A method and device for identity authentication and access control of low-altitude aircraft

Abstract

The present application provides an identity authentication and access control method and device for low-altitude aircraft, wherein the method includes: obtaining environmental data, equipment status data, and historical authentication logs of low-altitude aircraft to obtain collected data; inputting the collected data into an AI decision engine, generating an authentication factor combination through a pre-trained deep reinforcement learning model, and obtaining a main factor and a backup factor; using the main factor to authenticate the aircraft, and when the matching degree of the main factor identity authentication is within a preset range, triggering the backup factor to perform a secondary identity authentication to obtain an authentication result; generating an access token based on the authentication result and a risk assessment model, and the aircraft performs access control based on the access token. The present application relates to the field of low-altitude safety management and control, and solves the technical problems in the prior art of low-altitude aircraft identity authentication that are insufficiently secure and cannot dynamically adapt to complex airspace environments.

Description

Technical Field

[0001] The present invention belongs to the technical field of low-altitude safety management and control, and specifically is an identity authentication and access control method for low-altitude aircraft. Background Art

[0002] With the widespread use of low-altitude aircraft, identity authentication and access control have become critical aspects of airspace safety management. Current mainstream authentication systems are mostly based on static multi-factor authentication mechanisms, such as fixed-combination key authentication, digital certificates, or geo-fencing technology. However, existing authentication strategies lack dynamic adaptability and are unable to intelligently adjust authentication strength based on real-time environmental parameters and device status. This leads to insufficient security protection in high-risk scenarios, making it easy for unauthorized access to be missed and creating a single point of compromise. Furthermore, traditional systems often trade security for extended authentication times, making it difficult to balance the efficiency requirements of high-density, low-altitude traffic scenarios. Summary of the Invention

[0003] The present application provides an identity authentication and access control method and device for low-altitude aircraft, which solves the technical problems in the prior art of insufficient security of low-altitude aircraft identity authentication and inability to dynamically adapt to complex airspace environments.

[0004] To achieve the above objectives, this application adopts the following technical solutions:

[0005] In a first aspect, a method for identity authentication and access control for low-altitude aircraft is provided, comprising:

[0006] Obtain environmental data, equipment status data, and historical authentication logs of low-altitude aircraft to obtain collected data;

[0007] The collected data is input into the AI decision engine, and a combination of authentication factors is generated through a pre-trained deep reinforcement learning model to obtain a main factor and a backup factor; wherein the authentication method of the backup factor has higher authentication accuracy than the authentication method of the main factor;

[0008] The primary factor is used to authenticate the aircraft's identity. When the matching degree of the primary factor authentication falls within a preset range, the backup factor is triggered to perform secondary authentication and obtain the authentication result.

[0009] An access token is generated based on the authentication results and the risk assessment model, and the aircraft performs access control based on the access token; wherein, the access token is used to describe the relationship between the authority level and the authentication factors and environmental data, and the risk assessment model is built into the AI decision engine.

[0010] Based on the above technical solutions, the identity authentication and access control method for low-altitude aircraft provided in this application utilizes a dynamic multi-factor authentication mechanism, combined with an AI-driven intelligent decision-making engine, to flexibly generate factor authentication combinations, proactively identify counterfeit or abnormal devices, and effectively intercept illegal access attempts. The environmental risk model can assess complex airspace conditions in real time, dynamically adjusting permission levels and access scopes, ensuring automatic and strict control in high-risk scenarios such as signal interference and positioning deviation, significantly improving airspace safety.

[0011] In conjunction with the first aspect above, in one possible implementation, the collected data includes:

[0012] Environmental data including signal strength, spectrum interference value, horizontal component precision factor, temperature, humidity, and air pressure;

[0013] Device status data including the aircraft's remaining battery capacity, CPU or GPU load, remaining storage space, and flight altitude, speed, and heading;

[0014] An authentication log that includes the authentication results, authentication time, authentication factor combination, and corresponding environmental data and device status data of multiple recent identity authentications.

[0015] In conjunction with the first aspect above, in one possible implementation, the AI decision engine includes:

[0016] The decision generation unit is used to process the collected data using the built-in deep reinforcement learning model and output the authentication factor combination;

[0017] The risk assessment unit is used to calculate the environmental risk coefficient based on the environmental data using the built-in risk assessment model.

[0018] In conjunction with the first aspect above, in one possible implementation, calculating the environmental risk coefficient using a risk assessment model based on environmental data includes:

[0019] Normalize the values of each indicator in the environmental data to obtain the normalized values of each indicator, including:

[0020] Normalize the signal strength RSSI to obtain the signal normalization value RSSI norm , the calculation formula is: Among them, RSSI min Indicates the preset signal strength lower limit, RSSI max Indicates the preset signal strength upper limit;

[0021] Normalize the horizontal component precision dilution HDOP to obtain the normalized positioning accuracy value HDOP norm , the calculation formula is: ;

[0022] The spectrum normalization value Interf is calculated according to the formula norm : Among them, Interf k Indicates the spectrum interference value of the kth frequency band, N bands Indicates the number of monitoring frequency bands, Interf max Indicates the maximum spectrum interference value;

[0023] The temperature normalization value is calculated according to the formula T: ; Among them, T opt Indicates the ideal temperature value, T max Indicates the maximum temperature deviation;

[0024] The normalized value of air pressure is calculated according to the formula P: Among them, P std Indicates the standard atmospheric pressure value. P max Indicates the maximum deviation of air pressure;

[0025] The humidity normalized value is calculated according to the formula H: Among them, H thr Indicates the preset humidity threshold, H max Represents the maximum deviation value of humidity, ReLU() represents the ReLU function;

[0026] The normalized values of the above indicators are weighted and summed to obtain the calculated environmental risk coefficient R env The risk assessment model is: R env =w s ×(1-RSSI norm )+w i ×Interf norm +w h ×HDOP norm +w t × T+w p × P+w hum × H; where w s 、w i 、w h 、w t 、w p 、w hum Represent the coefficients of each item respectively, and the sum is 1.

[0027] In combination with the first aspect above, in one possible implementation, the training process of the pre-trained deep reinforcement learning model includes:

[0028] Set the state space, action space, and reward function of the deep reinforcement learning model; where

[0029] The state space is constructed by: collecting historical authentication logs, wherein each authentication log includes a timestamp, authentication result, authentication time, authentication factor combination, environmental data, and device status data;

[0030] Each data item in the historical authentication log is normalized and then concatenated to obtain the state space. The authentication results are normalized using a binary method: 0 indicates authentication failure and 1 indicates authentication success. The authentication factor combination is normalized using a one-hot encoding method.

[0031] The definition rule of the action space is: a predefined authentication factor library is defined as an action space, and each action in the action space corresponds to a factor combination strategy, and a factor combination strategy includes at least one main factor and at least one backup factor;

[0032] The calculation formula of the reward function R is: ; Among them, AS∈{0,1} represents the authentication result, TS' represents the normalized authentication time, R env represents the environmental risk coefficient calculated by the risk assessment model, α1, α2, and α3 represent the weight coefficients of each item, and β represents the fixed penalty value for authentication failure;

[0033] Use a deep Q-network or proximal policy optimization algorithm to build a deep reinforcement learning model, where the input layer dimension of the deep reinforcement learning model is the dimension of the state space, and the output layer dimension is the size of the action space;

[0034] The deep reinforcement learning model is iteratively trained and optimized using historical authentication logs, and a pre-trained deep reinforcement learning model is obtained, whose input data is the collected data and output is the optimal authentication factor combination including the main factor and the backup factor.

[0035] In conjunction with the first aspect above, in one possible implementation, the primary factor includes, but is not limited to, the following authentication methods: multi-band radio frequency fingerprint authentication, key authentication, digital certificate authentication, and geo-fence authentication; wherein geo-fence authentication refers to identity authentication by comparing the real-time location of the low-altitude aircraft with a preset geo-fence database;

[0036] The backup factors include but are not limited to the following authentication methods: biometric authentication, blockchain identity traceability authentication;

[0037] The biometric authentication includes but is not limited to fingerprint authentication, facial authentication, and voiceprint authentication of staff members;

[0038] The blockchain identity traceability authentication means verifying the historical flight records and working status of the low-altitude aircraft through smart contracts. If the low-altitude aircraft has no historical flight records or its working status is revoked or unknown, the verification fails.

[0039] The authentication factor library includes but is not limited to all authentication methods included in the primary factor and the backup factor.

[0040] In conjunction with the first aspect above, in one possible implementation, the matching degree of the primary factor identity authentication includes:

[0041] When the main factor is multi-band radio frequency fingerprint authentication, the cosine similarity between the feature vector of each frequency band and the registration template is calculated, and the radio frequency matching degree S is obtained by weighted summation. RF , the calculation formula is: ; Among them, n represents the number of frequency bands, Interf i represents the spectrum interference value of the i-th frequency band, S RF,i Represents the cosine similarity between the feature vector of the i-th frequency band and the registered template;

[0042] When the main factor is key authentication, when the challenge value obtained by decryption is consistent with the original challenge value sent by the authentication system, or when the message authentication code obtained by decryption is consistent with the message hash value calculated locally by the authentication system, the deviation T between the timestamp obtained by decryption and the current time of the authentication system is calculated. resp Calculate the key matching degree S Key , the formula is: ; Among them, T th Indicates the preset time threshold;

[0043] When the main factor is digital certificate authentication, the certificate matching degree S Cert The calculation formula is Valid chain ∈{0,1}, indicating the certificate chain verification result, and Valid chain =1 means the certificate chain is valid. chain =0 means the certificate chain is invalid, Valid signature ∈{0,1} represents the signature verification result, and Valid signature =1 means the signature is valid, signature =0 means the signature is invalid, γ1 and γ2 represent weight coefficients, and their sum is 1;

[0044] When the main factor is geofence authentication, calculate the minimum distance D between the real-time position of the low-altitude aircraft and the geofencemin , according to the preset distance threshold d th Calculate the geographic matching degree S Geo , the formula is: .

[0045] In combination with the above first aspect, in a possible implementation, when the main factor includes multiple authentication methods, the matching degree of the main factor identity authentication is an average value of the matching degrees of the multiple authentication methods.

[0046] In conjunction with the first aspect above, in one possible implementation, generating an access token based on the authentication result and the risk assessment model includes:

[0047] When the main factor authentication is successful, or the backup factor authentication is successful, the environmental risk coefficient R calculated according to the risk assessment model is env and the number of authentication factors N factor Calculate the permission value P, the formula is: ; Wherein, λ1 and λ2 represent weight coefficients of each item, and the sum is 1, η represents the amplification factor, the value is 10, and the number of authentication factors represents the total number of triggered main factors and / or backup factors;

[0048] When the permission value is within the preset first interval, the operation permission and token validity period corresponding to the first permission are allocated;

[0049] When the permission value is within the preset second interval, the operation permission and token validity period corresponding to the second permission are allocated;

[0050] When the permission value is within the preset third interval, the operation permission and token validity period corresponding to the third permission are allocated;

[0051] An access token is generated based on a signature algorithm, and the access token includes operation permissions and token validity period.

[0052] Based on the above technical solution, this application has achieved a leap from fixed strategy authentication to intelligent adaptive authentication, which significantly improves the authentication efficiency and flexibility of low-altitude aircraft in complex environments while ensuring safety. It is especially suitable for future high-density, multi-type, and dynamically changing low-altitude traffic scenarios.

[0053] In a second aspect, an identity authentication and access control device for low-altitude aircraft is provided, comprising: a communication unit and a processing unit; the communication unit is used to obtain collected data including environmental data, device status data, and historical authentication logs of the low-altitude aircraft, and is also used to transmit identity authentication results and access tokens;

[0054] The processing unit is configured to input the collected data into an AI decision engine, generate an authentication factor combination through a pre-trained deep reinforcement learning model, and obtain a primary factor and a backup factor; use the primary factor to authenticate the aircraft; and when the matching degree of the primary factor authentication is within a preset range, trigger the backup factor to perform a secondary authentication to obtain an authentication result; generate an access token based on the authentication result and a risk assessment model, and the aircraft performs access control based on the access token.

[0055] In a third aspect, the present application provides an identity authentication and access control device for low-altitude aircraft, comprising: a processor and a storage medium; the storage medium comprising instructions, the processor configured to execute the instructions to implement the method described in the first aspect and any possible implementation of the first aspect. The identity authentication and access control device for low-altitude aircraft can be an electronic device or a chip within an electronic device.

[0056] Fourthly, the present application provides an identity authentication and access control system for low-altitude aircraft, including:

[0057] The data acquisition module is used to obtain environmental data, equipment status data and historical authentication logs of low-altitude aircraft to obtain collected data;

[0058] The AI decision engine module processes collected data, generates authentication factor combinations through a pre-trained deep reinforcement learning model, and calculates environmental risk coefficients using a risk assessment model based on environmental data.

[0059] The identity authentication module is used to use the main factor to authenticate the identity of the aircraft. When the matching degree of the main factor identity authentication is within the preset range, the backup factor is triggered to perform secondary authentication and obtain the authentication result. An access token is generated based on the authentication result and the environmental risk factor. The aircraft performs access control based on the access token.

[0060] In the fifth aspect, the present application provides a computer-readable storage medium, which stores instructions. When the instructions are run on an identity authentication and access control device for low-altitude aircraft, the identity authentication and access control device for low-altitude aircraft executes the method described in the first aspect and any possible implementation of the first aspect.

[0061] In the sixth aspect, the present application provides a computer program product comprising instructions. When the computer program product is run on an identity authentication and access control device for low-altitude aircraft, the identity authentication and access control device for low-altitude aircraft executes the method described in the first aspect and any possible implementation of the first aspect.

[0062] This application provides an identity authentication and access control method and device for low-altitude aircraft. It can flexibly generate factor authentication combinations through a dynamic multi-factor authentication mechanism combined with an AI-driven intelligent decision-making engine, actively identify counterfeit or abnormal devices, and effectively intercept illegal access behaviors; evaluate complex airspace conditions in real time, dynamically adjust authority levels and access scopes, and ensure automatic and strict control in high-risk scenarios, significantly improving airspace safety, authentication efficiency and flexibility, and is suitable for high-density, multi-type, and dynamically changing low-altitude traffic scenarios.

[0063] It should be understood that the description of technical features, technical solutions, beneficial effects or similar language in this application does not imply that all features and advantages can be realized in any single embodiment. On the contrary, it is understood that the description of a feature or beneficial effect means that a specific technical feature, technical solution or beneficial effect is included in at least one embodiment. Therefore, the description of a technical feature, technical solution or beneficial effect in this specification does not necessarily refer to the same embodiment. Furthermore, the technical features, technical solutions and beneficial effects described in the present embodiment can also be combined in any appropriate manner. Those skilled in the art will understand that the embodiment can be implemented without one or more specific technical features, technical solutions or beneficial effects of a specific embodiment. In other embodiments, additional technical features and beneficial effects can also be identified in specific embodiments that do not embody all embodiments.

[0064] Compared with the prior art, the present invention has the following beneficial effects:

[0065] This invention significantly improves the security and flexibility of low-altitude aircraft authentication by combining a dynamic multi-factor authentication mechanism with an AI-driven intelligent decision-making engine. Specifically, the system collects environmental data, device status data, and historical authentication logs, and uses a pre-trained deep reinforcement learning model to dynamically generate a combination of primary and backup factors. This can proactively identify counterfeit or abnormal devices and effectively intercept illegal access. For example, primary factors include multi-band radio frequency fingerprint authentication, key authentication, and other methods, while backup factors include biometric authentication, blockchain identity traceability authentication, and other methods. Through multi-factor collaborative verification, a multi-level security protection system is constructed.

[0066] In terms of risk control and permission management, the built-in environmental risk assessment model analyzes multi-dimensional data such as signal strength, spectrum interference, and positioning accuracy in real time. Through normalization and weighted calculation, it generates an environmental risk coefficient, which dynamically adjusts permission levels and access scopes. When the primary factor authentication matches within a preset range, the system automatically triggers a secondary authentication with a backup factor. Simultaneously, based on the authentication result and the risk coefficient, an access token is generated, containing the permission level and validity period. This ensures automatic and strict control in high-risk scenarios such as signal interference and positioning deviation, achieving dynamic adaptation of security policies to environmental changes. BRIEF DESCRIPTION OF THE DRAWINGS

[0067] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0068] Figure 1 A system architecture diagram of an identity authentication and access control system for low-altitude aircraft provided in an embodiment of the present application;

[0069] Figure 2 A flowchart of an identity authentication and access control method for low-altitude aircraft provided in an embodiment of the present application;

[0070] Figure 3 A flowchart of another method for identity authentication and access control for low-altitude aircraft provided in an embodiment of the present application;

[0071] Figure 4 A schematic structural diagram of an identity authentication and access control device for low-altitude aircraft provided in an embodiment of the present application. DETAILED DESCRIPTION

[0072] The technical solutions of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the embodiments described are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0073] In the description of this application, unless otherwise specified, " / " means "or", for example, A / B can mean A or B. "And / or" in this article is merely a description of the association relationship of associated objects, indicating that three relationships can exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, "at least one" means one or more, and "a plurality" means two or more. Words such as "first" and "second" do not limit the quantity and execution order, and words such as "first" and "second" do not limit them to be necessarily different.

[0074] It should be noted that, in this application, words such as "exemplary" or "for example" are used to indicate examples, illustrations, or descriptions. Any embodiment or design described in this application as "exemplary" or "for example" should not be construed as being preferred or advantageous over other embodiments or designs. Rather, the use of words such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner.

[0075] The embodiment of the present application provides an identity authentication and access control method for low-altitude aircraft, which can be applied to Figure 1 As shown in the example of an identity authentication and access control system for low-altitude aircraft, Figure 1 As shown, the communication system includes: a data acquisition module, an AI decision engine module and an identity authentication module.

[0076] Among them, the data acquisition module is used to obtain environmental data, equipment status data and historical authentication logs of low-altitude aircraft to obtain collected data.

[0077] The AI decision engine module is used to process the collected data, generate authentication factor combinations through a pre-trained deep reinforcement learning model, and calculate the environmental risk coefficient using a risk assessment model based on environmental data.

[0078] The identity authentication module is used to use the main factor to authenticate the identity of the aircraft. When the matching degree of the main factor identity authentication is within the preset range, the backup factor is triggered to perform secondary authentication and obtain the authentication result. An access token is generated based on the authentication result and the environmental risk factor. The aircraft performs access control based on the access token.

[0079] In order to solve the technical problems in the existing technology that the identity authentication of low-altitude aircraft is insufficiently secure and cannot dynamically adapt to complex airspace environments, an embodiment of the present application provides an identity authentication and access control method for low-altitude aircraft. The method includes: obtaining multi-dimensional collection data, intelligently generating authentication factor combinations, hierarchically performing identity authentication, and dynamically generating access tokens, based on which intelligent safety management and control of low-altitude aircraft is achieved.

[0080] like Figure 2 As shown, an embodiment of the present application provides an identity authentication and access control method for low-altitude aircraft, including:

[0081] S1. Obtain environmental data, equipment status data, and historical authentication logs of low-altitude aircraft to obtain collected data.

[0082] Among them, the collected data is a basic information set for certification decisions, which is used to reflect the aircraft operating environment, equipment status and historical certification behavior characteristics.

[0083] In some implementations, environmental data may include airspace environmental parameters such as signal strength, spectrum interference value, and horizontal component precision factor. Equipment status data may include equipment operating indicators such as battery capacity, flight altitude, and speed. Historical authentication logs may record historical information such as authentication results, time consumption, and factor combinations.

[0084] It should be pointed out that the types of collected data can be expanded according to actual application scenarios, such as adding weather data or airspace control information.

[0085] For example, the signal strength (RSSI) in the environmental data can be collected in real time by sensors, and the flight altitude in the device status data can be obtained by the built-in GPS module of the aircraft.

[0086] S2. Input the collected data into the AI decision engine, and generate a combination of authentication factors through a pre-trained deep reinforcement learning model to obtain a main factor and a backup factor; the main factor and the backup factor represent different authentication methods.

[0087] Among them, the AI decision engine is the core module for realizing intelligent authentication, and the deep reinforcement learning model is used to extract features from the collected data and generate the optimal authentication strategy.

[0088] In some implementations, the authentication factor combination may include a combination strategy of multiple primary factors (such as radio frequency fingerprint authentication, key authentication) and backup factors (such as biometric authentication).

[0089] It should be pointed out that the model training process needs to construct a state space based on historical authentication logs and optimize the security and efficiency of the factor combination through the reward function.

[0090] Exemplarily, the primary factor may give priority to multi-band radio frequency fingerprint authentication, and the backup factor may be configured as fingerprint authentication, which is applicable to conventional airspace environments.

[0091] S3. Use the primary factor to authenticate the aircraft. When the matching degree of the primary factor authentication is within a preset range, the backup factor is triggered to perform secondary authentication to obtain the authentication result.

[0092] The primary factor authentication match is used to measure the consistency between authentication information and the registration template. The preset interval can be dynamically adjusted based on the risk level. Furthermore, the registration template represents a pre-stored set of baseline data or rules used to verify the aircraft's identity. Different authentication methods correspond to different registration templates.

[0093] In some implementations, principal factor authentication may include multi-band radio frequency fingerprint similarity calculation, key decryption verification, and other methods, and the matching degree may be generated by integrating the results of various authentication methods; for example, for key decryption verification and digital signature verification authentication methods, when the authentication is passed, such as the key hash value is completely consistent with the registration template and the signature verification is successful, the matching degree is set to 1; when the authentication fails, the matching degree is set to 0; for multi-band radio frequency fingerprint and sensor feature vector authentication methods (similarity matching based on continuous features), the matching degree can be generated by calculating the cosine similarity, Euclidean distance or dynamic time warping (DTW) distance between the authentication data and the registration template; for dynamic token time synchronization and response delay authentication methods, the matching degree can be generated by calculating the absolute value of the time difference when the authentication is successful and comparing it with a preset threshold.

[0094] It should be noted that the preset interval is usually the threshold range of "authentication is successful but there are certain risks", for example, secondary authentication is triggered when the matching degree is 60%-80%.

[0095] For example, when an aircraft enters a regional control zone, it sends an identity authentication request to the authentication system. The system first sends a data collection request to the aircraft to obtain device status data and retrieves historical authentication logs based on the aircraft ID. It also obtains environmental data from environmental monitoring sensors or internal sensors, ultimately collecting all collected data. The authentication system then normalizes the collected data and feeds it into an AI decision engine. Using a pre-trained deep reinforcement learning model, it generates an authentication factor combination consisting of a primary factor and backup factors. The system then issues a primary factor authentication instruction to the aircraft, such as performing multi-band RF fingerprint authentication or key authentication. After the aircraft completes the authentication operation and returns the result to the system, the system calculates the match degree of the primary factor identity authentication. If the match degree reaches a first preset threshold, authentication is successful. If the match degree falls below a second preset threshold, authentication fails. An access denial signal is then sent to the aircraft, and the authentication system's built-in risk management module enforces permission blocking, denying all aircraft operation requests. If the matching degree is within the preset range of [first preset threshold, second preset threshold], the system will trigger the backup factor for secondary identity authentication, such as biometric authentication or blockchain identity traceability authentication. The aircraft will perform authentication again and feedback the results.

[0096] It should be noted that if the authentication system detects that a new aircraft has connected to the network of the regional control zone but has not sent an identity authentication request, the system will proactively send a data collection request to the aircraft. If the aircraft rejects the collection request, the risk management module built into the authentication system will directly enforce permission interception and reject all operation requests of the aircraft.

[0097] S4. An access token is generated based on the authentication result and the risk assessment model, and the aircraft performs access control based on the access token.

[0098] Among them, the access token is used to describe the relationship between permission level, validity period, authentication factors, and environmental risks, and is the core credential of access control.

[0099] In some implementations, the risk assessment model can calculate the risk coefficient based on environmental data, and the authority level can be divided into basic, intermediate, advanced and other levels, with different levels corresponding to different operating permissions and token validity periods.

[0100] It should be noted that no access token is generated when the authentication result is failed, and access may be restricted or prohibited in high-risk environments.

[0101] For example, if the environmental risk factor is high (such as strong signal interference), even if the authentication is successful, only a basic authority token is generated, limiting the flight altitude and speed of the aircraft.

[0102] Based on the above technical solution, this application provides multi-dimensional data support for authentication decisions by obtaining environmental data, equipment status data and historical authentication logs of low-altitude aircraft; with the help of AI decision-making engines and pre-trained deep reinforcement learning models, a combination of main factors and backup factors is dynamically generated to build a flexible multi-factor authentication mechanism that can actively identify abnormal devices and intercept illegal access; the backup factor is dynamically triggered for secondary authentication through the main factor authentication matching degree, thereby improving the reliability of the authentication process; the access token is generated by combining the authentication results with the built-in risk assessment model, realizing intelligent management and control that dynamically adjusts the authority level and access scope according to environmental risks, effectively improving the authentication security, flexibility and adaptability to airspace risks of low-altitude aircraft in complex environments.

[0103] Obtain environmental data, equipment status data, and historical authentication logs of low-altitude aircraft to obtain collected data;

[0104] Input the collected data into the AI decision engine, and generate authentication factor combinations through the pre-trained deep reinforcement learning model to obtain the main factors and backup factors;

[0105] The primary factor is used to authenticate the aircraft's identity. When the matching degree of the primary factor authentication falls within a preset range, the backup factor is triggered to perform secondary authentication and obtain the authentication result.

[0106] An access token is generated based on the authentication results and the risk assessment model, and the aircraft performs access control based on the access token; wherein, the access token is used to describe the relationship between the authority level and the authentication factors and environmental data, and the risk assessment model is built into the AI decision engine.

[0107] In this embodiment, the collected data includes:

[0108] Environmental data including signal strength, spectrum interference value, horizontal component precision factor, temperature, humidity, and air pressure;

[0109] Device status data including the aircraft's remaining battery capacity, CPU or GPU load, remaining storage space, and flight altitude, speed, and heading;

[0110] An authentication log that includes the authentication results, authentication time, authentication factor combination, and corresponding environmental data and device status data of multiple recent identity authentications.

[0111] It should be noted that various indicators of environmental data need to be collected in real time through sensors, and the collection frequency can be dynamically adjusted according to airspace risks; equipment status data can be obtained through the aircraft's built-in sensors and system logs, such as reading the remaining power through the battery management system and obtaining real-time flight parameters through the flight control system.

[0112] In a possible implementation of the embodiment of the present application, the above S2 can be specifically implemented by the following S201, S202 and S203, which are specifically described below:

[0113] S201. Initialize the components of the AI decision engine.

[0114] The AI decision engine includes a decision generation unit and a risk assessment unit:

[0115] The decision generation unit uses the built-in deep reinforcement learning model to process the collected data and output the authentication factor combination;

[0116] The risk assessment unit calculates the environmental risk coefficient using a risk assessment model based on environmental data.

[0117] It should be noted that the two units can work together, and the risk assessment results can be fed back to the decision-making unit to adjust the factor combination strategy.

[0118] Exemplarily, when the risk assessment unit detects high spectrum interference, the decision generation unit preferentially selects multi-band radio frequency fingerprint authentication as the main factor.

[0119] S202. Generate an authentication factor combination through a deep reinforcement learning model.

[0120] Among them, the input of the deep reinforcement learning model is the normalized collected data, and the output is the main factor and the backup factor.

[0121] In some implementations, the model training process includes:

[0122] 1. Data collection and preprocessing:

[0123] First, extract at least 100,000 certification logs from the historical operation records of the low-altitude aircraft certification system. Each log contains the following fields:

[0124] Timestamp: accurate to milliseconds;

[0125] Authentication result: contains a binary label of success / failure;

[0126] Authentication time: unit: ms;

[0127] Authentication factor combination: including primary factor type and backup factor type;

[0128] Environmental data: including signal strength RSSI, spectrum interference Interf, HDOP, temperature T, humidity H, and air pressure P;

[0129] Device status data: including battery capacity, CPU load, flight altitude, and speed.

[0130] Then, each data item in the historical authentication log is normalized, wherein the normalization processing method of the environmental data is shown in step S203. The normalization processing method includes:

[0131] For timestamps: Convert the timestamp to milliseconds of the epoch time, such as 00:00:00 UTC on January 1, 2020, and then use the linear normalization formula Mapping the interval [0,1], where and They are the minimum and maximum values of timestamps in the historical logs, respectively.

[0132] For authentication time: linear normalization is used, the formula is: , where TS is the original time (unit: ms), TS min and TS max They are the minimum and maximum historical authentication time, respectively. After normalization, the value range is [0,1].

[0133] For authentication factor combinations: One-Hot Encoding is used to map the predefined authentication factor library (e.g., primary factors: multi-band RF fingerprint authentication, key authentication; backup factors: biometric authentication, blockchain traceability authentication) into binary vectors. For example, the combination of the primary factor "key authentication" + the backup factor "biometric authentication" can be encoded as ([0,1,1,0]) (assuming the primary factor library length is 2 and the backup factor library length is 2), ensuring that each factor combination corresponds to a unique sparse vector representation.

[0134] It should be noted that the authentication accuracy of the backup factor in this application is higher than that of the primary factor, which means that the authentication method of the backup factor generates authentication credentials based on non-tamperable or unique characteristics, and its authentication error rate is lower than the authentication error rate of the primary factor authentication method, where the authentication error rate can be the weighted average of the false acceptance rate (FAR) and the false rejection rate (FRR).

[0135] For example, the backup factor includes at least one of biometric authentication and blockchain identity traceability authentication.

[0136] Biometric authentication is based on the uniqueness of biometric features such as fingerprints, faces, and voiceprints, and its misidentification rate is usually less than or equal to 0.001%;

[0137] Blockchain identity traceability authentication verifies the aircraft's historical flight records through smart contracts and utilizes the distributed and tamper-proof nature of blockchain to ensure that authentication credentials cannot be forged or tampered with. Its misrecognition rate is typically less than or equal to 0.0001%.

[0138] The primary factor authentication method includes at least one of multi-band radio frequency fingerprint authentication, key authentication, digital certificate authentication, and geo-fencing authentication. In practice, the primary factor is typically easier to decrypt than the backup factor, resulting in reduced authentication accuracy. Therefore, in high-risk environments, where the network may be experiencing an external intrusion, the model triggers the backup factor, increasing the difficulty of identity authentication. This means that the backup factor's authentication accuracy is higher than that of the primary factor, which is the same as the backup factor's authentication difficulty being higher than that of the primary factor, or the backup factor's authentication error rate being lower than that of the primary factor.

[0139] For each numerical data in the device status data, the linear normalization formula is used Processing, where X is the original value of each indicator in the device status data (such as remaining battery capacity, CPU load, flight altitude), X min and X max are the minimum and maximum values of the indicator respectively.

[0140] Then construct the state space: concatenate the normalized environmental data, device status data, authentication results, authentication time, and factor combination codes in sequence into a state vector of length L .

[0141] 2. Environment modeling and action space definition:

[0142] First, the authentication system is abstracted into a reinforcement learning environment E, where:

[0143] Status S t : That is, the normalized state vector mentioned above;

[0144] Action At : A combination strategy selected from a predefined authentication factor library, including:

[0145] Main factor set: {multi-band radio frequency fingerprint authentication (F1), key authentication (F2), geo-fence authentication (F3), digital certificate authentication (F4)};

[0146] Backup factor set: {biometric authentication (B1), blockchain traceability authentication (B2)};

[0147] Action space size: One backup factor must be selected (it may not be triggered in practice), and at least one main factor must be selected, for a total of 45 combination strategies.

[0148] Then set the reward function as: ; Among them, AS∈{0,1} represents the authentication result, TS' represents the normalized authentication time, R env It represents the environmental risk coefficient calculated by the risk assessment model. α1, α2, and α3 represent the weight coefficients of each item, and the default values are: α1=10, α2=5, and α3=4. β represents the fixed penalty value for authentication failure, and the default value is 8.

[0149] 3. Algorithm selection and network architecture:

[0150] Taking the proximal policy optimization algorithm as an example, we build a deep reinforcement learning model, including:

[0151] Policy network: The input layer dimension is L, the hidden layer contains at least 2 layers of full connection and activation function, the output layer dimension is 45 action space size (including both main factors and backup factors), and the output action probability distribution For example, if we assign a probability of 0.8 to the action "primary factor = radio frequency fingerprint authentication, backup factor = biometric authentication" and assign lower probabilities to other actions, the final factor combination is [primary factor = radio frequency fingerprint authentication, backup factor = biometric authentication];

[0152] Value network: The input layer is the same as the policy network, the hidden layer contains at least 2 fully connected layers, and the output layer outputs a scalar value V(S t ), estimate the state value.

[0153] 4. Iterative training and optimization:

[0154] Set the training parameters to:

[0155] Set the batch size to 512 logs / batch and the learning rate to the initial value of 3×10 -4 , decaying by 10% every 1000 rounds; number of training rounds: at least 5000 rounds, until the reward value converges (with the fluctuation range <5% as the standard); discount factor: γ=0.99.

[0156] Execute the training process:

[0157] Data sampling: randomly extract batches of data from historical logs . Policy update: through PPO loss function Update the policy network parameters θ, where is the probability ratio of the new and old strategies, is the advantage function estimate, =0.2 is the clipping parameter, clip() represents the clipping function;

[0158] Value network update: via mean squared error (MSE) loss Optimize the value network.

[0159] Iteration: Repeat the above steps to save the model parameters every 500 rounds and evaluate indicators such as the authentication success rate and average time.

[0160] 5. Model validation and deployment:

[0161] 20,000 historical logs that were not used in training are reserved as the validation set. The evaluation indicators are defined as follows: Authentication success rate: number of successful authentications / total number of authentications (target ≥ 95%); average authentication time: average time taken for successful authentication (target ≤ 500ms); risk coverage: high-risk environments (such as R env ≥0.7) triggers the proportion of backup factors (target ≥90%). The model that achieves the target evaluation metric is saved, and a pre-trained deep reinforcement learning model is obtained, whose input data is the collected data and output is the optimal authentication factor combination including the main factor and backup factors. This model is then deployed on the authentication system.

[0162] After the model is deployed, the latest authentication logs (about 100) are collected every hour to form a sliding window dataset. The model parameters are regularly updated through incremental learning to ensure that they adapt to changes in the airspace environment.

[0163] Exemplarily, in a low-risk environment, the model outputs the primary factor as key authentication and the backup factor as fingerprint authentication to balance efficiency and security.

[0164] S203, calculating an environmental risk coefficient based on the environmental data.

[0165] Specifically, first, the values of each indicator in the environmental data need to be normalized to obtain the normalized values of each indicator, including:

[0166] Signal normalization value RSSI norm : Among them, RSSI min Indicates the preset signal strength lower limit, RSSI max Indicates the preset signal strength upper limit;

[0167] Positioning accuracy normalized value HDOP norm : ;

[0168] Spectral normalization value Interf norm : Among them, Interf k Indicates the spectrum interference value of the kth frequency band, N bands Indicates the number of monitoring frequency bands, Interf max Indicates the maximum spectrum interference value;

[0169] Temperature normalized value T: ; Among them, T opt Indicates the ideal temperature value, T max Indicates the maximum temperature deviation;

[0170] Normalized pressure value P: Among them, P std Indicates the standard atmospheric pressure value. P max Indicates the maximum deviation of air pressure;

[0171] Humidity normalized value H: Among them, H thr Indicates the preset humidity threshold, H max Represents the maximum deviation value of humidity, and ReLU() represents the ReLU function.

[0172] Then the normalized values of each indicator are weighted and summed to obtain the calculated environmental risk coefficient R env The risk assessment model is: R env =w s ×(1-RSSI norm )+w i ×Interf norm +w h ×HDOP norm +w t × T+w p × P+w hum × H; where w s 、w i 、w h 、w t 、w p 、w humRepresents each coefficient, and the default value is: w s =0.35, w i =0.25, w h =0.20, w t =0.10, w p =0.07, w hum =0.03.

[0173] Based on the above technical solution, the AI decision engine dynamically generates authentication factor combinations through data-driven intelligent algorithms, achieving adaptive matching of authentication strategies and environmental risks. Specifically, the engine consists of two core components: a decision generation unit and a risk assessment unit. The decision generation unit has a built-in pre-trained deep reinforcement learning model that can construct a state space based on collected data, and uses a pre-defined authentication factor library as an action space, iteratively optimizing the factor combination strategy through a reward function. The risk assessment unit normalizes environmental data such as signal strength, spectrum interference, and positioning accuracy, generates an environmental risk coefficient through weighted summation, and feeds it back to the decision generation unit in real time, prompting the model to automatically select a high-intensity multi-factor combination in high-risk scenarios, and give priority to low-intensity factors for rapid authentication in low-risk scenarios, achieving dynamic adaptation of "the higher the risk, the greater the authentication strength."

[0174] In a possible implementation of the embodiment of the present application, combined with Figure 2 ,like Figure 3 As shown, the above S3 can be implemented through the following steps:

[0175] First, perform main factor identity authentication. The main factors include multi-band radio frequency fingerprint authentication, key authentication, digital certificate authentication, geo-fence authentication, etc. Different authentication methods correspond to different verification logic.

[0176] For example, multi-band RF fingerprint authentication calculates the cosine similarity S between the feature vector of each frequency band and the registered template RF,i , and combined with the spectrum interference value Interf i Perform weighted summation to obtain the RF matching degree S RF , the formula is , the frequency band with less interference has a higher weight;

[0177] Key authentication requires verifying whether the decrypted challenge value is consistent with the original value. If they are consistent, the decryption timestamp is calculated based on the deviation T between the system time. resp Calculate the key matching degree S Key , the formula is: ; Among them, T th Indicates the preset time threshold, for example, 20ms. The smaller the deviation, the higher the matching degree.

[0178] The matching degree of digital certificate authentication is verified by the certificate chain. chain And the signature verification result is Valid signature The weighted summation is calculated as follows: Valid chain =1 means the certificate chain is valid. chain =0 means the certificate chain is invalid, Valid signature =1 means the signature is valid, signature =0 means the signature is invalid, γ1 and γ2 represent weight coefficients, and their sum is 1. The default values are: γ1=0.4, γ2=0.6;

[0179] Geofence authentication is performed by calculating the minimum distance D between the aircraft's real-time position and the preset fence. min , according to the formula Generate geographic matching degree S Geo , the closer the distance, the higher the matching degree, where d th Indicates the preset distance threshold, for example, d th =10m.

[0180] Next, the primary factor authentication match is calculated. If the primary factor includes multiple authentication methods (e.g., RF fingerprint and key authentication are enabled simultaneously), the match is calculated as the average of the matching degrees of each authentication method. The preset interval is typically set between 60% and 80%, indicating successful authentication but with some risk. When the match is greater than 80%, authentication succeeds immediately; when it is less than 60%, authentication fails. Secondary authentication with the backup factor is triggered only when the match is between 60% and 80%. The preset interval is [second threshold, first threshold], where the first and second thresholds can be set based on specific circumstances.

[0181] Finally, the backup factor is triggered for secondary authentication. The backup factor includes biometric authentication (fingerprint, face, voiceprint, etc.) and blockchain identity traceability authentication.

[0182] For example, biometric authentication verifies by comparing the cosine similarity of the fingerprint feature vector collected in real time with the registered fingerprint template. Blockchain identity traceability authentication uses a smart contract to query the aircraft's historical flight records and operating status. If the status is revoked, unknown, or no record, the authentication fails. The final authentication result is considered successful only if the backup factor authentication passes; otherwise, it fails.

[0183] Based on the above technical solution, this application implements a dual mechanism of rapid verification of main factors and risk protection of backup factors, ensuring adaptive authentication strength under different risk levels and improving the reliability and security of identity authentication.

[0184] In a possible implementation of the embodiment of the present application, the above S4 can be specifically implemented by the following steps:

[0185] First, based on the authentication result (primary factor authentication success, backup factor authentication success or failure) and the environmental risk coefficient Renv calculated by the risk assessment model, the authority value P is calculated in combination with the number of triggered primary factors and backup factors Nfactor. The calculation formula is , where λ1 and λ2 are weight coefficients, and λ1+λ2=1, and η is the amplification factor, which is 10.

[0186] For example, if two primary factors and one backup factor are triggered, then N factor =3, assuming the environmental risk factor R env =0.6, λ1=0.7, λ2=0.3, then P=floor(0.7×3+0.3×0.6×10)=floor(2.1+1.8)=3.

[0187] Then, the corresponding operation permission level and token validity period are assigned according to the permission value P. Among them, the preset permission level is divided into three levels:

[0188] When P is in the first interval [0-2], basic permissions are assigned, allowing the aircraft to perform basic flight operations (such as straight-line flight and altitude hold), and the token is valid for 2 hours;

[0189] When P is in the second interval [3-5], intermediate authority is assigned, allowing flight in specific areas (such as designated low-altitude test areas) with a validity period of 1 hour;

[0190] When P is in the third interval [6-10], advanced permissions are assigned, allowing full airspace flight and complex operations (such as route changes and mission loading), with a validity period of 0.5 hours.

[0191] It should be noted that the authority level and validity period can be dynamically adjusted according to real-time airspace control policies, such as automatically lowering the authority level near a temporary no-fly zone.

[0192] Finally, an access token containing permission information is generated using an asymmetric encryption signature algorithm (such as RSA). The token contains the permission level (such as "Intermediate"), the validity period (such as "2025-05-28T09:00:00 to 2025-05-28T13:00:00"), the aircraft's unique identifier (such as the IMEI number), a timestamp (to prevent replay attacks), and a signature value (generated by encrypting the above information using a private key). The generated token is transmitted to the aircraft in binary or JSON format. After verifying the signature using its built-in public key, the aircraft then implements access control logic based on the permission level in the token, such as rejecting flight instructions or data access requests that exceed the permission range.

[0193] Based on the above technical solution, this application realizes dynamic mapping from authentication strength and environmental risk to access rights, ensuring that aircraft obtain the minimum necessary permissions in different scenarios, and improving the security and refined management capabilities of airspace access.

[0194] The above mainly introduces the scheme of the embodiment of the present application from the perspective of device implementation. It can be understood that each device, for example, an identity authentication and access control device for low-altitude aircraft, contains at least one of the hardware structures and software modules corresponding to the execution of each function in order to realize the above functions. Those skilled in the art should easily realize that, in combination with the units and algorithm steps of each example described in the embodiments disclosed herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0195] In the embodiment of the present application, an identity authentication and access control device for low-altitude aircraft can be divided into functional units according to the above-mentioned method example. For example, each functional unit can be divided according to each function, or two or more functions can be integrated into one processing unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. It should be noted that the division of units in the embodiment of the present application is schematic and is only a logical functional division. There may be other division methods in actual implementation.

[0196] In the case of an integrated unit, Figure 4 A possible structural diagram of an identity authentication and access control device for low-altitude aircraft involved in the above embodiment (denoted as device 40) is shown. The device 40 includes a processing unit 401 and a communication unit 402, and may also include a storage unit 403. Figure 4 The structural schematic diagram shown can be used to illustrate the structure of the device involved in the above embodiments.

[0197] when Figure 4 The structural schematic diagram shown is used to illustrate the structure of the device involved in the above embodiment. The processing unit 401 is used to control and manage the actions of the device, the communication unit 402 is used for the device to communicate with other devices (such as low-altitude aircraft, sensor networks), and the storage unit 403 is used to store the program code and data of the device (such as historical authentication logs, registration templates, and permission configuration policies).

[0198] For example, the communication unit 402 is used to collect environmental data (signal strength, spectrum interference, etc.), device status data (battery capacity, flight altitude, etc.) and historical authentication logs of low-altitude aircraft and transmit them to the processing unit;

[0199] Processing unit 401 is used to input the collected data into the AI decision engine, generate an authentication factor combination through a deep reinforcement learning model, perform primary factor authentication and calculate the matching degree, trigger secondary authentication of the backup factor based on the matching degree, and generate an access token based on the authentication result and the risk assessment model.

[0200] In a possible implementation, the processing unit 401 is further configured to normalize the environmental data, calculate the environmental risk coefficient, and dynamically adjust the authority level according to the authority value calculation formula.

[0201] In one possible implementation, the communication unit 402 is also used to send an access token and permission information to the low-altitude aircraft, and the processing unit 401 is also used to verify the real-time location of the aircraft and the matching degree of the geo-fence, or to query the aircraft status through the blockchain smart contract.

[0202] The processing unit 401 may be a processor or controller, and the communication unit 402 may be a communication interface, a transceiver, a transceiver, a transceiver circuit, a transceiver device, etc. The term "communication interface" is a general term and may include one or more interfaces. The storage unit 403 may be a memory. When the device 40 is a chip, the processing unit 401 may be a processor or controller, and the communication unit 402 may be an input interface and / or output interface, a pin, or a circuit, etc. The storage unit 403 may be a storage unit within the chip (e.g., a register, a cache, etc.) or a storage unit located external to the chip (e.g., a read-only memory (ROM) or a random access memory (RAM), etc.).

[0203] Among them, the communication unit can also be called a transceiver unit. The antenna and control circuit with transceiver functions in the device 40 can be regarded as the communication unit 402 of the device 40, and the processor with processing function can be regarded as the processing unit 401 of the device 40. Optionally, the device used to implement the receiving function in the communication unit 402 can be regarded as the communication unit. The communication unit is used to perform the receiving steps in the embodiment of the present application. The communication unit can be a receiver, a receiver, a receiving circuit, etc. The device used to implement the sending function in the communication unit 402 can be regarded as a sending unit. The sending unit is used to perform the sending steps in the embodiment of the present application. The sending unit can be a transmitter, a transmitter, a sending circuit, etc.

[0204] Figure 4If the integrated units are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a number of instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) or a processor to execute all or part of the steps of the method described in each embodiment of the present application. The storage medium for storing computer software products includes various media that can store program codes, such as USB flash drives, mobile hard drives, read-only memories, random access memories, magnetic disks or optical disks.

[0205] An embodiment of the present application also provides a computer-readable storage medium, comprising instructions, which, when executed on a computer, enables the computer to execute any of the above methods.

[0206] An embodiment of the present application also provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute any of the above methods.

[0207] An embodiment of the present application also provides a chip, which includes a processor and an interface circuit, the interface circuit is coupled to the processor, the processor is used to run a computer program or instruction to implement the above method, and the interface circuit is used to communicate with other modules outside the chip.

[0208] The above embodiments can be implemented in whole or in part through software, hardware, firmware, or any combination thereof. When implemented using a software program, they can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the processes or functions described in the embodiments of this application are generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that includes one or more available media. Available media can include magnetic media (e.g., floppy disks, hard disks, tapes), optical media (e.g., DVDs), or semiconductor media (e.g., solid-state drives (SSDs)).

[0209] Although the present application is described herein in conjunction with various embodiments, in the process of implementing the claimed application, those skilled in the art may understand and implement other variations of the disclosed embodiments by reviewing the drawings, the disclosure, and the appended claims. In the claims, the word "comprising" does not exclude other components or steps, and "a" or "an" does not exclude multiple situations. A single processor or other unit may implement several functions listed in the claims. The fact that certain measures are recorded in different dependent claims does not mean that these measures cannot be combined to produce good results.

[0210] Although the present application has been described with reference to specific features and embodiments thereof, it is apparent that various modifications and combinations may be made thereto without departing from the spirit and scope of the present application. Accordingly, this specification and the drawings are merely illustrative of the present application as defined by the appended claims and are deemed to cover any and all modifications, variations, combinations or equivalents within the scope of the present application. Obviously, those skilled in the art may make various modifications and variations to the present application without departing from the spirit and scope of the present application. Thus, the present application is intended to encompass such modifications and variations as fall within the scope of the claims of the present application and their equivalents.

Claims

1. A method for identity authentication and access control for low-altitude aircraft, characterized in that: include: Obtain environmental data, equipment status data, and historical authentication logs of low-altitude aircraft to obtain collected data; An artificial intelligence (AI) decision engine is used to process the collected data and generate an authentication factor combination through a pre-trained reinforcement learning model built into the engine; the authentication factor combination includes a primary factor and a backup factor, and both the primary factor and the backup factor include multiple authentication methods, with the authentication method of the backup factor having higher authentication accuracy than the authentication method of the primary factor; The environmental risk coefficient is calculated by the risk assessment model built into the engine; The primary factor is triggered to perform the identity authentication of the aircraft. If the matching degree of the primary factor identity authentication is within the preset range, the backup factor is triggered to perform secondary identity authentication and obtain the authentication result; When the authentication result is successful, the operation authority and token validity period are determined based on the environmental risk factor and the number of authentication methods of the triggered main factors and / or backup factors, and the access token containing the operation authority and token validity period is sent to the aircraft.

2. The identity authentication and access control method for low-altitude aircraft according to claim 1, characterized in that: The environmental data include: signal strength, spectrum interference value, horizontal component precision factor, temperature, humidity, and air pressure; The device status data includes: the remaining battery capacity of the aircraft, CPU or GPU load, remaining storage space, and device status data of the flight altitude, speed, and heading; The historical authentication log includes: authentication results of multiple recent identity authentications, authentication time, authentication factor combinations, and corresponding environment data and device status data.

3. The identity authentication and access control method for low-altitude aircraft according to claim 1, characterized in that: The environmental risk coefficient is calculated using the risk assessment model built into the engine, including: Normalize the values of each indicator in the environmental data to obtain the normalized value of each indicator; The normalized values of the above indicators are weighted and summed to obtain the calculated environmental risk coefficient R env The risk assessment model is: R env =w s ×(1-RSSI norm )+w i ×Interf norm +w h ×HDOP norm +w t × T+w p × P+w hum × H; where w s 、w i 、w h 、w t 、w p 、w hum Represents each coefficient, and the sum is 1, RSSI norm Indicates the signal normalization value, Interf norm Indicates the spectrum normalization value, HDOP norm represents the normalized value of positioning accuracy, T represents the temperature normalized value, P represents the normalized value of air pressure, H represents the humidity normalized value.

4. The identity authentication and access control method for low-altitude aircraft according to claim 3, characterized in that: The normalization of the values of each indicator in the environmental data includes: Normalize the signal strength RSSI in the environmental data to obtain the signal normalization value RSSI norm , the calculation formula is: Among them, RSSI min Indicates the preset signal strength lower limit, RSSI max Indicates the preset signal strength upper limit; Normalize the horizontal component precision dilution HDOP to obtain the normalized positioning accuracy value HDOP norm , the calculation formula is: ; The spectrum normalization value Interf is calculated according to the formula norm : Among them, Interf k Indicates the spectrum interference value of the kth frequency band, N bands Indicates the number of monitoring frequency bands, Interf max Indicates the maximum spectrum interference value; The temperature normalization value is calculated according to the formula T: ; Among them, T opt Indicates the preset ideal temperature value. T max Indicates the maximum temperature deviation; The normalized value of air pressure is calculated according to the formula P: Among them, P std Indicates the standard atmospheric pressure value. P max Indicates the maximum deviation of air pressure; The humidity normalized value is calculated according to the formula H: Among them, H thr Indicates the preset humidity threshold, H max Represents the maximum deviation value of humidity, and ReLU() represents the ReLU function.

5. The identity authentication and access control method for low-altitude aircraft according to claim 1, characterized in that: The training process of the pre-trained deep reinforcement learning model includes: Set the state space, action space, and reward function of the deep reinforcement learning model; where The state space is constructed as follows: Collect historical authentication logs, where each authentication log includes a timestamp, authentication result, authentication time, authentication factor combination, environmental data, and device status data. Each data item in the historical authentication log is normalized and then concatenated to obtain a state space. The authentication result is normalized using a binary method: 0 indicates authentication failure and 1 indicates authentication success. The authentication factor combination is normalized using a one-hot encoding method. The definition rule of the action space is: a predefined authentication factor library is defined as an action space, and each action in the action space corresponds to a factor combination strategy, and a factor combination strategy includes at least one main factor and at least one backup factor; The calculation formula of the reward function R is: ; Among them, AS∈{0,1} represents the authentication result, TS' represents the normalized authentication time, R env represents the environmental risk coefficient calculated by the risk assessment model, α1, α2, and α3 represent the weight coefficients of each item, and β represents the fixed penalty value for authentication failure; Use a deep Q-network or proximal policy optimization algorithm to build a deep reinforcement learning model, where the input layer dimension of the deep reinforcement learning model is the dimension of the state space, and the output layer dimension is the size of the action space; The deep reinforcement learning model is iteratively trained and optimized using historical authentication logs, and a pre-trained deep reinforcement learning model is obtained, whose input data is the collected data and output is the optimal authentication factor combination including the main factor and the backup factor.

6. The identity authentication and access control method for low-altitude aircraft according to claim 5, characterized in that: The primary factor includes at least one of the following authentication methods: multi-band radio frequency fingerprint authentication, key authentication, digital certificate authentication, and geo-fence authentication; wherein the geo-fence authentication refers to identity authentication by comparing the real-time location of the low-altitude aircraft with a preset geo-fence database; The backup factor includes at least one of the following authentication methods: biometric authentication and blockchain identity traceability authentication; wherein the biometric authentication includes fingerprint authentication, facial authentication, and voiceprint authentication of the staff member; the blockchain identity traceability authentication means verifying the historical flight records and operating status of the low-altitude aircraft through a smart contract. If the low-altitude aircraft has no historical flight records or its operating status is revoked or unknown, the authentication fails; The predefined authentication factor library contains all authentication modes included in the primary factor and the backup factor.

7. The identity authentication and access control method for low-altitude aircraft according to claim 1, characterized in that: The matching degree of the primary factor identity authentication includes: When the main factor is multi-band radio frequency fingerprint authentication, the cosine similarity between the feature vector of each frequency band and the registration template is calculated, and the radio frequency matching degree S is obtained by weighted summation. RF , the calculation formula is: ; Among them, n represents the number of frequency bands, Interf i Indicates the spectrum interference value of the i-th frequency band, S RF,i represents the cosine similarity between the feature vector of the i-th frequency band and the registered template; When the main factor is key authentication, when the challenge value obtained by decryption is consistent with the original challenge value sent by the authentication system, or when the message authentication code obtained by decryption is consistent with the message hash value calculated locally by the authentication system, the deviation T between the timestamp obtained by decryption and the current time of the authentication system is calculated. resp Calculate the key matching degree S Key , the formula is: ; Among them, T th Indicates the preset time threshold; When the main factor is digital certificate authentication, the certificate matching degree S Cert The calculation formula is Valid chain ∈{0,1}, indicating the certificate chain verification result, and Valid chain =1 means the certificate chain is valid. chain =0 means the certificate chain is invalid, Valid signature ∈{0,1} represents the signature verification result, and Valid signature =1 means the signature is valid, signature =0 means the signature is invalid, γ1 and γ2 represent weight coefficients, and their sum is 1; When the main factor is geofence authentication, calculate the minimum distance D between the real-time position of the low-altitude aircraft and the geofence min , according to the preset distance threshold d th Calculate the geographic matching degree S Geo , the formula is: ; When the main factor includes multiple authentication methods, the matching degree of the main factor identity authentication is the average value of the matching degrees of the multiple authentication methods.

8. The identity authentication and access control method for low-altitude aircraft according to claim 1, characterized in that: The method for generating the access token includes: When the certification result is successful, the environmental risk coefficient R calculated according to the risk assessment model env and the number of authentication factors N factor Calculate the permission value P, the formula is: ; Wherein, λ1 and λ2 represent weight coefficients of each item, and the sum is 1, η represents the amplification factor, the value is 10, and the number of authentication factors represents the total number of triggered main factors and / or backup factors; The operation permission level and token validity period are allocated according to the permission value, and an access token is generated based on the signature algorithm.

9. The identity authentication and access control method for low-altitude aircraft according to claim 8, characterized in that: The access token includes operation authority, token validity period, aircraft unique identification, timestamp and signature value.

10. An identity authentication and access control device for low-altitude aircraft, characterized in that: include: a communication unit and a processing unit; The communication unit is used to obtain environmental data, device status data and historical authentication logs of the low-altitude aircraft, obtain collected data, and transmit identity authentication results and access tokens; The processing unit is configured to process the collected data using an AI decision engine, generate a combination of authentication factors using a pre-trained reinforcement learning model built into the engine to obtain a primary factor and a backup factor, and calculate an environmental risk coefficient using a risk assessment model built into the engine; The primary factor is triggered to perform the identity authentication of the aircraft. If the matching degree of the primary factor identity authentication is within the preset range, the backup factor is triggered to perform secondary identity authentication and obtain the authentication result; When the authentication result is successful, the operation authority and token validity period are determined based on the environmental risk factor and the number of triggered primary factors and / or backup factors, and the access token containing the operation authority and token validity period is sent to the aircraft.

Images