Trusted management component and trusted management method for unmanned system
By introducing trusted management components into unmanned systems, combining trust root signing and biometric identification, the protocol fragmentation and security vulnerabilities of unmanned system devices are solved, and unified management and efficient security control of equipment are achieved.
Patent Information
- Application Number
- CN202510806030.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-06-17
- Publication Date
- 2025-08-08
AI Technical Summary
Existing unmanned system equipment has problems in managing and controlling hardware heterogeneity and security risks. Traditional solutions cannot effectively realize cross-platform collaboration and device authentication, and there are problems such as protocol fragmentation, security vulnerabilities and physical environment exposure.
Trusted management components are adopted, including user authentication module and trusted platform module. Through trust root signing, trust chain construction and initialization verification, deep coupling between hardware-level trusted root and network identity authentication is achieved. Combined with biometrics and spectrum analysis, an unreplicable hardware identity identifier is built to perform vertical management of the device.
It realizes unified management and control of cross-brand and cross-protocol equipment, improves the supervision and management efficiency of unmanned systems, prevents illegal modification and rental, and improves the safety and management efficiency of equipment.
Smart Images
Figure CN120455147A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to unmanned systems such as self-driving cars, drones, and humanoid robots, and in particular to a trusted management component and a trusted management method for unmanned systems. Background Art
[0002] With the rapid development of unmanned driving technology, automated navigation algorithms, and IoT communication technologies, the unmanned equipment industry is undergoing a profound transformation from a single-function vehicle to an intelligent ecosystem. In scenarios like industrial inspections, logistics distribution, and emergency rescue, drones, self-driving cars, and unmanned boats have formed a cross-platform collaborative network.
[0003] However, the management and control challenges and security risks brought about by device heterogeneity are becoming a key bottleneck hindering the large-scale development of the industry. Currently, mainstream unmanned equipment on the market involves over 20 communication protocol standards, ranging from ROS (Robot Operating System) in the robotics field to MAVLink, a protocol specifically for drones. Manufacturers exhibit significant differences in hardware architecture, data interfaces, and identity authentication mechanisms. This fragmented ecosystem forces enterprise users to deploy multiple independent management and control platforms when implementing multi-device collaborative operations. This not only increases operational and maintenance costs, but also poses security risks such as control delays and command loss due to data loss during protocol conversion.
[0004] At the device security level, traditional solutions have exposed obvious systemic flaws. Take the SIM card solution, which is widely used in the mobile communications field, as an example. Although it can achieve device identity authentication through the operator network, it only stays at the network access control level. The theft incident of an industrial drone showed that attackers can obtain the device firmware through reverse engineering and then transplant the legitimate SIM card to the cloned device for illegal access, exposing the replicability vulnerability of the pure software authorization mechanism. At the same time, the mature Trusted Platform Module (TPM) technology in the computer field has encountered adaptation difficulties in unmanned equipment scenarios: existing TPM chips are mostly integrated by soldering on the motherboard, which can neither meet the modular maintenance requirements of field equipment nor cope with the risk of solder joint breakage caused by the frequent vibration of unmanned equipment.
[0005] Physical security is also a prominent issue. Unmanned devices are often exposed to open physical environments, and the risk of loss or malicious disassembly is significantly higher than for traditional IT equipment. A theft of an autonomous driving test vehicle revealed that an attacker bypassed the software-based digital rights management (DRM) system by simply short-circuiting the motherboard debug interface. While existing hardware lock solutions can detect physical presence, they generally employ one-way authentication mechanisms and lack the ability to verify the integrity of the device itself. This means that even if a module is not removed, an attacker can still construct a hybrid attack model of "legitimate module + tampered device" by replacing key components of the device (such as the main control chip or sensor module). Furthermore, the security of remote control mechanisms has been questioned: a remote shutdown command from an agricultural drone manufacturer was tampered with by a man-in-the-middle attack, resulting in widespread operational disruptions and exposing design flaws in signature verification and channel protection in pure software remote control protocols.
[0006] Against this backdrop, the industry urgently needs to build a security management and control system adapted to the unique attributes of unmanned devices. This system requires breakthroughs in three core dimensions: first, establishing a deep coupling mechanism between hardware-level trusted roots and network identity authentication to physically block unauthorized use; second, designing a dynamically adaptive integrity verification solution to address dynamic changes in device hardware configurations; and third, developing low-overhead, highly compatible security protocol middleware to resolve the fragmented management and control challenges brought about by a multi-protocol ecosystem. The realization of these technical goals not only affects the security of individual devices but also serves as the foundation for building a large-scale, trusted unmanned system network. This has important practical significance for promoting the implementation of strategic application scenarios such as intelligent manufacturing and smart cities. Summary of the Invention
[0007] Purpose of the invention: In view of the difficulty in unified management caused by the large number of manufacturers of intelligent unmanned systems such as self-driving cars, drones, and humanoid robots in the existing technology, the present invention proposes a trusted management component and trusted management method for unmanned systems. By combining identity authentication and platform trust detection, vertical management of "server-intelligent unmanned system-user" is realized through initialization and verification, which improves the long-standing problem of protocol fragmentation and difficulty in control in the field of unmanned equipment; based on trusted computing, a non-replicable hardware identity is constructed, which improves the superviseability and management efficiency of the unmanned system and realizes unified management of the unmanned system.
[0008] Technical solution: The trusted management component for unmanned systems of the present invention includes a user authentication module and a trusted platform module; the user authentication module includes a biometric module, and the biometric module includes an optical collector and a fingerprint collector; the trusted platform module includes a non-volatile memory, a volatile memory, a platform configuration register, a cryptography engine, a signal generator and a spectrum analyzer.
[0009] The non-volatile memory includes a primary security data area, a secondary security data area, and a tertiary security data area. The primary security data area is isolated from the outside world, the secondary security data area requests data through the bus and protocol, and the tertiary security data area accesses data through the bus and protocol.
[0010] The trust management method for unmanned systems of the present invention comprises the following steps:
[0011] (1) During the component production and initialization phase, the trust root is signed and the trust chain is established. The process is as follows: (1.1) Enter the endorsement key EK in the A layer of the component NVRAM, use the root CA to issue a certificate for the EK, generate the EK digital certificate and store it in the C layer of the NVRAM; (1.2) Submit the component's EK digital certificate and the root CA digital certificate to the government; (1.3) Obtain the digital certificate of the government server and write it to the B layer of the NVRAM; (1.4) Connect the component to the unmanned system for initialization:
[0012] (1.4.1) The component shakes hands with the government server and establishes trusted communication for the first time; (1.4.2) The component generates an AIK digital certificate based on the EK; (1.4.3) The component sends the AIK digital certificate to the government server; (1.4.4) The government server binds the component identity; The component uses the AIK private key to sign the random number generated by the government server and feeds it back to the government server. The government server verifies the signature result through the component's AIK digital certificate; (1.4.5) The component detects and binds to the hardware platform: The component inputs a test signal to the hardware platform and detects the response signal. Based on the amplitude, phase difference, and wave of the test signal and the response signal, the component verifies the signature result. The impedance value of the hardware circuit at the test signal frequency is plotted and the resulting impedance spectrum is stored in NVRAM. (1.4.6) Component detection and binding of firmware sequence: The component reads the firmware stored in the hardware platform according to the firmware startup sequence, calculates the summary value of the firmware code, and calculates and stores the PCR value through the cryptographic engine. (1.4.7) Component detection and binding of operating system: The component reads the program in the operating system according to the program execution sequence, calculates the summary value of the program code, and calculates and stores the PCR value through the cryptographic engine. (1.4.8) Component detection and binding of user identity: The extracted biometric features are stored in NVRAM.
[0013] (2) After the user passes the component authentication, hardware platform authentication, firmware sequence authentication, operating system authentication, and user authentication, the unmanned system is started. The authentication process is as follows:
[0014] (2.1) Component identity verification: The component signs the random number sent by the government server and feeds the signature result back to the government server for verification;
[0015] (2.2) Hardware platform verification: The component inputs a test signal to the hardware platform and detects the response signal, plots the impedance spectrum, and compares the consistency with the impedance spectrum stored in NVRAM;
[0016] (2.3) Firmware Sequence Verification: The component reads the firmware stored in the hardware platform, calculates the digest value of the firmware code, and compares the calculated PCR value with the PCR value stored in the platform configuration register for consistency;
[0017] (2.4) User Authentication: The component compares the extracted biometric information with the biometric information stored in NVRAM.
[0018] In step (1.1), EK is an RSA key pair, and the private key of EK is stored in the A layer of NVRAM from generation to component destruction.
[0019] In step (1.2), the root CA digital certificate is self-signed by the manufacturer's root CA.
[0020] In step (1.4.1), the component holds the digital certificate of the government server, and the government server holds the root CA digital certificate of the component manufacturer and the EK certificate of the component.
[0021] In step (1.4.2), the component generates an RSA key pair through the cryptographic engine and stores it in layer B of NVRAM as the AIK. It then uses the EK private key in layer A to sign the AIK public key, and the AIK digital certificate obtained by the signature is stored in layer C of NVRAM.
[0022] In step (1.4.4), the government server verifies the credibility of the component's EK digital certificate through the manufacturer's root CA digital certificate, and then verifies the credibility of the AIK digital certificate through the component's EK digital certificate, and finally verifies the signature result through the component's AIK digital certificate.
[0023] In step (2.2), the component inputs a test signal to the hardware platform through a signal generator, detects the response signal through a spectrum analyzer, plots the impedance spectrum, and compares the result with the impedance spectrum stored in NVRAM for consistency.
[0024] In step (2.3), the component reads the firmware stored in the EEPROM or FLASH of the hardware platform according to the firmware startup sequence, calculates the summary value of the firmware code, calculates the PCR value through the cryptographic engine, and compares the PCR value of each step with the PCR value stored in the platform configuration register for consistency.
[0025] Beneficial effects: Compared with the prior art, the present invention has the following advantages:
[0026] (1) The present invention integrates SIM card network identity authentication and TPM trusted computing functions, and realizes vertical management of "server-intelligent unmanned system-user" through initialization and verification, which helps to improve the long-standing problem of protocol fragmentation and difficulty in management and control in the field of unmanned equipment.
[0027] (2) The present invention constructs a non-replicable hardware identity based on trusted computing, realizes unified management and control of cross-brand and cross-protocol devices, significantly improves the superviseability and management efficiency of unmanned systems, realizes unified management of unmanned systems, and effectively controls illegal modification and illegal rental of intelligent unmanned systems. BRIEF DESCRIPTION OF THE DRAWINGS
[0028] Figure 1 A schematic diagram of the appearance and usage of the trusted management component of the present invention;
[0029] Figure 2 This is a diagram showing the internal modules of the trusted management component of the present invention;
[0030] Figure 3 This is a schematic diagram of the trust chain establishment and component identity authentication process of the present invention;
[0031] Figure 4 This is a flowchart of the overall binding of the trusted management components of the present invention. DETAILED DESCRIPTION
[0032] like Figures 1 to 4 As shown, the trusted management component for unmanned systems of the present invention consists of two parts: SIM (Subscriber Identity Module) and TPM (Trusted Platform Module).
[0033] Among them, the Trusted Platform Module TPM includes:
[0034] (1) Non-volatile memory (NVRAM): stores persistent data, such as the endorsement key EK and the identity authentication key AIK. NVRAM contains multiple data areas with different security levels. The data areas are isolated from each other, and cross-area operations are prohibited. Layer A is the first-level security data area, which is completely isolated from the outside world, that is, the world outside the component. Data requests or access are not allowed by any means, ensuring the absolute security of the data in Layer A. Layer B is the second-level security data area, which is in a black box state to the outside world and allows data requests through specific buses and protocols. Layer C is the third-level security data area, which allows the outside world to directly access data through specific buses and protocols.
[0035] (2) Volatile memory (RAM): Temporarily stores runtime data, such as session keys and intermediate calculation results. The data disappears after the component is powered off and is only read and written by the cryptographic engine.
[0036] (3) Platform Configuration Registers (PCR): stores the measurement values of each stage in the system startup process, used to verify the integrity of the firmware sequence and operating system. Only "extended" operations (i.e. PCR) are supported. new =Abstract(PCR old ||New data)) is only read and written by the cryptography engine.
[0037] (4) Cryptographic Engines: Processors that perform cryptographic calculations, such as RSA key pair generation, PCR expansion operations, random number generation, encryption and decryption operations, and signing and verification operations.
[0038] (5) Signal Generator: The signal generator generates a variable frequency AC signal as a test signal for detecting the spectrum of the hardware platform. The signal generator works in conjunction with the spectrum analyzer to measure the spectrum characteristics of the hardware platform.
[0039] (6) Spectrum Analyzer: The spectrum analyzer contains an analog-to-digital converter (ADC) and a computing unit. It performs a fast Fourier transform (FFT) on the data, converting the time domain signal into a frequency domain spectrum. The spectrum analyzer works in conjunction with the signal generator to measure the spectral characteristics of the hardware platform.
[0040] The user authentication module SIM includes a biometric module: the biometric module includes an optical collector and a fingerprint collector to collect the user's facial information and fingerprint information.
[0041] The management method of the trusted management component of an unmanned system of the present invention comprises the following steps:
[0042] Step (1): During the component production and initialization phase, the trust root is signed and the trust chain is established. The process is as follows:
[0043] During step (1.1) of the component production process, the manufacturer enters the endorsement key (EK) into the A layer of the component's NVRAM and uses the root CA to issue a certificate for the component's EK. The resulting EK digital certificate is stored in the C layer of NVRAM. The EK is a 2048-bit RSA key pair, unique for each component. The private key portion of the EK is securely stored in the A layer of NVRAM throughout the component's lifecycle, from generation to destruction. It is not disclosed to the outside world and represents the unique identity of the component.
[0044] In step (1.2), the component manufacturer submits the component's EK digital certificate and root CA digital certificate to the government, where the root CA digital certificate is self-signed by the manufacturer's root CA.
[0045] In step (1.3), the component manufacturer obtains the digital certificate of the government server and writes it into the B layer of NVRAM to ensure that the component can communicate with the government server in a trusted manner.
[0046] In step (1.4), after purchasing the components, the user connects to the reserved interface on the unmanned system and initializes the components. The initialization phase is divided into eight steps:
[0047] In step (1.4.1), the component shakes hands with the government server and establishes trusted communication for the first time. The component holds the government server's digital certificate, and the government server holds the component manufacturer's root CA digital certificate and the component's EK certificate. Therefore, both parties initially confirm each other's identities during the handshake process and establish trusted communication based on the TLS protocol.
[0048] In step (1.4.2), the component generates an AIK based on the EK. To ensure the security of the EK, the component's EK does not encrypt, decrypt, sign, or verify external data except during the handshake process. The component uses the cryptographic engine to generate an RSA key pair and stores it in the B layer of NVRAM as the AIK. The component then uses the EK private key in the A layer to sign the public key portion of the AIK. The resulting AIK digital certificate is stored in the C layer of NVRAM.
[0049] In step 1.4.3, the component sends the AIK digital certificate to the government server. The component holds the government server's digital certificate, and the government server holds the component manufacturer's root CA digital certificate, the component's EK certificate, and the component's AIK certificate. Both parties re-establish trusted communication based on the TLS protocol. This step reduces the use of the EK private key and improves EK security.
[0050] In step (1.4.4), the government server binds the component identity. The government server generates a random number (nonce) and sends it to the component. The component uses the AIK private key to sign the random number and sends the signature result (Sign AIK The component's EK digital certificate is verified using the vendor's root CA digital certificate. The AIK digital certificate is then verified using the component's EK digital certificate. Finally, the signature is verified using the component's AIK digital certificate. If the verification result matches the random number, the component's identity is trusted. If not, the component's identity is untrustworthy. This step enables the government server to uniquely bind the component's identity.
[0051] In step (1.4.5), the component detects and binds the hardware platform. The component inputs a test signal to the hardware platform through a signal generator (the test signal is an AC signal with a variable frequency), and detects the response signal through a spectrum analyzer. Based on the amplitude, phase difference, and waveform of the test signal and the response signal, the impedance value (i.e., impedance spectrum) of the hardware circuit at different test signal frequencies is plotted. The impedance spectrum is used as the characteristic of the hardware platform, and the impedance spectrum is stored in NVRAM. There are significant differences in the impedance spectra of different types of unmanned system hardware platforms. Even for the same type of unmanned system, there are slight differences in the measured impedance spectra due to process differences in the production process of the hardware platform. This link achieves the unique binding of the component and the hardware platform by measuring the impedance spectrum of the hardware platform.
[0052] In step 1.4.6, the component detects and binds the firmware sequence. Based on the firmware boot sequence, the component sequentially reads the firmware stored in the hardware platform's EEPROM or FLASH, calculates the firmware code digest, and then uses the cryptographic engine's PCR expansion function to calculate the PCR value. The resulting PCR value for each step is stored in the platform configuration register. This step uniquely binds the component to the firmware sequence by measuring the firmware's PCR value.
[0053] In step 1.4.7, the component detects and binds to the operating system. The component reads all programs in the operating system in the order they are executed, calculates the digest value of the program code, and then uses the PCR expansion function of the cryptographic engine to calculate the PCR value. The PCR value results of each step are stored in the platform configuration register. This step uniquely binds the component to the operating system by measuring the PCR value of the program.
[0054] In step 1.4.8, the component detects and binds the user's identity. The component's built-in biometric module records the user's biometric information (including fingerprints and facial features) and extracts features, storing the extracted biometric information in NVRAM. This step uniquely binds the component to the user's identity by measuring the user's biometrics.
[0055] At this point, component initialization is complete. The government server uses components to achieve unique binding for hardware platforms, firmware sequences, operating systems, and user identities.
[0056] Step (2), during the use phase, every time the user starts the unmanned system, five types of verification are carried out in sequence, namely component authentication, hardware platform authentication, firmware sequence authentication, operating system authentication, and user authentication. Only when all the verifications are passed can the unmanned system start normally. The verification process is as follows:
[0057] Step (2.1), component authentication: the government server generates a random number (nonce) and sends it to the component, the component signs the random number and sends the signature result (Sign AIK The component's identity is authenticated. If the signature matches the nonce, the component's identity is authentic. If not, the component's identity is unauthentic. This step continues throughout the unmanned system's operation.
[0058] Step (2.2), hardware platform verification: The component inputs a test signal to the hardware platform through a signal generator and detects the response signal through a spectrum analyzer, plotting an impedance spectrum and comparing it with the impedance spectrum stored in NVRAM. If the comparison results are consistent, the hardware platform is trustworthy; if the comparison results are inconsistent, the hardware platform is untrustworthy.
[0059] Step (2.3), firmware sequence verification: The component reads the firmware stored in the EEPROM or FLASH of the hardware platform in sequence according to the firmware startup sequence, calculates the summary value of the firmware code, and calculates the PCR value in sequence through the PCR expansion function of the cryptographic engine, and compares the PCR value of each step with the PCR value stored in the platform configuration register. If the comparison results are consistent, the firmware sequence is credible; if the comparison results are inconsistent, the firmware sequence is untrustworthy.
[0060] Step (2.4), user identity verification: The component detects the user's biometric information (including fingerprints and face) and performs feature extraction, and compares the extracted biometric information with the biometric information stored in NVRAM. If the comparison results are consistent, the user identity is credible; if the comparison results are inconsistent, the user identity is untrustworthy.
[0061] In step (2.5), if all four types of verification are passed, the unmanned system starts; if at least one type of verification fails, it means that the intelligent unmanned system is not trustworthy and the unmanned system stops starting.
Claims
1. A trusted management component for an unmanned system, characterized by: It includes a user authentication module and a trusted platform module; the user authentication module includes a biometric recognition module, and the biometric recognition module includes an optical collector and a fingerprint collector; the trusted platform module includes a non-volatile memory, a volatile memory, a platform configuration register, a cryptography engine, a signal generator and a spectrum analyzer.
2. The trusted management component for unmanned systems according to claim 1, wherein: The non-volatile memory includes a primary security data area, a secondary security data area and a tertiary security data area. The primary security data area is isolated from the outside world, the secondary security data area requests data through a bus and protocol, and the tertiary security data area accesses data through a bus and protocol.
3. A trusted management method for an unmanned system, characterized by: The following steps are involved: (1) During the component production and initialization phase, the trust root is signed and the trust chain is established. The process is as follows: (1.1) Enter the endorsement key EK in the A layer of the component NVRAM, use the root CA to issue a certificate for the EK, generate the EK digital certificate and store it in the C layer of the NVRAM; (1.2) Submit the component's EK digital certificate and the root CA digital certificate to the government; (1.3) Obtain the digital certificate of the government server and write it to the B layer of the NVRAM; (1.4) Connect the component to the unmanned system for initialization: (1.4.1) The component shakes hands with the government server and establishes trusted communication for the first time; (1.4.2) The component generates an AIK digital certificate based on the EK; (1.4.3) The component sends the AIK digital certificate to the government server; (1.4.4) The government server binds the component identity; the component uses the AIK private key to sign the random number generated by the government server and feeds it back to the government server, and the government server verifies the signature result through the component's AIK digital certificate; (1.4.5) The component detects and binds to the hardware platform: the component inputs a test signal to the hardware platform and detects the response signal, and draws the impedance value of the hardware circuit at the test signal frequency based on the amplitude, phase difference, and waveform of the test signal and the response signal, and stores the resulting impedance spectrum in NVRAM; (1.4.6) Component firmware sequence detection and binding: The component reads the firmware stored on the hardware platform according to the firmware boot sequence, calculates the summary value of the firmware code, and calculates and stores the PCR value through the cryptographic engine; (1.4.7) Component detection and binding to the operating system: The component reads the program in the operating system according to the program execution order, calculates the digest value of the program code, and calculates and stores the PCR value through the cryptographic engine; (1.4.8) Component for user identity detection and binding: stores the extracted biometrics into NVRAM; (2) After the user passes the component authentication, hardware platform authentication, firmware sequence authentication, operating system authentication, and user authentication, the unmanned system is started. The authentication process is as follows: (2.1) Component identity verification: The component signs the random number sent by the government server and feeds the signature result back to the government server for verification; (2.2) Hardware platform verification: The component inputs a test signal to the hardware platform and detects the response signal, plots the impedance spectrum, and compares the consistency with the impedance spectrum stored in NVRAM; (2.3) Firmware Sequence Verification: The component reads the firmware stored in the hardware platform, calculates the digest value of the firmware code, and compares the calculated PCR value with the PCR value stored in the platform configuration register for consistency; (2.4) User Authentication: The component compares the extracted biometric information with the biometric information stored in NVRAM.
4. The trusted management method for unmanned systems according to claim 3, characterized in that: In step (1.1), EK is an RSA key pair, and the private key of EK is stored in the A layer of NVRAM from generation to component destruction.
5. The trusted management method for unmanned systems according to claim 3, characterized in that: In step (1.2), the root CA digital certificate is self-signed by the manufacturer's root CA.
6. The trusted management method for unmanned systems according to claim 3, characterized in that: In step (1.4.1), the component holds the digital certificate of the government server, and the government server holds the root CA digital certificate of the component manufacturer and the EK certificate of the component.
7. The trusted management method for unmanned systems according to claim 3, characterized in that: In step (1.4.2), the component generates an RSA key pair through the cryptographic engine and stores it in layer B of NVRAM as the AIK. It then uses the EK private key in layer A to sign the AIK public key, and the AIK digital certificate obtained by the signature is stored in layer C of NVRAM.
8. The trusted management method for unmanned systems according to claim 3, characterized in that: In step (1.4.4), the government server verifies the credibility of the component's EK digital certificate through the manufacturer's root CA digital certificate, and then verifies the credibility of the AIK digital certificate through the component's EK digital certificate, and finally verifies the signature result through the component's AIK digital certificate.
9. The trusted management method for unmanned systems according to claim 3, characterized in that: In step (2.2), the component inputs a test signal to the hardware platform through a signal generator, detects the response signal through a spectrum analyzer, plots the impedance spectrum, and compares the result with the impedance spectrum stored in NVRAM for consistency.
10. The trusted management method for unmanned systems according to claim 3, characterized in that: In step (2.3), the component reads the firmware stored in the EEPROM or FLASH of the hardware platform according to the firmware startup sequence, calculates the summary value of the firmware code, calculates the PCR value through the cryptographic engine, and compares the PCR value of each step with the PCR value stored in the platform configuration register for consistency.