formatted by compilers, but also high-level language codes that can be implemented by computers using interpreters. Hardware devices may be configured to be operated by one or more software modules, and vice versa, to implement processes according to the present disclosure.

[0094] Although the present disclosure has been described with respect to specific items (e.g., detailed elements and limited embodiments and drawings), it is only used to help a more comprehensive understanding of the present disclosure, and the present disclosure is not limited to the above embodiments. It will be appreciated by those skilled in the art that various modifications and changes can be made based on the above description.

[0095] Therefore, the concept of the present disclosure should not be limited to the above-described embodiments, and the full scope of the appended claims and their equivalents should fall within the scope and concept of the present disclosure.

[0096] CROSS-REFERENCE TO RELATED APPLICATIONS

[0097] This application claims priority to Korean Patent Application No. 10-2022-0057003, filed on May 10, 2022, and Korean Patent Application No. 10-2023-0059954, filed on May 9, 2023, the disclosures of which are incorporated herein by reference in their entirety.

Claims

1. A method performed by an urban air traffic UAM aircraft, the method The following steps are involved: Receiving first status information of a first UAM aircraft; verifying the first status information; When the first status information fails to be verified, sending the abnormal status information of the first UAM aircraft to a ground control system GCS; When the GCS determines that the first state information is information sent by an attacker, receiving rule set update information from the GCS; and The rule set is updated based on the rule set update information.

2. The method according to claim 1, in, Based on the rule set being updated, information from the attacker is blocked.

3. The method according to claim 1, in, The first state information includes at least one of header information, payload information, global positioning system (GPS) information, and timestamp information.

4. The method according to claim 1, in, The step of verifying the first status information includes: acquiring second status information of the first UAM aircraft present in a storage unit; and The first state information is verified based on the first state information and the second state information.

5. The method according to claim 4, in, The second state information corresponds to information received before the first state information is received.

6. A method performed by a ground control system GCS, the method The following steps are involved: Receiving first status information of a first UAM aircraft; Acquire second state information existing in the storage unit; obtaining verification information based on a difference between the first state information and the second state information; verifying the first status information based on the verification information and a flight plan of the first UAM aircraft; as well as When the first state information fails to be verified, it is determined whether the first state information corresponds to information sent by an attacker.

7. The method according to claim 6, further comprising: The following steps are involved: When the first state information corresponds to information sent by the attacker, the first state information is discarded.

8. The method according to claim 6, further comprising: The following steps are involved: When the first state information does not correspond to information sent by the attacker, the first UAM aircraft is controlled.

9. The method according to claim 6, in, The first status information includes at least one of header information, payload information, global positioning system (GPS) information, and timestamp information, and Wherein, based on the status information periodically received from the first UAM aircraft, it is determined whether the first status information corresponds to the information sent by the attacker.

10. The method according to claim 6, in, The second state information corresponds to information received before the first state information is received.

11. A method performed by a ground control system GCS, the method The following steps are involved: When one or more first UAM aircraft receive first status information of a second UAM aircraft, and the first status information is not verified by the one or more first UAM aircraft, receiving abnormal condition information of the second UAM aircraft from the one or more first UAM aircraft; as well as A determination is made as to whether the one or more first UAM aircraft erroneously sent the abnormal condition information.

12. The method according to claim 11, further comprising: The following steps are involved: When the one or more first UAM aircraft erroneously transmit the abnormal condition information, discarding the abnormal condition information; as well as Blocking information transmitted by the one or more first UAM aircraft.

13. The method according to claim 11, further comprising: The following steps are involved: When the one or more first UAM aircraft transmit the abnormal condition information without error, rule set update information is transmitted to the one or more first UAM aircraft.

14. The method according to claim 11, in, The step of determining whether the one or more first UAM aircraft erroneously sent the abnormal condition information comprises: determining whether the one or more first UAM aircraft are present in the same area; and A determination is made as to whether the one or more first UAM aircraft transmitted the abnormal condition information during a same time period.

15. The method according to claim 11, in, The step of determining that the one or more first UAM aircraft erroneously sent the abnormal condition information comprises: The first status information of the second UAM aircraft is verified.

16. A ground control system GCS, include: Memory; and at least one processor, Wherein, the at least one processor is configured to: Receiving first status information of a first UAM aircraft; Acquire second state information existing in the storage unit; obtaining verification information based on a difference between the first state information and the second state information; verifying the first status information based on the verification information and a flight plan of the first UAM aircraft; and When the first state information fails to be verified, determining whether the first state information corresponds to information sent by an attacker, and The second state information corresponds to information received before the first state information is received.

17. The GCS according to claim 16, in, The at least one processor is configured to: When the first state information corresponds to information sent by the attacker, the first state information is discarded.

18. The GCS according to claim 16, in, The at least one processor is configured to: When the first state information does not correspond to information sent by the attacker, the first UAM aircraft is controlled.

Images