An air-to-air security authentication method for aerial networking unmanned aerial vehicles and related devices

Abstract

The application discloses a kind of security authentication methods and related devices for aerial networking unmanned aerial vehicle, including in registration stage, legal control site is issued shared key to authenticated wingman by group key distribution mode, subsequently, the shared key of each wingman and exclusive number information are issued to authenticated long plane, long plane and wingman obtain consistent shared key;In initial authentication stage, according to consistent shared key, long plane and wingman complete two-way authentication by "challenge-response" mechanism between them, and distribute session key for subsequent communication process;In continuous authentication stage, long plane and wingman use the CSI information collected in communication process, obtain wireless composite domain features using feature extraction method, complete two-way continuous authentication by "challenge-response" mechanism, and update session key for subsequent communication process, realize continuous security authentication.The application guarantees the reliable continuous authentication under long plane-wingman mode, ensures the efficiency and security of battlefield information transmission.

Description

Technical Field

[0001] This invention belongs to the field of wireless communication security and relates to a security authentication method and related devices for aerial networked unmanned aerial vehicles. Background Technology

[0002] The new military revolution is developing rapidly worldwide, and cyberspace has become a new strategic high ground for competition among all parties. As the nervous system of information warfare, battlefield wireless networks have always been a key focus of the spiraling struggle for information dominance between opposing sides. Airborne wireless networks are an important component of network information systems and theater joint operations command information systems. They are a fundamental guarantee for effectively supporting the linking of various combat resources across land, sea, air, space, and cyberspace in the battlefield environment, and for integrated joint operations within the theater.

[0003] Beyond typical terrestrial communication network scenarios, battlefield wireless networks are evolving with the increasing integration of IoT nodes into satellites, missiles, aircraft, ships, artillery, and individual soldier combat equipment. This has led to new battlefield wireless network scenarios, such as unmanned combat and military IoT, focusing on battlefield target identification, weapon and equipment monitoring, situational awareness, and communication collaboration and sharing. In the new era of information technology development, ensuring that typical battlefield wireless networks, including wireless access, drone swarms, and military IoT, can effectively address security threats such as unauthorized access, forgery, deception, and eavesdropping is crucial for achieving victory in informationized warfare.

[0004] The open propagation of electromagnetic waves in wireless communication creates vulnerability in wireless links, providing natural conditions for malicious attacks by adversaries and being the root cause of wireless security problems.

[0005] Space-based networks, operating in open channels, face increasingly severe threats from electromagnetic interference, attacks, and interception, exhibiting vulnerabilities at the signal and information levels. Given the high-level security communication needs of the military and the need to closely monitor the development of adversary cyberspace wireless attack technologies, there is an urgent need to explore intrinsically secure access technologies for space-based wireless networks. Summary of the Invention

[0006] The purpose of this invention is to provide a security authentication method and related device for aerial networked drones, thereby solving the problem of vulnerability at the signal and information levels in existing airborne networks.

[0007] To achieve the above objectives, the present invention employs the following technical solution: A security authentication method for aerial networked unmanned aerial vehicles (UAVs) includes a registration phase, an initial authentication phase, and a continuous authentication phase. During the registration phase, the legitimate control site distributes shared keys to the certified wingmen through group key distribution, and then distributes the shared keys and unique identification information of each wingman to the certified lead machine. The lead machine and wingmen obtain the same shared key. During the initial authentication phase, the lead aircraft and wingman complete two-way authentication through a challenge-response mechanism based on a consistent shared key, and distribute session keys for subsequent communication. During the continuous authentication phase, the lead aircraft and wingman use the CSI information collected during the communication process to obtain wireless composite domain features using feature extraction methods. They complete two-way continuous authentication through a challenge-response mechanism and update the session key for subsequent communication processes to achieve continuous security authentication.

[0008] Furthermore, the process by which a legitimate controlling site distributes a shared key to an authenticated wingman via group key distribution includes: The control station broadcasts a group key distribution command to each registered wingman. After receiving the command, a legitimate wingman that has been authenticated with the control station performs a group key distribution with the control station. The control station then sends the encrypted group key to each wingman in sequence according to the time slot anti-collision principle.

[0009] Furthermore, the process by which the lead aircraft and wingman obtain a consistent shared key includes: The wingman retrieves the legitimate control station number, the response during the control station authentication process, and the old anonymous number, updates and stores the wingman's anonymous number, and sends a message to the lead aircraft; After receiving the message, the lead aircraft verifies whether the control station number is valid, stores the response, uses the anonymous number to find the unique number and shared key corresponding to the wingman from the numbers sent by the control station, updates the wingman's anonymous number, calculates the lead aircraft's anonymous number, and sends the message to the wingman. After receiving the message, the wingman verifies whether the anonymous ID is correct. If it is incorrect, the authentication process is paused; if it is correct, the wingman's anonymous ID is stored.

[0010] Furthermore, the challenge-response mechanism between the control station and the drone includes: The lead aircraft obtains the current timestamp, generates a random number, encrypts it using the local shared key, calculates the message authentication code using the stored unique number and the shared key, and sends the challenge to the wingman using the message authentication code; After receiving the message authentication code, the wingman first checks whether the returned anonymous number is correct. If it is incorrect, the authentication process stops. Then, it obtains the current timestamp, determines whether the message has excessive delay, the possibility of being intercepted and replayed, and whether the message is incomplete or tampered with. It decrypts and stores the message, verifies the validity of the message, calculates and generates the message authentication code, and sends the response to the lead aircraft.

[0011] Furthermore, the initial two-way authentication process between the lead aircraft and the wingman includes: After receiving the response, the lead aircraft verifies whether the received lead aircraft number matches its own, finds the matching wingman's unique number and key based on the anonymous number, obtains the current timestamp, determines whether the message has excessive delay or the possibility of being intercepted and replayed, and whether the message is incomplete or tampered with, and verifies the validity of the message. If all of these match, the wingman is considered a legitimate wingman, and the lead aircraft completes the initial authentication of the wingman. The lead aircraft selects a session key, encrypts the selected session key using its own key and a stored random number, calculates a message authentication code, and sends a message to the wingman using the message authentication code. After receiving the message, the wingman first checks if the returned anonymous number is correct. If it is incorrect, the authentication process stops. Then, it obtains the current timestamp, determines whether the message has excessive delay or is likely to be intercepted and replayed, and whether the message is incomplete or tampered with. It also verifies the validity of the message. If all of these are consistent, the lead aircraft is considered a legitimate lead aircraft. The session key is decrypted and stored, completing the wingman's initial authentication of the lead aircraft.

[0012] Furthermore, the lead aircraft's continuous certification process for its wingman includes: The wingman updates its local key and random number, sends a continuous authentication request to the lead aircraft, updates its local key and random number using the stored wireless composite domain feature quantization value, obtains the current timestamp, calculates and generates a message authentication code using the updated random number and key, and sends the message to the lead aircraft. After receiving a message, the lead aircraft verifies whether the received lead aircraft ID matches its own. If they match, it finds the matching wingman's unique ID and key based on the anonymous ID, obtains the current timestamp, and determines whether the message has excessive delay, the possibility of being intercepted and replayed, or the possibility of the message being incomplete or tampered with. It updates its own key and random number using the stored wireless composite domain feature quantization value, and verifies the validity of the message. If all of these match, the wingman is considered a legitimate wingman, completing the lead aircraft's continuous authentication of the wingman.

[0013] Furthermore, the wingman's continuous authentication process for the lead aircraft includes: The lead aircraft updates its local session key, calculates the message authentication code, and sends the message to the wingman. After receiving the message, the wingman first checks if the returned anonymous number is correct. If it is incorrect, the authentication process stops. Then, it obtains the current timestamp, determines whether the message has excessive delay, the possibility of being intercepted and replayed, or whether the message is incomplete or tampered with. It updates its local session key and verifies the validity of the message. If all of these are consistent, the lead aircraft is considered a legitimate lead aircraft, and the wingman completes the continuous authentication of the lead aircraft.

[0014] A security authentication system for aerial networked unmanned aerial vehicles (UAVs) includes: The registration module is used during the registration phase to distribute shared keys to the authenticated wingmen through group key distribution, and then distribute the shared keys and unique number information of each wingman to the authenticated master machine, so that the master machine and wingmen obtain the same shared key; An initial authentication module is used to complete two-way authentication between the lead aircraft and the wingman through a challenge-response mechanism based on a consistent shared key during the initial authentication phase, and to distribute a session key for subsequent communication. The continuous authentication module is used in the continuous authentication phase by which the lead aircraft and wingman use the CSI information collected during the communication process, use feature extraction methods to obtain wireless composite domain features, complete bidirectional continuous authentication through a challenge-response mechanism, and update the session key for subsequent communication processes to achieve continuous secure authentication.

[0015] A terminal device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the method.

[0016] A computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the method.

[0017] Compared with the prior art, the present invention has the following beneficial effects: This invention provides a secure authentication method for UAVs in an aerial network. It comprises three stages: registration, initial authentication, and continuous authentication. First, the legitimate control station distributes a shared key to the authenticated wingmen via group key distribution. Then, it distributes the shared keys and unique identification information of each wingman to the authenticated lead aircraft. In the initial authentication stage, the lead aircraft and wingmen complete bidirectional authentication through a challenge-response mechanism and distribute session keys for subsequent communication. Subsequent authentication is achieved through continuous authentication. During each continuous authentication, the lead aircraft and wingmen utilize CSI information collected during communication to obtain wireless composite domain characteristics, complete bidirectional authentication through the challenge-response mechanism, and update the session key for subsequent communication, achieving secure and reliable continuous authentication. This invention ensures secure and reliable continuous authentication in the lead-wingman mode, constructs a complete and hierarchical authentication system, making the authentication process more organized and operable. It does not rely on the inherent protection capabilities of traditional cryptographic mechanisms, achieving an integrated design of communication and security. It can verify the identity of UAVs in real time, ensuring continuous communication security, thereby effectively reducing the risk of active and passive attacks on airborne networks and ensuring the efficiency and security of battlefield information transmission. Meanwhile, the overall authentication method is designed to be lightweight, suitable for aerial networking scenarios, and can be widely used in airborne wireless networks to ensure the security of their authentication and communication processes.

[0018] Furthermore, both initial and continuous authentication employ a challenge-response mechanism, where both parties verify each other's identity during the authentication process, ensuring that only legitimate drones can participate in communication. This effectively prevents unauthorized drone access and malicious attacks, significantly improving the security of the communication system. Attached Figure Description

[0019] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 This is a flowchart of the security authentication method for aerial networked unmanned aerial vehicles (UAVs) according to the present invention.

[0021] Figure 2 This is a flowchart illustrating the registration phase of the present invention.

[0022] Figure 3 This is a flowchart illustrating the implementation process of the initial certification phase of this invention.

[0023] Figure 4 This is a flowchart illustrating the implementation process of the continuous certification phase of this invention.

[0024] Figure 5 This is a schematic diagram of a preferred embodiment of the security authentication system for aerial networked unmanned aerial vehicles (UAVs).

[0025] Figure 6 This is a schematic diagram of the electronic device structure according to a preferred embodiment of the present invention. Detailed Implementation

[0026] The following description, in conjunction with the accompanying drawings, illustrates exemplary embodiments of this application, including various details to aid understanding. These should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of this application. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0027] Obviously, the described embodiments are only some, not all, of the embodiments in this application. All other embodiments obtained by those skilled in the art based on the embodiments in this application without inventive effort are within the scope of protection of this application.

[0028] Furthermore, the term "and / or" in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, the character " / " in this article generally indicates that the preceding and following related objects have an "or" relationship.

[0029] The present invention will now be described in further detail with reference to the accompanying drawings: See Figure 1 This invention provides a security authentication method for aerial networked drones, including a registration phase, an initial authentication phase, and a continuous authentication phase, specifically including the following steps: Step 1: Registration Phase. This is the preparation phase for the entire authentication process. A legitimate control station broadcasts a group key distribution command to each registered wingman. Upon receiving the command, the wingman performs a group key distribution with the control station. Specifically, the control station sends encrypted group keys to each wingman sequentially according to the time-slot anti-collision principle. Considering that the drone swarm operates in a lord-wingman mode, with wingmen being legitimate drones already authenticated with the control station, the legitimate control station then sends the shared group key and each wingman's unique identifier to the registered legitimate lord. The lord and wingmen obtain a consistent shared key through the legitimate control station, and the lord obtains the identity information of each wingman, such as... Figure 2 As shown.

[0030] Step 1.1: The control station distributes a shared group key between itself, its wingmen, and the lead aircraft; the lead aircraft and its wingmen then obtain the shared key. The shared key is only possessed by the legitimate lead and wingmen. At the same time, after the registration phase, the wingmen's unique ID is stored on the legitimate lead. The privacy of the unique ID can effectively prevent unauthorized identities from forging messages. Step 1.2: Wingman retrieves the legitimate control station number Response during the authentication process with the control site With the old anonymous number Update and store the wingman's anonymous ID. Send message To the lead aircraft; Step 1.3: After receiving the message, the master unit verifies whether the control station number is valid and stores the response. Using anonymous numbers Find the unique identification number corresponding to the wingman from the numbers sent by the control station. With shared keys Update the wingman's anonymous number The anonymous number of the computing leader ,in Assign a unique serial number to the lead aircraft and send messages to the wingman. ; Step 1.4: After receiving the message, the wingman verifies the anonymous ID. Check if it's correct; if incorrect, pause the authentication process; if correct, store the long-term anonymous ID. .

[0031] Step 2: Initial authentication phase. The lead aircraft and wingman exchange information through a challenge-response mechanism. Two-way authentication is completed by judging whether the response is correct and valid, and a session key is distributed for subsequent communication. Figure 3 As shown.

[0032] Step 2.1: The primary machine obtains the current timestamp. Using timestamps can effectively ensure message real-time performance and prevent replay attacks. Generate random numbers Encrypt it using the shared key on this side to obtain Calculate using the stored unique ID and shared key And calculate the message authentication code. Using message authentication codes can protect message integrity and effectively prevent message tampering, and then send the message to the wingman. ; Step 2.2: After receiving the message, the wingman first checks if the returned anonymous ID is correct. If it is incorrect, the authentication process stops, and then the current timestamp is obtained. ,judge To determine whether the conditions are met, it is necessary to assess whether the message has excessive latency or the possibility of being intercepted and replayed, and to calculate... Determine if the message is incomplete or potentially tampered with, decrypt and store it. ,calculate Judgment and received Does the message validity verification process consistently work? (Wingman calculation) ,calculate Generate message authentication code The wingman then sent a response message to the lead aircraft. ; Step 2.3: After receiving the message, the primary server verifies whether the received primary server ID matches its own. Find the matching wingman's unique ID number With key Get the current timestamp ,calculate ,judge Whether the conditions are met is used to determine if the message has excessive latency or is likely to be intercepted and replayed. To determine if the message is incomplete or potentially tampered with, calculate... Judgment and received The system verifies the validity of the messages. If all messages match, the wingman is considered legitimate, completing the lead aircraft's initial authentication of the wingman. A session key is then selected. This is used for subsequent communication between the wingman and the lead aircraft, and the selected session key is generated using the local key and the stored random number. Encryption obtained ,calculate Calculate message authentication code The lead aircraft then sent a message to the wingman. ; Step 2.4: Upon receiving the message, the wingman first checks if the returned anonymous ID is correct. If it is incorrect, the authentication process is stopped, and then the current timestamp is obtained. ,judge To determine whether the conditions are met, it is necessary to assess whether the message has excessive latency or the possibility of being intercepted and replayed, and to calculate... To determine if the message is incomplete or potentially tampered with, calculate... Judgment and received The system checks whether the message validity is consistent. If all checks are consistent, the primary server is considered legitimate, and the session key is decrypted and stored. The wingman completed the initial authentication of the lead aircraft.

[0033] Step 3: Continuous Authentication Phase. After initial authentication, the drone swarm relies primarily on continuous authentication for flight and mission execution. Continuous authentication follows the initial authentication process and can be viewed as a cyclical process. The lead drone and wingman maintain continuous real-time communication, simultaneously collecting CSI information and using feature extraction methods to obtain wireless composite domain features. The lead drone and wingman interact through a "challenge-response" mechanism, completing bidirectional continuous authentication by judging the correctness and validity of the response, and updating the session key for subsequent communication. Figure 4 As shown.

[0034] Step 3.1: After the wingman and the lead aircraft establish a legitimate network, they continuously communicate in real time through this legitimate network, collect CSI information in real time, and use feature extraction methods to obtain wireless composite domain features; Step 3.2: The wingman updates its local key and random number, sends a continuous authentication request to the lead aircraft, and the wingman uses the stored wireless composite domain feature quantization value. Update local key For simplicity, consider the XOR operation. Update the random number on this side. Get the current timestamp ,calculate Calculate using updated random numbers and keys Generate message authentication code Then a message was sent to the lead aircraft. ; Step 3.3: After receiving the message, the primary machine verifies whether the received primary machine ID matches its own. If they match, then proceed according to... Find the matching wingman's unique ID number With key Get the current timestamp ,calculate ,judge Whether the conditions are met is used to determine if the message has excessive latency or is likely to be intercepted and replayed. To determine whether a message is incomplete or potentially tampered with, the stored wireless composite domain feature quantization value is used. Update local key Update the random number on this side. ,calculate Judgment and received The system checks if the message validity is consistent. If it is consistent, the wingman is considered legitimate, completing the lead aircraft's continuous authentication of the wingman. The local session key is then updated. ,calculate Calculate message authentication code Then send a message To the wingman; Step 3.4: Upon receiving the message, the wingman first checks if the returned anonymous ID is correct. If it is incorrect, the authentication process is stopped, and then the current timestamp is obtained. ,judge To determine whether the conditions are met, it is necessary to assess whether the message has excessive latency or the possibility of being intercepted and replayed, and to calculate... Determine if the message is incomplete or potentially tampered with, and update the local session key. ,calculate Judgment and received The validity of the verification messages is checked. If they are consistent, the lead aircraft is considered a legitimate lead aircraft, and the wingman completes one continuous authentication of the lead aircraft.

[0035] This invention also provides a security authentication system for aerial networked unmanned aerial vehicles (UAVs), such as... Figure 5 As shown, the system includes: a registration module, an initial authentication module, and a continuous authentication module.

[0036] The registration module is used during the registration phase to distribute shared keys to the authenticated wingmen through group key distribution, and then distribute the shared keys and unique number information of each wingman to the authenticated master machine, so that the master machine and wingmen obtain the same shared key; An initial authentication module is used to complete two-way authentication between the lead aircraft and the wingman through a challenge-response mechanism based on a consistent shared key during the initial authentication phase, and to distribute a session key for subsequent communication. The continuous authentication module is used in the continuous authentication phase by which the lead aircraft and wingman use the CSI information collected during the communication process, use feature extraction methods to obtain wireless composite domain features, complete bidirectional continuous authentication through a challenge-response mechanism, and update the session key for subsequent communication processes to achieve continuous secure authentication.

[0037] It is understood that the security authentication system for aerial networked drones provided by the present invention corresponds to the security authentication method for aerial networked drones provided in the foregoing embodiments. The relevant technical features of the security authentication system for aerial networked drones can be referred to the relevant technical features of the security authentication method for aerial networked drones, and will not be repeated here.

[0038] Another object of the present invention is to provide an electronic device, such as... Figure 6 As shown, it includes a memory, a processor, and a computer program stored in the memory and executable on the processor, the processor performing the steps of the security authentication method for aerial networked unmanned aerial vehicles.

[0039] The security authentication method for aerial networked drones includes the following steps: During the registration phase, the legitimate control site distributes shared keys to the certified wingmen through group key distribution, and then distributes the shared keys and unique identification information of each wingman to the certified lead machine. The lead machine and wingmen obtain the same shared key. During the initial authentication phase, the lead aircraft and wingman complete two-way authentication through a challenge-response mechanism based on a consistent shared key, and distribute session keys for subsequent communication. During the continuous authentication phase, the lead aircraft and wingman use the CSI information collected during the communication process to obtain wireless composite domain features using feature extraction methods. They complete two-way continuous authentication through a challenge-response mechanism and update the session key for subsequent communication processes to achieve continuous security authentication.

[0040] A fourth objective of this invention is to provide a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the security authentication method for aerial networked unmanned aerial vehicles.

[0041] The security authentication method for aerial networked drones includes the following steps: During the registration phase, the legitimate control site distributes shared keys to the certified wingmen through group key distribution, and then distributes the shared keys and unique identification information of each wingman to the certified lead machine. The lead machine and wingmen obtain the same shared key. During the initial authentication phase, the lead aircraft and wingman complete two-way authentication through a challenge-response mechanism based on a consistent shared key, and distribute session keys for subsequent communication. During the continuous authentication phase, the lead aircraft and wingman use the CSI information collected during the communication process to obtain wireless composite domain features using feature extraction methods. They complete two-way continuous authentication through a challenge-response mechanism and update the session key for subsequent communication processes to achieve continuous security authentication.

[0042] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0043] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0044] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0045] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0046] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A security authentication method for aerial networked unmanned aerial vehicles (UAVs), characterized in that, It includes the registration phase, the initial certification phase, and the continuous certification phase; During the registration phase, the legitimate control site distributes shared keys to the certified wingmen through group key distribution, and then distributes the shared keys and unique identification information of each wingman to the certified lead machine. The lead machine and wingmen obtain the same shared key. During the initial authentication phase, the lead aircraft and wingman complete two-way authentication through a challenge-response mechanism based on a consistent shared key, and distribute session keys for subsequent communication. During the continuous authentication phase, the lead aircraft and wingman use the CSI information collected during the communication process to obtain wireless composite domain features using feature extraction methods. They complete two-way continuous authentication through a "challenge-response" mechanism and update the session key for subsequent communication processes to achieve continuous security authentication. The lead aircraft's continuous authentication process for its wingman includes: The wingman updates its local key and random number, sends a continuous authentication request to the lead aircraft, updates its local key and random number using the stored wireless composite domain feature quantization value, obtains the current timestamp, calculates and generates a message authentication code using the updated random number and key, and sends the message to the lead aircraft. After receiving a message, the lead aircraft verifies whether the received lead aircraft ID matches its own. If they match, it finds the matching wingman's unique ID and key based on the anonymous ID, obtains the current timestamp, and determines whether the message has excessive delay, the possibility of being intercepted and replayed, or the possibility of the message being incomplete or tampered with. It updates its own key and random number using the stored wireless composite domain feature quantization value, and verifies the validity of the message. If all of these match, the wingman is considered a legitimate wingman, completing the lead aircraft's continuous authentication of the wingman.

2. The security authentication method for aerial networked unmanned aerial vehicles (UAVs) according to claim 1, characterized in that, The process by which a legitimate controlling site distributes a shared key to an authenticated wingman via group key distribution includes: The control station broadcasts a group key distribution command to each registered wingman. After receiving the command, a legitimate wingman that has been authenticated with the control station performs a group key distribution with the control station. The control station then sends the encrypted group key to each wingman in sequence according to the time slot anti-collision principle.

3. The security authentication method for aerial networked unmanned aerial vehicles (UAVs) according to claim 1, characterized in that, The process by which the lead aircraft and wingman obtain a consistent shared key includes: The wingman retrieves the legitimate control station number, the response during the control station authentication process, and the old anonymous number, updates and stores the wingman's anonymous number, and sends a message to the lead aircraft; After receiving the message, the lead aircraft verifies whether the control station number is valid, stores the response, uses the anonymous number to find the unique number and shared key corresponding to the wingman from the numbers sent by the control station, updates the wingman's anonymous number, calculates the lead aircraft's anonymous number, and sends the message to the wingman. After receiving the message, the wingman verifies whether the anonymous ID is correct. If it is incorrect, the authentication process is paused; if it is correct, the wingman's anonymous ID is stored.

4. A security authentication method for aerial networked unmanned aerial vehicles (UAVs) according to claim 1, characterized in that, The challenge-response mechanism between the control station and the drone includes: The lead aircraft obtains the current timestamp, generates a random number, encrypts it using the local shared key, calculates the message authentication code using the stored unique number and the shared key, and sends the challenge to the wingman using the message authentication code; After receiving the message authentication code, the wingman first checks whether the returned anonymous number is correct. If it is incorrect, the authentication process stops. Then, it obtains the current timestamp, determines whether the message has excessive delay, the possibility of being intercepted and replayed, and whether the message is incomplete or tampered with. It decrypts and stores the message, verifies the validity of the message, calculates and generates the message authentication code, and sends the response to the lead aircraft.

5. A security authentication method for aerial networked unmanned aerial vehicles (UAVs) according to claim 1, characterized in that, The initial two-way authentication process between the lead aircraft and the wingman includes: After receiving the response, the lead aircraft verifies whether the received lead aircraft number matches its own, finds the matching wingman's unique number and key based on the anonymous number, obtains the current timestamp, determines whether the message has excessive delay or the possibility of being intercepted and replayed, and whether the message is incomplete or tampered with, and verifies the validity of the message. If all of these match, the wingman is considered a legitimate wingman, and the lead aircraft completes the initial authentication of the wingman. The lead aircraft selects a session key, encrypts the selected session key using its own key and a stored random number, calculates a message authentication code, and sends a message to the wingman using the message authentication code. After receiving the message, the wingman first checks if the returned anonymous number is correct. If it is incorrect, the authentication process stops. Then, it obtains the current timestamp, determines whether the message has excessive delay or is likely to be intercepted and replayed, and whether the message is incomplete or tampered with. It also verifies the validity of the message. If all of these are consistent, the lead aircraft is considered a legitimate lead aircraft. The session key is decrypted and stored, completing the wingman's initial authentication of the lead aircraft.

6. A security authentication method for aerial networked unmanned aerial vehicles (UAVs) according to claim 1, characterized in that, The wingman's continuous authentication process for the lead aircraft includes: The lead aircraft updates its local session key, calculates the message authentication code, and sends the message to the wingman. After receiving the message, the wingman first checks if the returned anonymous number is correct. If it is incorrect, the authentication process stops. Then, it obtains the current timestamp, determines whether the message has excessive delay, the possibility of being intercepted and replayed, or whether the message is incomplete or tampered with. It updates its local session key and verifies the validity of the message. If all of these are consistent, the lead aircraft is considered a legitimate lead aircraft, and the wingman completes the continuous authentication of the lead aircraft.

7. A security authentication system for aerial networked unmanned aerial vehicles (UAVs), characterized in that, The steps for implementing the method according to any one of claims 1 to 6 include: The registration module is used during the registration phase to distribute shared keys to the authenticated wingmen through group key distribution, and then distribute the shared keys and unique number information of each wingman to the authenticated master machine, so that the master machine and wingmen obtain the same shared key; An initial authentication module is used to complete two-way authentication between the lead aircraft and the wingman through a challenge-response mechanism based on a consistent shared key during the initial authentication phase, and to distribute a session key for subsequent communication. The continuous authentication module is used in the continuous authentication phase by which the lead aircraft and the wingman use the CSI information collected during the communication process to obtain the wireless composite domain features using the feature extraction method, complete the two-way continuous authentication through the "challenge-response" mechanism, and update the session key for subsequent communication processes to achieve continuous security authentication.

8. A terminal device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images