Unmanned aerial vehicle airspace management and control method and system, electronic equipment and storage medium

Abstract

The embodiment of the invention provides an unmanned aerial vehicle airspace management and control method and system, electronic equipment and a storage medium, and the method comprises the steps that an unmanned aerial vehicle receives an identity authentication request sent by an airspace management and control center in a management and control airspace; the unmanned aerial vehicle sends a CA authentication request to the airspace management and control center, the CA authentication request carries an SM2 device certificate injected into the unmanned aerial vehicle in advance, and CA authentication is carried out through the airspace management and control center according to the SM2 device certificate; if the CA authentication is passed, allowing the unmanned aerial vehicle to fly in the control airspace, performing key negotiation between the unmanned aerial vehicle and the airspace control center, and receiving an SM9 multicast key issued by the airspace control center; and the unmanned aerial vehicle performs encrypted communication with the airspace management and control center according to the SM9 multicast key.

Description

Technical Field

[0001] This document relates to the field of unmanned aerial vehicle (UAV) safety control technology, and in particular to a UAV airspace management method, system, electronic device and storage medium. Background Technology

[0002] With the widespread application of drones in logistics, surveying, security and other fields, the security threats they face are becoming increasingly severe. Existing drone communication solutions are mostly passive defenses (such as GPS geofencing), lacking active identity authentication and dynamic airspace authorization capabilities, and most do not employ security algorithms, thus failing to comply with Chinese cybersecurity regulations.

[0003] Therefore, the main drawbacks of existing drone communication technologies are as follows: 1. Insufficient communication security: Traditional data / image transmission uses AES or unencrypted protocols, which are easily cracked or injected with false commands. 2. Passive airspace control: Relying on GPS fencing or radio interference, it is impossible to actively verify the legitimacy of the drone's identity. 3. Poor cross-platform collaboration: There is a lack of secure authentication channels with security algorithm support between flight control and monitoring systems. Summary of the Invention

[0004] The purpose of this invention is to provide a method, system, electronic device and storage medium for airspace management of unmanned aerial vehicles (UAVs), aiming to solve the above-mentioned problems in the prior art.

[0005] This invention provides a method for airspace management of unmanned aerial vehicles (UAVs), comprising: The drone receives an identity authentication request sent by the airspace control center while in the controlled airspace; The UAV sends a CA authentication request to the airspace control center, wherein the CA authentication request carries a pre-injected SM2 device certificate of the UAV, and the airspace control center performs CA authentication based on the SM2 device certificate; If CA authentication is successful, the UAV is allowed to fly in the controlled airspace. The UAV negotiates a key with the airspace control center and receives the SM9 multicast key issued by the airspace control center. The UAV communicates with the airspace control center using the SM9 multicast key in encrypted form.

[0006] This invention provides an unmanned aerial vehicle (UAV) airspace management system, comprising: The drone is used to receive an identity authentication request sent to it by the airspace control center in the controlled airspace; send a CA authentication request to the airspace control center, wherein the CA authentication request carries an SM2 device certificate pre-injected into the drone; perform CA authentication through the airspace control center based on the SM2 device certificate; negotiate a key with the airspace control center; receive an SM9 multicast key issued by the airspace control center; and conduct encrypted communication with the airspace control center based on the SM9 multicast key. The airspace control center is used to send an identity authentication request to the drone after detecting the drone in the controlled airspace, receive the CA authentication request sent by the drone, perform CA authentication, and if the CA authentication is successful, allow the drone to fly in the controlled airspace, negotiate keys with the drone, and issue an SM9 multicast key.

[0007] This invention also provides an electronic device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps of the above-described UAV airspace management method.

[0008] This invention also provides a computer-readable storage medium storing an information transmission implementation program, which, when executed by a processor, implements the steps of the above-described UAV airspace management method.

[0009] By employing the embodiments of the present invention, dynamic airspace authorization is achieved through a CA center, replacing traditional geofencing, enabling proactive control, and providing end-to-end security through a full lifecycle safety algorithm protection from production to flight. Attached Figure Description

[0010] To more clearly illustrate the technical solutions in one or more embodiments of this specification or in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0011] Figure 1 This is a flowchart of the UAV airspace management method according to an embodiment of the present invention; Figure 2 This is a schematic diagram of the UAV airspace management method according to an embodiment of the present invention; Figure 3 This is a schematic diagram of an unmanned aerial vehicle (UAV) airspace management system according to an embodiment of the present invention; Figure 4 This is a schematic diagram of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0012] To enable those skilled in the art to better understand the technical solutions in one or more embodiments of this specification, the technical solutions in one or more embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this specification, and not all of the embodiments. Based on one or more embodiments of this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the protection scope of this document.

[0013] Method Implementation Examples According to embodiments of the present invention, a method for UAV airspace management is provided. The technical solution of the present invention provides a method for UAV airspace access and real-time encrypted communication that integrates HarmonyOS distributed capabilities, PX4 flight control and cryptographic algorithms (SM2 / SM3 / SM4), which is applicable to scenarios such as government-regulated airspace and military no-fly zones. Figure 1 This is a flowchart of the UAV airspace management method according to an embodiment of the present invention, such as... Figure 1 As shown, the UAV airspace management method according to an embodiment of the present invention specifically includes: Step S101: The UAV receives an identity authentication request sent to it by the airspace control center in the controlled airspace. In step S102, the UAV sends a CA authentication request to the airspace control center, wherein the CA authentication request carries a pre-injected SM2 device certificate of the UAV, and the airspace control center performs CA authentication based on the SM2 device certificate. In this embodiment of the invention, the UAV has a pre-installed SM2 device certificate in a security chip embedded in the flight control module. The SM2 device certificate is bound to the unique ID of the MCU of the flight control module and the hardware fingerprint of the onboard computer module. The SM2 device certificate specifically includes: a unique device ID, a public key certificate in SM2 / X.509 format, and an SM4 symmetric key for high-speed encryption.

[0014] The technical solution of this invention pre-installs an SM2 device certificate in the security chip and binds it to the unique ID of the flight control MCU and the hardware fingerprint of the HarmonyOS TEE, ensuring that the private key cannot be exported. This covers the key management process in the production stage, preventing competitors from copying the process.

[0015] Step S103: If CA authentication is successful, the UAV is allowed to fly in the controlled airspace. The UAV negotiates a key with the airspace control center and receives the SM9 multicast key issued by the airspace control center. In this embodiment of the invention, an emergency waypoint can be triggered after the key expires.

[0016] If no CA authentication request is received from the drone within the predetermined time, or if the CA authentication fails, the drone is determined to have taken off illegally.

[0017] Step S104: The UAV communicates with the airspace control center using the SM9 multicast key in encrypted form. Specifically, this includes: The UAV acquires raw data from the sensors through the flight control module and encrypts the raw data through a security chip embedded in the flight control module. The encryption key is updated every predetermined time period through SM2 key negotiation. The UAV appends an SM3 hash value to the encrypted data to obtain the final encrypted sensor data. The encrypted sensor data is then sent to the onboard computer module via UART / Ethernet and transmitted to the airspace control center via SoftBus.

[0018] It should be noted that, in this embodiment of the invention, the airborne computer module is a HarmonyOS airborne computer module. The security chip is coupled to the flight controller via the SPI bus and is independent of the HarmonyOS TEE environment.

[0019] The technical solution of this invention embeds a security chip (such as SJT1007) in the PX4 flight controller, hardware-accelerating the SM2 / SM3 / SM4 algorithms to solve the problem of insufficient computing power in traditional flight controllers. It achieves real-time encryption (latency <5ms) in resource-constrained environments, unlike purely software encryption schemes. The SM2 device certificate is triple-bound with the flight controller MCU's unique ID and the HarmonyOS TEE fingerprint to prevent cloning. This ensures the uniqueness of the UAV's identity and prevents counterfeit devices from accessing the airspace system. This invention employs a dynamic airspace CA authentication mechanism. When a UAV enters controlled airspace, it obtains temporary flight permissions through SM2 two-way authentication + SM9 multicast key distribution, replacing traditional GPS fencing and achieving proactive, traceable dynamic airspace control.

[0020] The technical solutions of the embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0021] like Figure 2 As shown, when a drone takes off from a controlled airspace, the airspace control system detects the drone and proactively sends an authentication request. If the drone fails to send an authentication request in a timely manner, the airspace control system determines that the drone has taken off illegally and will take appropriate emergency measures. If the drone sends a CA authentication request and the airspace control center authenticates it, the drone is allowed to fly in that airspace. Subsequent communication between the airspace control system and the drone will use a negotiated key for encrypted communication.

[0022] After verifying the validity of the certificate and airspace permissions, the airspace control center issues a temporary airspace key, namely the SM9 multicast key. Using the SM9 multicast key, the following communications can be initiated: 1. Encryption of image / data transmission: The video stream is encrypted using SM4-GCM mode, where the encryption key is updated every 30 seconds via SM2 key negotiation.

[0023] HarmonyOS SoftBus manages encrypted channels and supports secure networking of multiple devices (such as ground stations and other drones).

[0024] 2. Data integrity verification: All MAVLink commands are appended with an SM3 hash value, and the flight control module rejects unsigned data.

[0025] 3. The data stream during the drone's flight is as follows: Sensor data → PX4 flight controller (raw data) → Security chip encryption (SM4-CTR) → Data with SM hash value attached → Transmitted to HarmonyOS onboard computer via UART / Ethernet port → Distributed to other devices via HarmonyOS SoftBus (e.g., encrypted image transmission to ground station).

[0026] To achieve the above functions, the following hardware requirements apply to the drone: 1. PX4 flight control module and security chip, used for flight control and underlying encryption execution. The main flight controller is the PX4 flight control module: PX4 (such as the STM32F7 used in Pixhawk 4) is responsible for real-time tasks such as sensor fusion and attitude control. Security chip: ATECC608A, which connects to PX4 via I2C / SPI and is used for key storage (preventing physical extraction), security algorithm acceleration (hardware calculation of SM4 / SM3), and secure boot verification (preventing firmware tampering).

[0027] 2. The onboard computer running HarmonyOS is used for high-level security decisions and distributed collaboration, communicating with the PX4 flight controller via UART / CAN or high-speed USB. HarmonyOS's HDF (Hardware Driver Framework) encapsulates flight control communication and provides standardized security APIs.

[0028] SM2 device certificate generation and injection: 1. Generation method: The SM2 device certificate is issued by an enterprise-level PKI system (or a compliant CA institution). The SM2 device certificate includes: a unique device ID (such as SN number), a public key certificate (SM2 / X.509 format), and a symmetric key (SM4, used for high-speed encryption).

[0029] 2. Injection Method: Operate in a secure, isolated production line environment (to prevent bypass attacks), using a programmer provided by the chip manufacturer (such as Microchip's CryptoAuthLib toolchain) to write the certificate via a physical interface (SWD / JTAG). Direct transmission via a standard USB interface is prohibited.

[0030] 3. SM2 Device Certificate Binding: Associate the certificate with the following hardware features: the unique ID of the PX4 flight controller's MCU (such as the 96-bit UID of STM32), and the TEE hardware fingerprint of the HarmonyOS onboard computer (such as the Huawei HiChain ID); write the binding relationship into the secure storage area of ​​the security chip for bidirectional verification during subsequent communication.

[0031] In summary, the technical solution of this invention implements dynamic airspace authorization through a CA center, replacing traditional geofencing. It provides end-to-end security protection through a full lifecycle security algorithm from production to flight.

[0032] Device Example 1 According to embodiments of the present invention, an airspace management system for unmanned aerial vehicles (UAVs) is provided. Figure 3 This is a schematic diagram of an unmanned aerial vehicle (UAV) airspace management system according to an embodiment of the present invention, such as... Figure 3 As shown, the unmanned aerial vehicle (UAV) airspace management system according to an embodiment of the present invention specifically includes: The drone 10 is used to receive an authentication request sent to it by an airspace control center in the controlled airspace; send a CA authentication request to the airspace control center, wherein the CA authentication request carries an SM2 device certificate pre-injected into the drone; perform CA authentication with the airspace control center based on the SM2 device certificate; negotiate a key with the airspace control center; receive an SM9 multicast key issued by the airspace control center; and conduct encrypted communication with the airspace control center based on the SM9 multicast key. The drone 10 specifically includes: The injection module is used to pre-install an SM2 device certificate in the security chip embedded in the flight control module. The SM2 device certificate is bound to the unique ID of the MCU of the flight control module and the hardware fingerprint of the airborne computer module. The SM2 device certificate specifically includes: a unique device ID, a public key certificate in SM2 / X.509 format, and an SM4 symmetric key for high-speed encryption.

[0033] The flight control module is used to acquire raw data from the sensors; A security chip, embedded in the flight control module and coupled to the flight control module via an SPI bus, is used to encrypt the raw data. The encryption key is updated every predetermined time through SM2 key negotiation. An SM3 hash value is appended to the encrypted data to obtain the final encrypted sensor data. The encrypted sensor data is then sent to the onboard computer module via UART / Ethernet. An onboard computer module, connected to the flight control module, is used to transmit encrypted sensor data to the airspace control center via SoftBus.

[0034] Airspace control center 12 is used to send an authentication request to the drone after detecting the drone in the controlled airspace, receive the CA authentication request sent by the drone, perform CA authentication, and if the CA authentication is successful, allow the drone to fly in the controlled airspace, negotiate a key with the drone, and issue an SM9 multicast key. The airspace control center 12 is further used to: if it does not receive the CA authentication request from the drone within a predetermined time, or if the CA authentication fails, determine that the drone has taken off illegally and perform emergency handling for the drone.

[0035] The embodiments of the present invention are device embodiments corresponding to the above method embodiments. The specific operation of each module can be understood with reference to the description of the method embodiments, and will not be repeated here.

[0036] Device Example 2 This invention provides an electronic device, such as... Figure 4 As shown, it includes: a memory 40, a processor 42, and a computer program stored in the memory 40 and executable on the processor 42, wherein the computer program, when executed by the processor 42, performs the steps as described in the method embodiment.

[0037] Device Example 3 This invention provides a computer-readable storage medium storing an information transmission implementation program, which, when executed by a processor 42, performs the steps described in the method embodiment.

[0038] The computer-readable storage media described in this embodiment include, but are not limited to, ROM, RAM, disk, or optical disk.

[0039] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for airspace management and control of unmanned aerial vehicles (UAVs), characterized in that, include: The drone receives an identity authentication request sent by the airspace control center while in the controlled airspace; The UAV sends a CA authentication request to the airspace control center, wherein the CA authentication request carries a pre-injected SM2 device certificate of the UAV, and the airspace control center performs CA authentication based on the SM2 device certificate; If CA authentication is successful, the UAV is allowed to fly in the controlled airspace. The UAV negotiates a key with the airspace control center and receives the SM9 multicast key issued by the airspace control center. The UAV communicates with the airspace control center using the SM9 multicast key in encrypted form.

2. The method according to claim 1, characterized in that, The method further includes: If no CA authentication request is received from the drone within the predetermined time, or if the CA authentication fails, the drone is determined to have taken off illegally.

3. The method according to claim 1, characterized in that, The method further includes: The UAV has a pre-installed SM2 device certificate in a security chip embedded in the flight control module. The SM2 device certificate is bound to the unique ID of the MCU of the flight control module and the hardware fingerprint of the onboard computer module. The SM2 device certificate specifically includes: a unique device ID, a public key certificate in SM2 / X.509 format, and an SM4 symmetric key for high-speed encryption.

4. The method according to claim 3, characterized in that, The encrypted communication between the UAV and the airspace control center based on the SM9 multicast key specifically includes: The UAV acquires raw data from the sensors through the flight control module and encrypts the raw data through a security chip embedded in the flight control module. The encryption key is updated every predetermined time period through SM2 key negotiation. The UAV appends an SM3 hash value to the encrypted data to obtain the final encrypted sensor data. The encrypted sensor data is then sent to the onboard computer module via UART / Ethernet and transmitted to the airspace control center via SoftBus.

5. A drone airspace management system, characterized in that, include: The drone is used to receive authentication requests sent to it by the airspace control center in the controlled airspace. Send a CA authentication request to the airspace control center, wherein the CA authentication request carries a pre-injected SM2 device certificate of the UAV, and the airspace control center performs CA authentication based on the SM2 device certificate, performs key negotiation with the airspace control center, receives the SM9 multicast key issued by the airspace control center, and performs encrypted communication with the airspace control center based on the SM9 multicast key; The airspace control center is used to send an identity authentication request to the drone after detecting the drone in the controlled airspace, receive the CA authentication request sent by the drone, perform CA authentication, and if the CA authentication is successful, allow the drone to fly in the controlled airspace, negotiate keys with the drone, and issue an SM9 multicast key.

6. The system according to claim 5, characterized in that, The airspace control center is further configured to: if it does not receive a CA authentication request from the UAV within a predetermined time, or if the CA authentication fails, determine that the UAV has taken off illegally and perform emergency procedures on the UAV.

7. The system according to claim 5, characterized in that, The drone specifically includes: The injection module is used to pre-install an SM2 device certificate in the security chip embedded in the flight control module. The SM2 device certificate is bound to the unique ID of the MCU of the flight control module and the hardware fingerprint of the onboard computer module. The SM2 device certificate specifically includes: a unique device ID, a public key certificate in SM2 / X.509 format, and an SM4 symmetric key for high-speed encryption.

8. The system according to claim 7, characterized in that, The drone specifically includes: The flight control module is used to acquire raw data from the sensors; A security chip, embedded in the flight control module and coupled to the flight control module via an SPI bus, is used to encrypt the raw data. The encryption key is updated every predetermined time through SM2 key negotiation. An SM3 hash value is appended to the encrypted data to obtain the final encrypted sensor data. The encrypted sensor data is then sent to the onboard computer module via UART / Ethernet. An onboard computer module, connected to the flight control module, is used to transmit encrypted sensor data to the airspace control center via SoftBus.

9. An electronic device, characterized in that, include: The memory, the processor, and the computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps of the unmanned aerial vehicle airspace management method as described in any one of claims 1 to 4.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores an information transmission implementation program, which, when executed by a processor, implements the steps of the UAV airspace management method as described in any one of claims 1 to 4.

Images