Lightweight distributed anonymous two-way authentication method for drones assisted by blockchain

Abstract

The present invention proposes a lightweight, distributed, anonymous, two-way authentication method for drones assisted by blockchain. First, permission control is implemented through smart contracts deployed on the blockchain to ensure that only authorized entities can access secret information stored on the chain. Next, a dynamic pseudonym mechanism is adopted, and the drone identity and session key are updated for each session. In addition, the physical unclonable function is combined with a fuzzy extractor to effectively solve the noise sensitivity problem inherent in the response of the physical unclonable function, while maintaining the security of the generated session key. The present invention overcomes the single point of failure and excessive computing / communication costs of centralized ground stations. Moreover, since drones are devices with limited computing resources, the protocol will not have a negative impact on the performance of the drone.

Description

Technical Field

[0001] The present invention belongs to the field of unmanned aerial vehicle (UAV) communication security and blockchain technology, and specifically provides a lightweight distributed anonymous two-way authentication method for UAVs assisted by blockchain. Background Art

[0002] With the development of low-altitude aerial intelligent networks and the sixth-generation mobile communications (6G) era, drones have become widely used in daily life and military fields. Drones not only offer significant advantages such as low cost, small size, and light weight, but also excel in ease of operation, maneuverability, environmental adaptability, and stealth. These advantages have led to their importance in data collection applications such as remote sensing mapping, environmental monitoring, and agricultural monitoring. However, because drones communicate over public and insecure wireless channels, they are vulnerable to various security threats, such as tampering and replay attacks. Consequently, drone security issues continue to attract attention. Existing security authentication methods primarily rely on complex encryption schemes to ensure data security. However, drones are resource-constrained devices, making it difficult to run traditional encryption algorithms and store keys on them. Therefore, ensuring secure communication and data transmission while controlling drone performance costs is crucial. Existing research has the following three main problems: 1. It fails to consider the limitations of unmanned aerial vehicles (UAVs) in computing and communication, resulting in the protocol having a negative impact on the performance of the UAV; 2. When performing security authentication through base stations (GS), it ignores the single point of failure problem that may exist in centralized ground stations; 3. During the security authentication process, due to the lack of detailed permission control over the information stored on the blockchain, unauthorized drones or base stations can illegally access sensitive information. Summary of the Invention

[0003] This paper proposes a lightweight distributed anonymous two-way authentication method for drones assisted by blockchain.

[0004] The technical solution to achieve the purpose of the present invention is: a lightweight distributed anonymous two-way authentication method for drones assisted by blockchain, the specific steps are:

[0005] The drone completes registration at the base station, and the sensitive information generated during the registration process is encrypted and stored in the blockchain network;

[0006] Deploy a blockchain network with smart contract functionality and implement automated execution mechanisms through pre-set contract logic;

[0007] The drone node sends a data packet containing identity authentication information and an encrypted request string to the base station;

[0008] After receiving the information, the base station verifies the digital identity of the drone node. After the authentication is passed, the base station forwards the information to the target drone node and initiates an authentication request to the target drone node.

[0009] After receiving the base station information, the target drone node performs two-way authentication: after verifying the validity of the base station identity, it generates a secure session key, returns an authentication response to the base station, and synchronously updates the session status on the blockchain;

[0010] The base station conducts final verification of the response information of the target drone node and completes the information transfer after confirming the legitimacy of the identity;

[0011] After receiving the forwarded information, the sending drone node ensures the security of the communication link by verifying the identity of the base station, then generates a session key and submits the blockchain update to complete the entire secure session establishment process.

[0012] Compared with the prior art, the present invention has the following significant advantages:

[0013] The present invention effectively solves the centralized single point failure problem existing in the traditional authentication system by distributing and storing the sensitive information generated by identity authentication in a blockchain network and using smart contracts to achieve refined access control. In terms of security mechanism design, the physical unclonable function (physical unclonable function response) is combined with fuzzy extractor technology to significantly improve the anti-noise interference ability of the physical unclonable function response; at the same time, efficient algorithms such as lightweight hashing and XOR operations are adopted, so that the protocol can greatly reduce the computing and communication overhead while ensuring security, which is particularly suitable for resource-constrained Internet of Things devices. The present invention can not only significantly optimize the computing and communication resource utilization of drones, but also demonstrate excellent security protection performance in the face of various network attacks. It has significant advantages such as high authentication efficiency and low deployment cost, and has broad application prospects in scenarios such as drone group authentication and Internet of Things security access.

[0014] The present invention will be described in further detail below with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 A basic scenario diagram for blockchain-assisted drone safety authentication.

[0016] Figure 2 This is the mutual authentication and key negotiation flow chart between the sending UAV node UAVi and the target UAV node UAVj.

[0017] Figure 3 A comparison chart of the time consumption for sending drone nodes as the number of messages increases.

[0018] Figure 4 This is a comparison chart of the time consumption of the base station as the number of messages increases.

[0019] Figure 5 A comparison chart of the time consumption of target drone / user node as the number of messages increases. DETAILED DESCRIPTION

[0020] A lightweight distributed anonymous two-way authentication method for UAVs assisted by blockchain. First, permission control is implemented through smart contracts deployed on the blockchain to ensure that only authorized entities can access secret information stored on the chain. Then, a dynamic pseudonym mechanism is adopted, and the UAV identity and session key are updated for each session. In addition, the physical unclonable function is combined with a fuzzy extractor to effectively solve the noise sensitivity problem inherent in the response of the physical unclonable function, while maintaining the security of the generated session key. This method overcomes the single point failure and excessive computing / communication cost problems of centralized ground stations, and since UAVs are devices with limited computing resources, the protocol will not have a negative impact on the performance of the UAV. According to security analysis, it is confirmed that the protocol can effectively resist various attacks, and the proposed protocol can effectively reduce computing and communication overhead, so that the protocol can maintain secure and reliable communication in resource-constrained UAV networks. The present invention includes the following steps:

[0021] (1) The drone completes the registration process at the base station. The system encrypts the sensitive information generated during the registration process and stores it in the blockchain network to ensure that the data cannot be tampered with. (2) A blockchain network with smart contract functions is deployed to implement an automated execution mechanism through preset contract logic, significantly reducing the need for human intervention and operational risks. (3) The sending drone node UAVi sends a data packet containing identity authentication information and an encrypted request string to the ground station base station. (4) After the base station receives the information, it first verifies the digital identity of the sending drone node UAVi. After the authentication is passed, it securely forwards the information and simultaneously initiates an authentication request to the target drone node UAVj. (5) After receiving the base station information, the target drone node UAVj performs two-way authentication: after verifying the validity of the base station identity, it generates a secure session key, returns an authentication response to the base station, and synchronously updates the session status on the blockchain. (6) The base station finally verifies the response information of the target drone node UAVj, and completes the information transfer after confirming the legitimacy of the identity. (7) After receiving the forwarded information, the sending drone node UAVi ensures the security of the communication link by verifying the base station identity, then generates a session key and submits the blockchain update to complete the entire secure session establishment process. The specific implementation process is as follows:

[0022] Step 1: The drone completes the registration process at the base station. The sensitive information generated during the registration process is encrypted and stored in the blockchain network to ensure that the data cannot be tampered with.

[0023] like Figure 1The following diagram illustrates a basic scenario for blockchain-assisted drone security authentication. This model leverages the distributed nature of blockchain, the automated execution of smart contracts, and a strict permissions management mechanism to build a secure and reliable drone authentication service platform. The model primarily consists of blockchain nodes, base stations, and drones. Blockchain nodes are deployed on cloud servers and jointly manage and maintain a blockchain ledger, providing services to drones and base stations during missions. Drones and base stations act as light clients, interacting with the blockchain through smart contracts without requiring full blockchain data synchronization. This ensures that even if the drones or base stations are attacked, attackers cannot access secret information stored on the blockchain, effectively guaranteeing data security. When drones or base stations modify information stored on the blockchain through smart contracts, the consensus mechanism of the blockchain nodes is triggered. Only after consensus and verification by the node network can the modified information be written to the blockchain, ensuring the anti-counterfeiting and traceability of the authentication service.

[0024] The UAV needs to be registered on the base station before deployment. The registration process is as follows:

[0025] (1) Send the UAV node UAVi to randomly generate a challenge ,Depend on Generates the desired physical unclonable function response ;

[0026] (2) The sending drone node UAVi will respond to the physical unclonable function With real name As the input of the hash function, the pseudonym used by the sending drone node UAVi during the communication process is jointly output ,Right now: ;

[0027] (3) The sending drone node UAVi will Sent to the base station, where Represents the hardware information of the drone, such as chip serial number, sensor identification, etc. (each drone corresponds to are all different), sending the drone node UAVi storage In the database;

[0028] (4) The base station will receive the information from the sending drone node UAVi , stored in the blockchain in the form of tuples;

[0029] (5) The registration phase of the target UAV node UAVj is the same as the above process.

[0030] Step 2: Deploy a blockchain network with smart contract capabilities, and implement an automated execution mechanism through preset contract functions, significantly reducing the need for human intervention and operational risks.

[0031] Blockchain technology is widely used in finance and information security due to its immutability and decentralization. These characteristics make it valuable in scenarios where data must be permanently reliable and historical data cannot be altered or deleted. A test environment was built using Ganache and Truffle for the prototype. The specific architecture is as follows:

[0032] (1) On-chain storage of sensitive information: UAV nodes and base stations use blockchain’s distributed ledger technology to store secret information generated during registration and authentication in the form of transaction records in a persistent manner within the blockchain’s data structure. Each blockchain node maintains a complete copy of the ledger to ensure data redundancy and consistency.

[0033] (2) Smart contract-driven access control: Base stations and drone nodes implement fine-grained access control over data on the blockchain by calling smart contracts. For example, only authorized entities (such as authenticated drone nodes) are allowed to trigger updates to their own information and access operations on the chain. At the same time, smart contracts can be automatically executed according to the defined contract logic without the need for human intervention, greatly reducing the risk of human intervention.

[0034] (3) Verification architecture ensures data integrity: Any request for modification or deletion of information by the base station and the drone node will trigger the node consensus verification, rejecting illegal operations by users who are not registered on the blockchain. After the transaction passes the verification, a new block will be generated, which will be connected to the main chain after hash linking, making the authentication information between the drone node and the base station tamper-proof and traceable.

[0035] Smart contracts are deployed in the authentication and key negotiation protocols to provide decentralized auxiliary authentication services for drone nodes and base stations. The basic functions of smart contracts deployed in the blockchain are as follows: Figure 2 As shown, the contract functions preset by the smart contract are introduced in detail below:

[0036] (1) registerUAV: This function is only allowed to be called by ground station (base station) nodes that have been registered on the blockchain. It is used to implement the registration function of drone node devices;

[0037] (2) UpdateMempool: This function updates the transaction pool information and can only be called by base stations / drones registered on the blockchain. The system will implement a double verification mechanism for the caller: if an unregistered base station initiates a request, an authorization failure response will be returned; if a malicious drone node is detected attempting an operation, the transaction execution will be forcibly terminated;

[0038] (3) QueryMempool: As a blockchain transaction pool information query interface, this function adopts an access control strategy based on registered identity. Valid query results are returned only when the requester is a legally registered base station or drone node. Requests initiated by unauthenticated users will trigger the query failure protocol.

[0039] (4) UpdateBlockchain: This function implements blockchain-specific data update operations and is strictly limited to being called by registered drone nodes. It mainly implements the following functions: updating the data stored in the blockchain after completing the authentication process; using a timestamp synchronization recording mechanism to ensure operation traceability; implementing a data version control strategy (marking old data as invalid); binding node identity with operation permissions, allowing only updating its own data to prevent malicious nodes from tampering with blockchain information;

[0040] (5) QueryBlockchain: Blockchain data query function. The system implements access control by verifying the registration status of the requesting node. Unregistered nodes will trigger the query failure response mechanism;

[0041] (6) revokeBlockchainByPID: This function is a security management function that grants registered base stations operation permissions. When the system detects that a drone node has been hijacked or exhibits malicious behavior, the base station performs a credential revocation operation through this function, thereby excluding the hacked device from the authentication system and ensuring the overall security of the system.

[0042] Step 3: The sending drone node UAVi sends a data packet containing identity authentication information and an encrypted request string to the ground station base station.

[0043] The sending drone node UAVi will respond As input to the fuzzy extractor, the output key ,Right now ,in represents the auxiliary data generated, To ensure the security of the transmission key, the auxiliary data Encrypted transmission, encrypted value . Send the drone node UAVi to generate a random number and the request string , and request the pseudonym of the communication object from the blockchain , then calculate the first message sent and the second message : , .

[0044] Will It is sent to the base station, and the hash value of this information is recorded in a transaction pool on the blockchain, and the above hash value is marked as pending verification.

[0045] Step 4: After receiving the information, the base station first verifies the digital identity of the sending drone node UAVi. After the authentication is passed, the base station forwards the information to the target drone node UAVj and initiates an authentication request to the target drone node UAVj.

[0046] Figure 2 To illustrate the mutual authentication and key agreement flow chart between the sending UAV node UAVi and the target UAV node UAVj, the steps for identity authentication and key establishment between UAVs are described in detail below.

[0047] After receiving the information, the base station queries the information of the sending drone node UAVi from the blockchain . Calculate the decrypted auxiliary data ,pass The key of the sending drone node UAVi can be calculated , the message Decrypt to get the decrypted request string , random numbers And send drone hardware information . Send the drone hardware information obtained from the chain Send drone hardware information after decryption Compare and then get the stored data from the blockchain , calculate the message based on the decrypted data ,verify and Whether they are equal, and at the same time verify whether the message to be verified in the transaction pool is consistent with the received message. If both are equal, the message verification is successful, otherwise the message will be discarded.

[0048] If the message verification is successful, the base station generates a random number , and calculate the message that needs to be sent 、 、 and : , , , Will It is sent to the target drone node UAVj, and the hash value of this information is recorded in the transaction pool on the blockchain, marked as verified and waiting to be forwarded.

[0049] Step 5: After receiving the base station information, the target drone node UAVj performs two-way authentication: after verifying the validity of the base station identity, it generates a secure session key, returns an authentication response to the base station, and synchronously updates the session status on the blockchain.

[0050] After receiving the message from the base station, the target UAV node UAVj first responds to the challenge Calculate PUF response , then calculate the decrypted pseudonym , send the random number generated by the drone , random number generated by the base station and messages : , , , , verify the calculated With the received If they are the same, the message verification is successful, otherwise the message is discarded.

[0051] If the message verification is successful, the target UAV node UAVj is extracted by the fuzzy extractor. function Calculate the key To ensure the security of the transmission key, the auxiliary data Encrypted transmission, encrypted value , the target UAV node UAVj generates a random number , while generating new physical unclonable function challenges ,according to Generate the corresponding physical unclonable function response: . Then calculate the message to be sent 、 and newly generated pseudonyms : , , ,Will Send to the base station to calculate the session key: , record the hash of the session key into the transaction pool of the blockchain and mark it as the key generation state. and newly generated pseudonyms Stored in the database, the newly generated pseudonyms in the blockchain and the newly generated response to update.

[0052] Step 6: The base station performs a final verification on the response information of the target drone node UAVj, and completes the information transfer after confirming the legitimacy of the identity.

[0053] After the base station receives the message from the target UAV node UAVj, it calculates the decrypted auxiliary data , by auxiliary data The key of the target drone node UAVj can be obtained . The received message Decrypt the random number generated by the decrypted target UAV node UAVj , decrypted response And the decrypted target drone node UAVj hardware information . Will be obtained from the chain After decryption Compare and then calculate the message based on the decrypted data , verify the calculated With the received message If both are the same, the message verification succeeds; otherwise, the message is discarded.

[0054] If the message verification is successful, the base station generates a random number , and calculate the message that needs to be sent and : , ,Will It is sent to the sending drone node UAVi, and the hash value of this information is updated to the blockchain transaction pool and marked as the key transfer status.

[0055] Step 7: After receiving the forwarded information, the sending drone node UAVi ensures the security of the communication link by verifying the base station identity, then generates a session key and submits the blockchain update to complete the entire secure session establishment process.

[0056] After the sending drone node UAVi receives the message sent by the base station, the sending drone node UAVi will receive the received message Decryption is performed to obtain the random number generated by the base station after decryption and the random number generated by the target drone , then calculate the message based on the decrypted data , verify the calculated message With the received message At the same time, verify whether the key transmission information in the transaction pool is the same as the calculation result. If both are the same, the message verification is successful, otherwise the message is discarded.

[0057] If the message verification is successful, the sending drone node UAVi calculates the session key: , then send the drone node UAVi to generate a new physical unclonable function challenge , calculate the new response , a new pseudonym , will generate new challenges and a new pseudonym Stored in the database, the new pseudonym in the blockchain and the newly calculated Perform an update to verify whether the hash value of the session key in the transaction pool is the same as that in the transaction pool, and update the transaction pool status on the blockchain to the completed status.

[0058] Through the above steps, the sending UAV node UAVi and the target UAV node UAVj have authenticated each other, and the session key for subsequent secure communication Successfully created.

[0059] Performance evaluation:

[0060] Computational overhead: In this section, the present invention will compare and analyze the computational overhead of the above protocol with existing protocols. They represent hash functions, hash-based message authentication operations, physically unclonable function operations, symmetric encryption / decryption operations, and multiplication and addition operations on elliptic curves. When performing the above operations, libraries such as pycrypto and hashlib in Python are used. Hashlib is one of Python's standard libraries. It provides a series of common hash algorithms, such as MD5, SHA-1, SHA-256, etc. The hash algorithm can convert data of any length into a hash value of fixed length, which is usually used in scenarios such as data encryption and data integrity verification. Pycrypto is a powerful third-party encryption library that provides a variety of classic and modern encryption algorithms, such as AES, RSA, Diffie-Hellman key exchange, etc. They each provide different encryption tools and functions. The processing results can be obtained through the above code. They are 0.001, 0.088, 0.015, 0.05, 0.632 and 0.016 ms respectively.

[0061] Taking the proposed protocol as an example, the sending UAV node UAVi uses hashing 6 times, physical unclonable functions 2 times, and encryption and decryption 2 times; the base station uses hashing 9 times, encryption and decryption 3 times; the target UAV node UAVj uses hashing 9 times, physical unclonable functions 2 times, and encryption and decryption 1 time. Through calculation, it can be obtained that the total computational overhead generated by the protocol during authentication is The existing methods are mainly as follows: , using multiplication operations on elliptic curves, 2, using addition operations on elliptic curves, 3, using chaotic mapping and message authentication operations, 4, using hash and XOR functions, 5, combining multiplication and addition operations on elliptic curves, etc. Compared with the above methods, the present invention integrates blockchain technology to solve the problems faced by these protocols such as single point failure. In the event of malicious behavior, the base station has the ability to track the true identity of the suspicious drone node. At the same time, the constructed blockchain provides permission access control for the drone node, ensuring that only authorized drones or base stations can access the stored data. At the same time, drones and base stations do not store any sensitive information, effectively preventing the leakage of secrets caused by attacks on base stations and drones, and ensuring the security of the system.

[0062] The method for using elliptic curve authentication is and , resulting in a high computational overhead. The method proposed in the present invention uses lightweight hashing and encryption and decryption operations, and has also undergone security testing. In addition, the challenge-response of the physical unclonable function of the method proposed in the present invention is updated in each session to ensure forward security. The use of chaotic mapping and message authentication operations will also lead to high computational overhead. The present invention uses a fuzzy extractor on the basis of existing message authentication to reduce the noise that may be generated by the physical unclonable function, thereby enhancing the security of the session key. The existing methods mainly use hashing and XOR, and do not update the credentials used in the session after each authentication, which makes it easy to cause the session key to be leaked. The method proposed in the present invention uses new credentials for authentication each time a new session is conducted to ensure key security. The comparison of computational overhead is detailed in Table 1.

[0063] Furthermore, the computational overhead of the proposed method is significantly lower when the number of drones is large. For example, during post-disaster reconstruction, a large number of drones will be activated simultaneously, resulting in a large amount of authentication information being received by the base station and the drones. Figure 3-5 The figure shows a comparison of the runtime cost of processing authentication messages at the sending drone node, the base station, and the target drone node / target user node, compared to existing methods. This method is more efficient than existing protocols for generating authentication messages and negotiating keys between drones. Therefore, this method performs better in terms of computational overhead.

[0064] Table 1 Comparison of computational overhead

[0065] plan Sending drone node (milliseconds) Base station (milliseconds) Target UAV / User Node (milliseconds) Total (milliseconds) Existing method 1 <![CDATA[10T h +3T Ecm +T f ]]> <![CDATA[12T h +T Ecm ]]> <![CDATA[9T h +T f +2T Ecm ]]> 3.853 Existing method 2 <![CDATA[6T h +3T Ecm +T Eca ]]> <![CDATA[8T h +4T Ecm +2T Enc ]]> <![CDATA[4T h +3T Ecm ]]> 6.454 Existing method 3 <![CDATA[4T h +7T Enc +T f +4T m ]]> <![CDATA[13T Enc +6T m +2T h ]]> <![CDATA[2T h +7T Enc +T f +2T m ]]> 2.444 Existing method 4 <![CDATA[4T h +3T Enc +T f ]]> <![CDATA[4T Enc +T h ]]> <![CDATA[4T h +3T Enc +T f ]]> 0.539 Existing method 5 <h2 style=";text-align:left;direction:ltr"><![CDATA[6T <h2 style=";text-align:left;direction:ltr"> h <h2 style=";text-align:left;direction:ltr"> +5T<h2 style=";text-align:left;direction:ltr"> Ecm <h2 style=";text-align:left;direction:ltr"> +2T<h2 style=";text-align:left;direction:ltr"> Eca <h2 style=";text-align:left;direction:ltr"> ]]><h2 style=";text-align:left;direction:ltr"> <![CDATA[4T h +T Ecm +T Eca ]]> <![CDATA[5T h +7T Ecm +5T Eca ]]> 8.359 Methods <h2 style=";text-align:left;direction:ltr"><![CDATA[6T <h2 style=";text-align:left;direction:ltr"> h <h2 style=";text-align:left;direction:ltr"> +2T<h2 style=";text-align:left;direction:ltr"> Enc <h2 style=";text-align:left;direction:ltr"> +2T<h2 style=";text-align:left;direction:ltr"> f <h2 style=";text-align:left;direction:ltr"> ]]><h2 style=";text-align:left;direction:ltr"> <![CDATA[9T h +3T Enc ]]> <![CDATA[9T h +T Enc +2T f ]]> 0.384

[0066] Communication overhead: To calculate the communication cost of the present invention, the random number, pseudonym, hash output, encryption and decryption (using Advanced Encryption Standard AES), elliptic curve point, and timestamp are 128, 160, 160, 128, 160, and 32 bits, respectively. In the proposed method, a total of four messages are exchanged: , , and ,in The first is 128 bits, and the rest are 160 bits. Calculation shows that the communication overhead of the proposed method is 1824 bits. Similarly, the communication overhead of existing protocols can be calculated, as shown in Table 2. Although existing protocols primarily using hash and XOR functions produce the lowest communication overhead, this approach suffers from security deficiencies. Compared to other existing protocols, the communication overhead of the proposed method is reduced by 52.6%, 59.6%, 29.8%, and 38.6%, respectively. This demonstrates the overall superior performance of the proposed protocol.

[0067] Table 2. Communication overhead comparison

[0068] plan Message 1 Message 2 Message 3 Message 4 Message 5 Message 6 Communication overhead (bits) Existing method 1 992 672 640 480 - - 2784 bits Existing method 2 512 1024 672 704 - - 2912 bits Existing method 3 416 288 416 544 416 288 2368 bits Existing method 4 736 608 400 - - - 1744 bits Existing method 5 672 1024 832 - - - 2528 bits Methods 448 640 448 288 - - 1824 bits

Claims

1. A lightweight distributed anonymous two-way authentication method for drones assisted by blockchain, characterized in that: The specific steps are: The drone completes registration at the base station, and the sensitive information generated during the registration process is encrypted and stored in the blockchain network. The specific process for the drone to complete registration at the base station is as follows: (1) Sending drone nodes to randomly generate challenges , and generates a physical unclonable function response , the specific formula is: , PUF is a physical unclonable function; (2) Send the drone node to respond with the physical unclonable function With real name As the input of the hash function, the pseudonym used by the sending drone node UAVi during the communication process is jointly output ,Right now: ; (3) Sending drone node will Sent to the base station, where Represents the hardware information of the drone, sent to the drone node storage In the database; (4) The base station will receive information from the sending drone node , stored in the blockchain in the form of tuples; Deploy a blockchain network with smart contract functionality and implement automated execution mechanisms through pre-set contract logic; The drone node sends a data packet containing identity authentication information and an encrypted request string to the base station. The specific process is as follows: The sending drone node UAVi will respond As input to the fuzzy extractor, the key is determined, i.e. ,in represents the auxiliary data generated, The generated key; For auxiliary data Perform encrypted transmission to obtain encrypted auxiliary data ; Send the drone node UAVi to generate a random number and the request string , and request the pseudonym of the communication object from the blockchain ; Calculate the first message sent and the second message : , ; Will Send to the base station and The hash value is recorded in a transaction pool on the blockchain, and the hash value is marked as pending verification; After receiving the information, the base station verifies the digital identity of the drone node. After the authentication is successful, the base station forwards the information to the target drone node and initiates an authentication request to the target drone node. The specific method for verifying the digital identity of the drone node is as follows: After receiving the information, the base station queries the information of the sending drone node UAVi from the blockchain ; Calculate the decrypted auxiliary data , through the auxiliary data after decryption Calculate the key for sending the drone node UAVi , the first message Decrypt to get the decrypted request string , random numbers And send drone hardware information ; Send drone hardware information obtained from the chain Send drone hardware information after decryption Compare and if there is an exact match, get the stored data from the blockchain , calculate the second decrypted message based on the decrypted data , verify the second decrypted message With the second message Whether they are equal, and at the same time verify whether the message to be verified in the transaction pool is consistent with the received message. If both are equal, the message verification is successful, otherwise the message is discarded; After receiving the base station information, the target drone node performs two-way authentication: after verifying the validity of the base station identity, it generates a secure session key, returns an authentication response to the base station, and synchronously updates the session status on the blockchain; The base station conducts final verification of the response information of the target drone node and completes the information transfer after confirming the legitimacy of the identity; After receiving the forwarded information, the sending drone node ensures the security of the communication link by verifying the identity of the base station, then generates a session key and submits the blockchain update to complete the entire secure session establishment process.

2. The blockchain-assisted lightweight distributed anonymous two-way authentication method for drones according to claim 1 is characterized in that: The encrypted auxiliary data is .

3. The blockchain-assisted lightweight distributed anonymous two-way authentication method for drones according to claim 1 is characterized in that: After the digital identity authentication of the drone node is passed, the information is forwarded to the target drone node, and the specific process of initiating an authentication request to the target drone node is as follows: The base station generates a random number , and calculate the third message that needs to be sent , the fourth message 、Fifth News And the sixth message : , , , ;Will Send to the target UAV node UAVj, and The hash value is recorded in the transaction pool on the blockchain and marked as verified and waiting to be forwarded.

4. The blockchain-assisted lightweight distributed anonymous two-way authentication method for drones according to claim 3 is characterized in that: The specific process of the target drone node performing two-way authentication after receiving the base station information is as follows: After receiving the message from the base station, the target UAV node UAVj will Calculate PUF response ; Calculate the decrypted pseudonym , send the random number generated by the drone , random number generated by the base station and the sixth decrypted message : , , , , Verify the calculated With the received If they are the same, the message is verified successfully. Otherwise, the message is discarded. If the message verification is successful, the target UAV node UAVj is extracted by the fuzzy extractor. Function Compute key , specifically ; For auxiliary data Encrypted transmission, encrypted value , the target UAV node UAVj generates a random number , while generating new physical unclonable function challenges ,according to Generate the corresponding physical unclonable function response: ; Calculate the seventh message to be sent ,eighth and newly generated pseudonyms : , , ,Will Send to the base station to calculate the session key: , record the hash of the session key into the transaction pool of the blockchain and mark it as the key generation state; The new physical unclonable function challenge and newly generated pseudonyms Stored in the database, the newly generated pseudonyms in the blockchain and the newly generated response to update.

5. The blockchain-assisted lightweight distributed anonymous two-way authentication method for drones according to claim 4 is characterized in that: The base station performs final verification on the response information of the target drone node and completes the information transfer after confirming the legitimacy of the identity. The specific method is as follows: After the base station receives the message from the target UAV node UAVj, it calculates the decrypted auxiliary data , by auxiliary data Get the key of the target drone node UAVj ; The seventh message received Decrypt the random number generated by the decrypted target UAV node UAVj , decrypted response And the decrypted target drone node UAVj hardware information ; Will be obtained from the chain After decryption Compare and calculate the message based on the decrypted data , verify the calculated With the received message If they are the same, the message is verified successfully. Otherwise, the message is discarded. If the message verification is successful, the base station generates a random number , and calculate the ninth message that needs to be sent and the tenth : ， ； Will Send to the sending drone node UAVi, and at the same time The hash value is updated to the blockchain transaction pool and marked as the key transfer status.

6. The blockchain-assisted lightweight distributed anonymous two-way authentication method for drones according to claim 5 is characterized in that: After receiving the forwarded information, the sending drone node ensures the security of the communication link by verifying the base station identity, then generates a session key and submits the blockchain update. The specific method to complete the entire secure session establishment process is as follows: After the sending drone node UAVi receives the message sent by the base station, the sending drone node UAVi will receive the received message Decryption is performed to obtain the random number generated by the base station after decryption and the random number generated by the target drone ; Calculate the tenth decrypted message based on the decrypted data , verify the tenth decrypted message With the tenth message received At the same time, verify whether the key transmission information in the transaction pool is the same as the calculation result. If both are the same, the message verification is successful, otherwise the message is discarded; If the message verification is successful, the sending drone node UAVi calculates the session key: ; Send the drone node UAVi to generate a new physical unclonable function challenge , calculate the new response , a new pseudonym , will generate new challenges and a new pseudonym Stored in the database, the new pseudonym in the blockchain and the newly calculated Perform an update to verify whether the hash value of the session key in the transaction pool is the same as that in the transaction pool, and update the transaction pool status on the blockchain to the completed status.

Images