Lightweight identity authentication method for unmanned platform decentralized cluster

Abstract

The invention discloses a lightweight identity authentication method for a decentralized cluster of an unmanned platform. The method comprises the following steps: when an unmanned cluster network is established, a head node of each communication cluster in the unmanned cluster network generates a cluster key, and each unmanned platform node of each communication cluster adopts a corresponding cluster key to carry out data encryption transmission on a wireless channel; when the unmanned platform node to be networked joins a corresponding communication cluster in the unmanned cluster network, a network access request message is sent to a head node of the communication cluster, the head node performs identity verification according to the received network access request message, and after the verification is passed, a corresponding cluster key is imported into the current unmanned platform node to be networked in a ciphertext form; and when the unmanned platform node changes, updating the cluster key. Lightweight identity authentication of network access of the unmanned platform is realized, the validity of a certificate is verified without consuming a lot of time, the characteristic of high real-time requirement of the unmanned platform is met, and forward and backward confidentiality is guaranteed.

Description

Technical Field

[0001] This invention relates to the field of unmanned platform security technology, specifically to a lightweight identity authentication method for decentralized clusters of unmanned platforms. Background Technology

[0002] Compared to traditional manned aircraft, unmanned platforms are cheaper, more flexible, and can adapt to various dangerous situations. They can accomplish many tasks that manned aircraft cannot, and have been widely used in both military and civilian fields.

[0003] Decentralized clusters, as a mainstream application scenario for unmanned platforms, consist of a large number of similar or multi-type unmanned platforms that work together to complete specific tasks through mutual perception, information sharing, and autonomous collaboration. Compared to single unmanned platforms or centralized clusters, decentralized clusters, with their advantages of fault tolerance and self-organization, are more suitable for decentralized, dynamically changing distributed scenarios. They can also leverage cluster characteristics to expand their environmental detection and perception capabilities, effectively improving the survivability of unmanned platform systems and achieving resilience and versatility in unmanned platform task execution.

[0004] To control costs or due to a lack of sensitivity to security threats, some manufacturers of existing unmanned platforms for civilian and commercial use have not adopted cryptographic technologies for security protection. Even those manufacturers that do adopt cryptographic technologies generally use international algorithms, have irregular key management, and lack a systematic security protection system, which poses significant security risks.

[0005] Unmanned platforms often have characteristics such as limited computing resources, high real-time requirements, and limited channel transmission bandwidth. In their security system design, such as the number of interactions between the two parties, the complexity of the cryptographic algorithms on which security depends, and protocol compatibility, lightweight design is often required.

[0006] Decentralized clusters of unmanned platforms constantly face network security threats, primarily including replay attacks and identity spoofing attacks, which compromise the confidentiality, integrity, and authenticity of the cluster. The addition of new unmanned platform nodes and the removal of older nodes within the cluster present both forward and backward security threats. Attackers often impersonate legitimate nodes to infiltrate the cluster, hijack unmanned platforms to control ground stations or other unmanned platforms, and ultimately control the entire cluster. Summary of the Invention

[0007] The purpose of this invention is to address the shortcomings of existing technologies by providing a lightweight identity authentication method for decentralized clusters of unmanned platforms.

[0008] To achieve the above objectives, this invention provides a lightweight identity authentication method for decentralized clusters of unmanned platforms, comprising: When the unmanned cluster network is established, a cluster key is generated. Each unmanned platform node in each communication cluster uses the corresponding cluster key to perform encrypted data transmission on the wireless channel. When a node of an unmanned platform to join the network joins the corresponding communication cluster in the unmanned cluster network, it sends a network entry request message to the head node of the communication cluster so that the head node of the communication cluster can authenticate itself according to the received network entry request message, and after the authentication is successful, import the corresponding cluster key into the unmanned platform node to join the network. The cluster key is updated when a node waiting to join the network receives the cluster key or when any unmanned platform node in the unmanned cluster network leaves the communication cluster in the unmanned cluster network.

[0009] Furthermore, the cluster key is generated by the head node of the communication cluster.

[0010] Furthermore, the network access request message includes a timestamp, validity period, and UID information of the unmanned platform node to be accessed.

[0011] Furthermore, the UID information is obtained by the unmanned platform node registering on the unmanned platform.

[0012] Furthermore, a signing private key and an encryption private key are generated in advance by the ground control station based on the UID information of the unmanned platform node, and the signing private key and the encryption private key are sent to the corresponding unmanned platform node for pre-storage. The UID information of the unmanned platform node is sent to the corresponding header node as the signature public key and the encryption public key identifier to form a UID list and store it. The unmanned platform node to be connected to the network uses its signature private key to digitally sign the network access request message and then sends it to the head node of its communication cluster. The head node of the communication cluster determines whether the UID information of the unmanned platform node to be connected to the network is in the UID list. If the UID information of the unmanned platform node to be connected to the network is in the UID list, it uses the signature public key to verify the digital signature of the network access request message. After the verification is successful, the cluster key is encrypted using the encryption public key and then imported into the unmanned platform node to be connected to the network.

[0013] Furthermore, the head node broadcasts a dispersion factor to the other unmanned platform nodes within its communication cluster, enabling the other unmanned platform nodes within the communication cluster to update their cluster keys based on the dispersion factor and the current cluster key.

[0014] Furthermore, the cluster key is updated based on the dispersion factor and the current cluster key as follows: Gkeyy=HMAC_SM3_256(Gkeyx, Dispersion Factor) Where Gkeyy is the updated cluster key, Gkeyx is the current cluster key, and HMAC_SM3_256(.) is the HMAC mode output using the SM3 algorithm, which outputs 256 bits of data.

[0015] Furthermore, after identity verification, the head node uses the UID information of the currently network-connecting unmanned platform node and the SM9 algorithm to encrypt the cluster key with the public key, and then imports the encrypted data into the currently network-connecting unmanned platform node. The currently network-connecting unmanned platform node uses its private key to decrypt and obtain the cluster key.

[0016] Beneficial effects: 1. This invention achieves lightweight identity authentication for unmanned platforms to enter the network based on the SM9 identifier algorithm and IBC technology, without consuming a lot of time to verify the validity of certificates, thus meeting the high real-time requirements of unmanned platforms. 2. When the unmanned platform node within the communication cluster changes, the cluster key is updated synchronously, ensuring forward and backward confidentiality. Attached Figure Description

[0017] Figure 1 This is a diagram illustrating an unmanned platform node applying to join the unmanned cluster network. Figure 2 A diagram illustrating the process of the head node sending the cluster key to the verified unmanned platform node after authentication. Figure 3 This is a diagram illustrating the cluster key update process. Detailed Implementation

[0018] The present invention will be further illustrated below with reference to the accompanying drawings and specific embodiments. These embodiments are implemented based on the technical solutions of the present invention, and it should be understood that these embodiments are only used to illustrate the present invention and are not intended to limit the scope of the present invention.

[0019] like Figures 1 to 3 As shown, this embodiment of the invention provides a lightweight identity authentication method for decentralized clusters of unmanned platforms, including: A cluster key is generated when the unmanned swarm network is established. Each unmanned platform node in each communication cluster uses the corresponding cluster key to encrypt data transmission over the wireless channel. An unmanned swarm network typically includes multiple communication clusters, formed according to the current task allocation. All unmanned platform nodes under each communication cluster are pre-assigned. Each communication cluster has a head node, which is the core control and coordination unit of each communication cluster. Its role spans the entire process of intra-cluster communication management, resource scheduling, data processing, and inter-cluster interaction. The aforementioned cluster key is preferably generated by the head node of the communication cluster when the cluster is established and is updated in real time as the cluster members are dynamically adjusted.

[0020] See Figure 1 When a new unmanned platform node joins a corresponding communication cluster in the unmanned cluster network, it sends a network entry request message to the head node of that communication cluster. The head node then authenticates the node based on the received request and, upon successful authentication, imports the corresponding cluster key into the new node. After successful authentication, the new node is considered a new member of the network. (See also...) Figure 2 To ensure the security of cluster key transmission, the head node uses the UID information of the unmanned platform node to be connected to the network and the SM9 algorithm to encrypt the cluster key with the public key, and then imports the encrypted data into the unmanned platform node to be connected to the network. The unmanned platform node to be connected to the network uses its private key to decrypt and obtain the cluster key.

[0021] The aforementioned network access request message includes a timestamp, validity period, and the UID information of the unmanned platform node to be added to the network. The timestamp represents the time of this task execution, and the validity period represents the duration of this task execution. The UID information is obtained by the unmanned platform node during registration on the unmanned platform. Specifically, the ground control station pre-generates a signing private key and an encryption private key based on the unmanned platform node's UID information, and sends these two keys to the corresponding unmanned platform node for pre-storage. The unmanned platform node's UID information is then sent as the signing public key and encryption public key identifier to the corresponding header node, forming a UID list and storing it. A node seeking to join the network digitally signs its network entry request message using its signature private key and then sends it to the head node of its communication cluster. The head node checks if the node's UID is in its UID list. If so, it verifies the digital signature using its signature public key to determine if the node can join the cluster. If the verification is successful, the cluster key is encrypted using the encryption public key and then imported into the node's network. A node can only join the unmanned cluster network if and only if it possesses the registered UID and private key.

[0022] When a new unmanned platform node receives the cluster key, or when any unmanned platform node leaves the communication cluster of the unmanned platform network, the cluster key is updated. This ensures that newly joined unmanned platform nodes cannot know information before they joined, and that leaving unmanned platform nodes cannot know information after they left, thus satisfying forward and backward confidentiality requirements. For details, see [link to details]. Figure 3When a new unmanned platform node receives the cluster key, or when any unmanned platform node in the unmanned cluster network leaves the communication cluster, the head node broadcasts a dispersion factor to the remaining unmanned platform nodes in its communication cluster. This allows the remaining unmanned platform nodes in the communication cluster to update their cluster keys based on the dispersion factor and the current cluster key. The specific method is as follows: Gkeyy=HMAC_SM3_256(Gkeyx, Dispersion Factor) Where Gkeyy is the updated cluster key, Gkeyx is the current cluster key, and HMAC_SM3_256(.) is the HMAC mode output using the SM3 algorithm, which outputs 256 bits of data.

[0023] It should be noted that, in order to facilitate the storage of cluster keys and private keys in unmanned platform nodes, and the storage of UID lists in head nodes, a storage module needs to be integrated inside the unmanned platform nodes: a secure TF card. Its form factor adopts the TF card interface commonly found in unmanned platform internal components, and data interaction is carried out through the SD protocol. Generally, no hardware modification is required for the unmanned platform, only software adaptation is needed.

[0024] The above description is merely a preferred embodiment of the present invention. It should be noted that for those skilled in the art, other parts not specifically described are existing technology or common knowledge. Several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A lightweight identity authentication method for decentralized clusters of unmanned platforms, characterized in that, include: When the unmanned cluster network is established, a cluster key is generated. Each unmanned platform node in each communication cluster uses the corresponding cluster key to perform encrypted data transmission on the wireless channel. When a node of an unmanned platform to join the network joins the corresponding communication cluster in the unmanned cluster network, it sends a network entry request message to the head node of the communication cluster so that the head node of the communication cluster can authenticate itself according to the received network entry request message, and after the authentication is successful, import the corresponding cluster key into the unmanned platform node to join the network. The cluster key is updated when a node waiting to join the network receives the cluster key or when any unmanned platform node in the unmanned cluster network leaves the communication cluster in the unmanned cluster network.

2. The lightweight identity authentication method for decentralized clusters of unmanned platforms according to claim 1, characterized in that, The cluster key is generated by the head node of the communication cluster.

3. The lightweight identity authentication method for decentralized clusters of unmanned platforms according to claim 1, characterized in that, The network access request message includes a timestamp, validity period, and UID information of the unmanned platform node to be accessed.

4. A lightweight identity authentication method for decentralized clusters of unmanned platforms according to claim 3, characterized in that, The UID information is obtained by the unmanned platform node registering on the unmanned platform.

5. A lightweight identity authentication method for decentralized clusters of unmanned platforms according to claim 3, characterized in that, The ground control station generates a signature private key and an encryption private key in advance based on the UID information of the unmanned platform node, and sends the signature private key and the encryption private key to the corresponding unmanned platform node for pre-storage. The UID information of the unmanned platform node is sent to the corresponding header node as the signature public key and the encryption public key identifier to form a UID list and store it. The unmanned platform node to be connected to the network uses its signature private key to digitally sign the network access request message and then sends it to the head node of its communication cluster. The head node of the communication cluster determines whether the UID information of the unmanned platform node to be connected to the network is in the UID list. If the UID information of the unmanned platform node to be connected to the network is in the UID list, it uses the signature public key to verify the digital signature of the network access request message. After the verification is successful, the cluster key is encrypted using the encryption public key and then imported into the unmanned platform node to be connected to the network.

6. A lightweight identity authentication method for decentralized clusters of unmanned platforms according to claim 1, characterized in that, The head node broadcasts the dispersion factor to the other unmanned platform nodes in its communication cluster, so that the other unmanned platform nodes in the communication cluster can update their cluster keys based on the dispersion factor and the current cluster key.

7. A lightweight identity authentication method for decentralized clusters of unmanned platforms according to claim 6, characterized in that, The cluster key is updated based on the dispersion factor and the current cluster key as follows: Gkeyy=HMAC_SM3_256(Gkeyx, Dispersion Factor) Where Gkeyy is the updated cluster key, Gkeyx is the current cluster key, and HMAC_SM3_256(.) is the HMAC mode output using the SM3 algorithm, which outputs 256 bits of data.

8. A lightweight identity authentication method for decentralized clusters of unmanned platforms according to claim 5, characterized in that, After successful authentication, the head node uses the UID information of the unmanned platform node to be connected to the network and the SM9 algorithm to encrypt the cluster key with the public key, and then imports the encrypted data into the unmanned platform node to be connected to the network. The unmanned platform node to be connected to the network uses its private key to decrypt and obtain the cluster key.

Images