Unmanned system endogenous safety protection system and method

Abstract

The invention provides an endogenous security protection system and method for an unmanned system. The system comprises a physical identity authentication module, an anomaly detection module, an endogenous security knowledge base, a security constraint knowledge base, a network security function base and an endogenous identity base. The method comprises the following steps: constructing an endogenous safety knowledge base, a safety constraint knowledge base and the like; a physical identity authentication module based on source features is constructed by using an endogenous security knowledge base and an endogenous identity base, and an anomaly detection module based on endogenous behaviors is constructed by using the endogenous security knowledge base, a network security function base and a security constraint knowledge base. According to the invention, the physical identity authentication method of the source features of the unmanned device is utilized to ensure the safe networking of the unmanned device, the safety of the unmanned task is ensured through the abnormal detection method based on the endophytic behavior, and the task endophytic safety protection system of the unmanned system is formed based on the basic general library and the domain specialized library. And the security protection of data and program flows in the unmanned system is realized.

Description

Technical Field

[0001] The present invention belongs to the technical field of unmanned system safety, and relates to an unmanned system intrinsic safety protection system and method. Background Art

[0002] Since the new century, unmanned systems have been present in the modern industrial field, breaking the traditional industrial scene's understanding of industrial control such as manufacturing, transportation, and quality inspection. However, with the advancement of countermeasure technology, unmanned equipment faces security issues at multiple levels and angles, among which the operational safety of unmanned systems during missions has become one of the bottlenecks for further expanding the industrial application of unmanned equipment.

[0003] An analysis of existing unmanned system protection technologies revealed the following defects: (1) In the existing technology, the data security of unmanned systems mainly relies on communication encryption. With the development of quantum computing technology, the existing encryption algorithms are likely to be cracked at any time. At the same time, the industrial application scenarios of unmanned systems are relatively complex, and there are unknown security attack methods in cyberspace. Therefore, it is impossible to rely on existing communication encryption methods to achieve full-stage protection of unmanned system tasks; (2) In the existing technical solutions, the unmanned system security protection system is usually an external software security protection system, and its defense specifications are established on the basis of responding to known threats. That is, it not only needs to be able to accurately perceive the attack behavior, but also needs to predict all known conditions such as how to establish the attack chain and the attack mechanism. Therefore, this type of defense system cannot provide any substantial security defense against unknown network attacks.

[0004] In view of how unmanned systems can autonomously perform complex tasks in the future, the inherent security technology of unmanned systems is an important path for their development. Among them, inherent security refers to building sustainable security defense capabilities from the inside out by relying on the inherent characteristics of the network itself. In the unmanned system mission scenario, the inherent security capabilities of the unmanned system and the environment are used, and the original security capabilities are embedded in the design and construction of the unmanned system, so that the unmanned equipment can defend against unknown security attacks through the original security system during the execution of the mission, ensuring the normal operation of the mission.

[0005] Therefore, based on the above ideas, the present invention provides an unmanned system endogenous safety protection system and method. Summary of the invention

[0006] The purpose of the present invention is to address the problems existing in the prior art and provide an inherent security protection system and method for unmanned systems, which solves the problem that the existing protection technology requires prior knowledge to design and implement corresponding security protection methods for attacks on unmanned systems, so it is often unable to defend against unknown attack methods in complex scenarios.

[0007] To this end, the present invention adopts the following technical solutions: An unmanned system endogenous safety protection system, comprising: Physical identity authentication module and anomaly detection module; wherein: The identity authentication module refers to an unmanned equipment physical identity authentication module based on source characteristics; The anomaly detection module refers to an anomaly detection module based on endogenous behavior; and an endogenous security knowledge base, a security constraint knowledge base, a network security function base and an endogenous identity base for constructing a physical identity authentication module and an anomaly detection module; wherein: The security constraint knowledge base, network security function library and endogenous identity library are all subsets of the endogenous security knowledge base.

[0008] A method for protecting the inherent safety of an unmanned system, using the above-mentioned inherent safety protection system for an unmanned system, comprises the following steps: Step 1: Build an endogenous security knowledge base, a security constraint knowledge base, a network security function base, and an endogenous identity base.

[0009] The step 1 comprises the following steps: Step 1.1: The task system first sets up the task, and encrypts and transmits the task to the unmanned system through the communication system for deployment. In the unmanned system, the motor, robotic arm device and other equipment are called to realize the operation of the task, or the unmanned equipment task operation is simulated using the unmanned system simulation platform, and the unmanned equipment control and information interaction data are collected; Step 1.2: Perform data cleaning, feature selection and extraction on the interactive data obtained in step 1.1, including unmanned equipment firmware information, onboard computer information, communication system communication frequency and communication encryption method, unmanned equipment group key information, mission number and mission content, control parameters and equipment operation process data records. Use the complete search strategy and misclassification rate as the evaluation function, and select the feature set with the highest function evaluation score to form the endogenous security knowledge base; Step 1.3: Take a subset of the endogenous security knowledge base to construct an endogenous identity database. The data in the endogenous identity database is used to implement the unmanned device identity construction, identity recognition and access control functions to ensure the security of unmanned device networking; The data in the endogenous identity database includes: the integrity check value obtained by verifying the integrity of the unmanned equipment firmware and the onboard computer through domestic security chips, the unmanned equipment group key and the endogenous identity credentials.

[0010] Step 1.4: Take a subset of the endogenous security knowledge base to build a network security function library to discover abnormal working conditions of devices; The data of the network security function library includes: motion trajectory and unmanned equipment task timestamp; Step 1.5: Take a subset of the endogenous security knowledge base to build a security constraint knowledge base. The security constraint knowledge base determines whether there is an attack during the operation of the unmanned equipment by understanding how various control programs of the unmanned equipment call and access corresponding resource information, as well as the movement trajectory of the unmanned equipment, and classifies the attack behaviors, including memory attacks and program flow attacks. When there is an attack, quickly locate the type of attack and block the attack to ensure the safety of the unmanned system mission operation; The data of the security constraint knowledge base includes: program flow, data access control and task encryption transmission information.

[0011] Step 2: Use the endogenous security knowledge base and endogenous identity database to build a physical identity authentication module based on native features to ensure the security protection of unmanned equipment networking.

[0012] The step 2 comprises the following steps: Step 2.1: According to the endogenous security knowledge base and the endogenous identity database structure information, obtain the integrity check value and the group key of the unmanned device, and construct a unique endogenous identity credential of the unmanned device; Step 2.2: In the scenario of unmanned equipment running tasks, the unmanned equipment needs to be authenticated when it accesses the system. The unmanned equipment's intrinsic identity credentials constructed in step 2.1 are uploaded to the cloud and compared with the unmanned equipment's intrinsic identity credentials in the database to determine whether the unmanned equipment is a trusted unmanned equipment. Step 2.3: If the endogenous identity database is matched to a trusted unmanned device, the unmanned device is connected to the network, and permissions are opened between multiple unmanned devices in the network to achieve collaborative tasks by exchanging data with each other.

[0013] Step 3: Utilize the intrinsic security knowledge base, network security function library, and security constraint knowledge base to build an anomaly detection module based on intrinsic behavior to ensure the real-time security of unmanned system operation tasks.

[0014] The step 3 comprises the following steps: Step 3.1: To build an anomaly detection module based on endogenous behavior, we first need to collect sensor data of unmanned equipment under normal and abnormal operating conditions, and use the collected data to select, adjust and train the deep neural network model for unmanned system anomaly detection; Step 3.2: Deploy the trained deep neural network model on the unmanned device as part of the network security function library. Then, during the execution of the unmanned system task, monitor the operating status of the unmanned device in real time. That is, the unmanned device continuously monitors the sensor data and uses the processed sensor data through the network security function library to determine whether there is abnormal behavior. Step 3.3: When the network security function library determines that the unmanned device status is abnormal, it determines that the unmanned system is under attack; The abnormalities in the unmanned equipment status include behavioral deviations and program flow errors.

[0015] Step 3.4: When it is determined that the unmanned system is under attack, the attack type and attack impact range are first determined through the network security function library, and then the attack is blocked through the security constraint knowledge base. Finally, the data information at the end of the previous task is restored and the current task is re-run; The security constraint knowledge base blocks attacks by immediately locking memory area data and improving memory access permissions.

[0016] The beneficial effects of the present invention are: The system of the present invention can solve the problem of unknown network attacks faced by unmanned systems during missions. It can effectively respond to unknown network attacks with the help of an endogenous security knowledge base during the entire stage of the unmanned system's mission execution, eliminating potential safety hazards of unmanned equipment during the mission.

[0017] The method of the present invention constructs an endogenous security knowledge base, a security constraint knowledge base, a network security function base and an endogenous identity base by analyzing multiple dimensions such as equipment, functions and tasks. The physical identity authentication method based on the intrinsic characteristics of unmanned equipment is used to ensure the secure networking of unmanned equipment. The safety of unmanned tasks is guaranteed by an anomaly detection method based on endogenous behavior, thereby jointly realizing the security protection of data and program flows in unmanned systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 This is a system architecture diagram of the present invention; FIG2 is a flow chart of building an endogenous security knowledge base in the method of the present invention; FIG3 is an application flow chart of the physical identity authentication module in the method of the present invention; FIG4 is a flowchart of the application of the anomaly detection module in the method of the present invention. DETAILED DESCRIPTION

[0019] The technical solution of the present invention is described below in conjunction with the accompanying drawings and implementation methods.

[0020] like Figure 1 As shown, an unmanned system endogenous safety protection system includes: Physical identity authentication module and anomaly detection module; wherein: The identity authentication module refers to an unmanned equipment physical identity authentication module based on source characteristics; The anomaly detection module refers to an anomaly detection module based on endogenous behavior; and an endogenous security knowledge base, a security constraint knowledge base, a network security function base and an endogenous identity base for constructing a physical identity authentication module and an anomaly detection module; wherein: The security constraint knowledge base, network security function library and endogenous identity library are all subsets of the endogenous security knowledge base.

[0021] A method for protecting the inherent safety of an unmanned system, using the above-mentioned inherent safety protection system for an unmanned system, comprises the following steps: Step 1: Build an endogenous security knowledge base, a security constraint knowledge base, a network security function base, and an endogenous identity base.

[0022] The step 1 comprises the following steps: Step 1.1: The task system first sets up the task, and encrypts and transmits the task to the unmanned system through the communication system for deployment. In the unmanned system, the motor, robotic arm device and other equipment are called to realize the operation of the task, or the unmanned equipment task operation is simulated using the unmanned system simulation platform, and the unmanned equipment control and information interaction data are collected; Step 1.2: Figure 2 As shown, the interactive data obtained in step 1.1, including unmanned equipment firmware information, onboard computer information, communication system communication frequency and communication encryption method, unmanned equipment group key information, task number and task content, control parameters and equipment operation process data records, are cleaned, features are selected and extracted, and the complete search strategy and misclassification rate are used as evaluation functions to select the feature set with the highest function evaluation score to form an endogenous security knowledge base; Step 1.3: Take a subset of the endogenous security knowledge base to construct an endogenous identity database. The data in the endogenous identity database is used to implement the unmanned device identity construction, identity recognition and access control functions to ensure the security of unmanned device networking; The data of the endogenous identity database includes: integrity check values ​​obtained by verifying the integrity of unmanned equipment firmware and onboard computers through domestic security chips, unmanned equipment group keys, and endogenous identity credentials; Step 1.4: Take a subset of the endogenous security knowledge base to build a network security function library to discover abnormal working conditions of devices; The data of the network security function library includes: motion trajectory and unmanned equipment task timestamp, etc.; Step 1.5: Take a subset of the endogenous security knowledge base to construct a security constraint knowledge base. The security constraint knowledge base determines whether there is an attack during the operation of the unmanned equipment by understanding how various control programs of the unmanned equipment call and access corresponding resource information, as well as the movement trajectory of the unmanned equipment, and classifies the attack behaviors, including memory attacks and program flow attacks; when there is an attack, quickly locate the attack type and block the attack to ensure the safety of the unmanned system mission operation; The data of the security constraint knowledge base includes: program flow, data access control and task encryption transmission information, etc.

[0023] Step 2: Use the endogenous security knowledge base and endogenous identity database to build a physical identity authentication module based on native features to ensure the security protection of unmanned equipment networking.

[0024] like Figure 3 As shown, step 2 includes the following steps: Step 2.1: According to the endogenous security knowledge base and the endogenous identity database structure information, obtain the integrity check value and the group key of the unmanned device, and construct a unique endogenous identity credential of the unmanned device; Step 2.2: In the scenario of unmanned equipment running tasks, the unmanned equipment needs to be authenticated when it accesses the system. The unmanned equipment's intrinsic identity credentials constructed in step 2.1 are uploaded to the cloud and compared with the unmanned equipment's intrinsic identity credentials in the database to determine whether the unmanned equipment is a trusted unmanned equipment. Step 2.3: If the endogenous identity database is matched to a trusted unmanned device, the unmanned device is connected to the network, and permissions are opened between multiple unmanned devices in the network to achieve collaborative tasks by exchanging data with each other.

[0025] Step 3: Utilize the intrinsic security knowledge base, network security function library, and security constraint knowledge base to build an anomaly detection module based on intrinsic behavior to ensure the real-time security of unmanned system operation tasks.

[0026] like Figure 4 As shown, step 3 includes the following steps: Step 3.1: To build an anomaly detection module based on endogenous behavior, we first need to collect sensor data of unmanned equipment under normal and abnormal operating conditions, and use the collected data to select, adjust and train the deep neural network model for unmanned system anomaly detection; Step 3.2: Deploy the trained deep neural network model on the unmanned device as part of the network security function library. Then, during the execution of the unmanned system task, monitor the operating status of the unmanned device in real time. That is, the unmanned device continuously monitors the sensor data and uses the processed sensor data through the network security function library to determine whether there is abnormal behavior. Step 3.3: When the network security function library determines that the unmanned device status is abnormal, it determines that the unmanned system is under attack; The abnormalities in the unmanned equipment status include behavioral deviations and program flow errors.

[0027] Step 3.4: When it is determined that the unmanned system is under attack, the attack type and attack impact range are first determined through the network security function library, and then the attack is blocked through the security constraint knowledge base. Finally, the data information at the end of the previous task is restored and the current task is re-run; The security constraint knowledge base blocks attacks by immediately locking memory area data, improving memory access permissions, etc.

Claims

1. An unmanned system endogenous safety protection system, characterized in that: include: A physical identity authentication module and an anomaly detection module; wherein the identity authentication module refers to an unmanned equipment physical identity authentication module based on native features, and the anomaly detection module refers to an anomaly detection module based on endogenous behavior; As well as an endogenous security knowledge base, a security constraint knowledge base, a network security function library and an endogenous identity library for constructing a physical identity authentication module and an anomaly detection module; among which, the security constraint knowledge base, the network security function library and the endogenous identity library are all subsets of the endogenous security knowledge base.

2. A method for protecting the inherent safety of an unmanned system, characterized in that: The application of the unmanned system endogenous safety protection system as claimed in claim 1 comprises the following steps: Step 1: Build an endogenous security knowledge base, a security constraint knowledge base, a network security function base, and an endogenous identity base; Step 2: Use the endogenous security knowledge base and endogenous identity database to build a physical identity authentication module based on source features to ensure the security protection of unmanned equipment networking; Step 3: Utilize the intrinsic security knowledge base, network security function library, and security constraint knowledge base to build an anomaly detection module based on intrinsic behavior to ensure the real-time security of unmanned system operation tasks.

3. The method for protecting the inherent safety of an unmanned system according to claim 2, characterized in that: The step 1 comprises the following steps: Step 1.1: Use the unmanned system simulation platform to simulate the operation of unmanned equipment tasks, or run unmanned equipment tasks in a real working environment to collect unmanned equipment control and information interaction data; Step 1.2: Perform data cleaning, feature selection and extraction on the interactive data obtained in step 1.1, including unmanned equipment firmware information, onboard computer information, communication system communication frequency and communication encryption method, unmanned equipment group key information, mission number and mission content, control parameters and equipment operation process data records. Use the complete search strategy and misclassification rate as the evaluation function, and select the feature set with the highest function evaluation score to form the endogenous security knowledge base; Step 1.3: Take a subset of the endogenous security knowledge base to construct an endogenous identity database. The data in the endogenous identity database is used to implement the unmanned device identity construction, identity recognition and access control functions to ensure the security of unmanned device networking; The data of the endogenous identity database includes: the integrity check value obtained by verifying the integrity of the unmanned equipment firmware and the onboard computer through the domestic security chip, the unmanned equipment group key and the endogenous identity certificate; Step 1.4: Take a subset of the endogenous security knowledge base to build a network security function library to discover abnormal working conditions of devices; The data of the network security function library includes motion trajectories and unmanned equipment task timestamps; Step 1.5: Take a subset of the endogenous security knowledge base to construct a security constraint knowledge base. The security constraint knowledge base determines whether there is an attack during the operation of the unmanned equipment by understanding how various control programs of the unmanned equipment call and access corresponding resource information, as well as the movement trajectory of the unmanned equipment, and classifies the attack behaviors, including memory attacks and program flow attacks; when there is an attack, quickly locate the attack type and block the attack to ensure the safety of the unmanned system mission operation; The data of the security constraint knowledge base includes: program flow, data access control and task encryption transmission information.

4. The method for protecting the inherent safety of an unmanned system according to claim 2, characterized in that: The step 2 comprises the following steps: Step 2.1: According to the structure of the endogenous identity library, obtain the integrity check value and the group key of the unmanned device, and construct a unique endogenous identity credential of the unmanned device; Step 2.2: In the scenario where the unmanned device is running a task, the unmanned device needs to be authenticated when it accesses the system. The unmanned device's intrinsic identity credential constructed in step 2.1 is uploaded to the cloud and compared with the unmanned device's intrinsic identity credential in the database to determine whether the unmanned device is a trusted unmanned device. Step 2.3: If the endogenous identity database is matched to a trusted unmanned device, the unmanned device is connected to the network, and permissions are opened between multiple unmanned devices in the network to achieve collaborative tasks by exchanging data with each other.

5. The method for protecting the inherent safety of an unmanned system according to claim 2, characterized in that: The step 3 comprises the following steps: Step 3.1: To build an anomaly detection module based on endogenous behavior, we first need to collect sensor data of unmanned equipment under normal and abnormal operating conditions, and use the collected data to select, adjust and train the deep neural network model for unmanned system anomaly detection; Step 3.2: Deploy the trained deep neural network model on the unmanned device as part of the network security function library. Then, during the execution of the unmanned system task, monitor the operating status of the unmanned device in real time. That is, the unmanned device continuously monitors the sensor data and uses the processed sensor data through the network security function library to determine whether there is abnormal behavior. Step 3.3: When the network security function library determines that the unmanned device status is abnormal, it determines that the unmanned system is under attack; The abnormality of the unmanned equipment state includes behavioral deviation and program flow error; Step 3.4: When it is determined that the unmanned system is under attack, the attack type and attack impact range are first determined through the network security function library, and then the attack is blocked through the security constraint knowledge base. Finally, the data information at the end of the previous task is restored and the current task is re-run; The security constraint knowledge base blocks attacks by immediately locking memory area data and improving memory access permissions.

Images