Metadata-based airborne software loading security protection chain method and system

Abstract

The invention discloses a metadata-based airborne software loading security protection chain method and system, and belongs to the technical field of information security. According to the method, security protection is achieved through standardized interaction between physical nodes, and the method comprises the steps that a physical node B receives a transmission message containing an upgrade package mirror image, metadata, a digital certificate and a first digital signature from a physical node A, and verifies the identity and data integrity of the physical node A; then, the physical node B receives and verifies an upgrading request containing the digital certificate and the signed software version list from the physical node C; and after the verification is passed, a response message containing the upgrade package mirror image, the metadata and the authentication information is sent to the physical node C, so that the physical node C completes software upgrade. According to the method, the security verification chain throughout the whole software circulation process is constructed, security threats such as counterfeiting and tampering in the transmission process are effectively defended, and the high reliability of the airborne software upgrading process and the security of the airborne end are ensured.

Description

Technical Field

[0001] This invention belongs to the field of information security technology, specifically relating to a method and system for a security protection chain for airborne software loading based on metadata. Background Technology

[0002] With the rapid development of next-generation aviation technologies and the continuous enhancement of airborne performance and functions, the future aviation field is moving towards a more systematic and intelligent direction, making the need for airborne software upgrades and updates increasingly urgent. Therefore, it is necessary to provide airborne systems with different functions and capabilities based on mission requirements, enabling rapid updates and iterations of airborne capabilities in different scenarios.

[0003] To address these needs, the software center repository retrieves completed software upgrade packages from the application development side. To provide upgrade services to the onboard devices more conveniently, the software center repository distributes the upgrade packages across multiple software loading libraries, allowing onboard devices to directly retrieve the upgrade packages from these libraries. However, during the transmission of these software upgrade packages, each physical node transmits the packages via a wireless network. This makes the upgrade packages vulnerable to various security threats during transmission, such as impersonation attacks, data tampering, and man-in-the-middle attacks. Attackers can attack critical nodes in the upgrade package transmission path or the transmitted software upgrade packages themselves, compromising the correctness and integrity of the upgrade packages and ultimately affecting the security of the onboard devices.

[0004] Based on the above problems, it is necessary to design an airborne software loading security protection method to ensure the correctness and integrity of software upgrade packages and enhance the security and reliability of the airborne end. Summary of the Invention

[0005] To address the problems existing in the prior art, this application provides a method and system for an airborne software loading security protection chain based on metadata. The method ensures the correctness of the software itself through metadata and provides full-process security protection using security technologies. This effectively prevents various security threats to the software upgrade package during transmission, improves the reliability of the software upgrade package, and ensures the security of the airborne terminal.

[0006] This invention is achieved through the following technical solution: A metadata-based airborne software loading security protection chain method includes the following steps: Physical node B receives a transmission message from physical node A. The transmission message includes a software upgrade package image, metadata describing the upgrade package image, a digital certificate of physical node A, and a first digital signature obtained by physical node A signing a first hash value based on its private key. The first hash value is generated based on the metadata and the upgrade package image. Physical node B verifies the received transmission message, and the verification includes: verifying the identity validity of physical node A through the digital certificate and verifying the data integrity through the first digital signature; Physical node B receives an upgrade request from physical node C, the upgrade request including physical node C's digital certificate and a signed list of software versions; Physical node B verifies the upgrade request. After successful verification, it sends a response message to physical node C. The response message includes at least the software upgrade package image, the corresponding metadata, and authentication information for verifying the data source.

[0007] Preferably, the roles of physical node A, physical node B, and physical node C change dynamically; Wherein, physical node A is the application development side, software center library, or software loading library; physical node B is the software center library, software loading library, or airborne terminal; and physical node C is the software loading library or airborne terminal.

[0008] Preferably, verifying the identity of physical node A specifically includes: Verify whether the digital certificate of physical node A is valid; The digital certificate was verified to be not on the certificate revocation list; The authenticity of the digital certificate's signature is verified using the certificate authority's public key.

[0009] Preferably, the step of verifying data integrity through the first digital signature specifically includes: Decrypt the first digital signature using the public key in the digital certificate of physical node A to obtain the first hash value; Based on the received metadata and the upgrade package image, recalculate the hash value; Compare whether the first hash value is consistent with the recalculated hash value.

[0010] Preferably, before physical node B receives the upgrade request from physical node C, the method further includes a metadata reconstruction and forwarding step: After verifying the transmitted message from physical node A, physical node B reconstructs the received metadata and generates verification metadata. Physical node B generates a second digital signature by signing the hash value based on its private key, the hash value being generated based on the verification metadata and the upgrade package image; Physical node B sends the verification metadata, the second digital signature, and the upgrade package image as a new transmission message to the software loading library, which is physical node C.

[0011] Preferably, the reconstructed metadata includes: simplifying the metadata received from physical node A and adding expiration time information for managing the lifecycle of software upgrade packages.

[0012] Preferably, the signed software version list in the upgrade request is a third digital signature obtained by physical node C signing the hash value of the software version list based on its private key. The verification of the upgrade request by physical node B includes: verifying the validity of the digital certificate of physical node C, and verifying the third digital signature.

[0013] Preferably, the physical node C undergoes a software upgrade, including: The authentication information is used to verify the identity and validity of physical node B; Verify the integrity of the received upgrade package image; Verify the key information in the metadata; Determine whether the upgrade package image is within its validity period based on the expiration time in the metadata; If the verification passes and the application has not expired, the upgrade process will be executed.

[0014] Preferably, the method is executed on a complete chain consisting of the application development side, the software center library, the software loading library, and the onboard terminal, wherein: Physical node A is the application development side, physical node B is the software central library, and physical node C is the software loading library; The method also includes a physical node D, wherein the physical node D is an airborne terminal; The upgrade request is sent from physical node D to physical node C; After physical node C verifies the upgrade request, it sends the upgrade package image, metadata, and authentication information to physical node D. Physical node D verifies the received information, and performs a software upgrade after successful verification.

[0015] A metadata-based airborne software loading security protection chain system includes the following steps: The first receiving module is used for physical node B to receive a transmission message from physical node A. The transmission message includes a software upgrade package image, metadata describing the upgrade package image, a digital certificate of physical node A, and a first digital signature obtained by physical node A signing a first hash value based on its private key. The first hash value is generated based on the metadata and the upgrade package image. The second verification module is used by physical node B to verify the received transmission message. The verification includes: verifying the identity validity of physical node A through the digital certificate and verifying the data integrity through the first digital signature. The first receiving module is used for physical node B to receive an upgrade request from physical node C, the upgrade request including physical node C's digital certificate and a signed software version list; The second verification module is used by physical node B to verify the upgrade request. After successful verification, it sends a response message to physical node C. The response message includes at least the software upgrade package image, the corresponding metadata, and authentication information for verifying the data source.

[0016] Compared with the prior art, the present invention has the following beneficial technical effects: This application provides a metadata-based security protection chain method for airborne software loading. It binds the software upgrade package image with metadata describing its key information, combining this with digital certificates and digital signatures to form a complete transmission message, achieving data traceability and anti-counterfeiting from the source. Physical node B first verifies the identity of physical node A through a digital certificate, ensuring the data source is trustworthy, and then verifies data integrity through a first digital signature, effectively resisting the risk of tampering during transmission. For upgrade requests from physical node C, the same digital certificate and signature verification mechanism confirms the legitimacy of the request, preventing malicious requests and unauthorized access. This method, through standardized node interaction and cryptographic verification, forms a security protection chain throughout the entire data transmission chain. It is adaptable to the stringent environmental requirements of airborne scenarios and can flexibly handle the software transfer needs between multiple nodes, significantly reducing security threats such as impersonation attacks and data tampering, providing core technical support for the security and reliability of airborne software upgrades. This application also proposes a metadata-based airborne software loading security protection chain system, an electronic device, and a computer storage medium, which possess all the advantages of the aforementioned metadata-based airborne software loading security protection chain method. Attached Figure Description

[0017] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a flowchart of the method for loading a security protection chain for airborne software based on metadata in an embodiment of the present invention.

[0019] Figure 2 This is a flowchart of the physical node verification process in an embodiment of the present invention. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. The components of the embodiments of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0021] Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely to illustrate selected embodiments of the application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0022] A metadata-based airborne software loading security protection chain method includes the following steps: Physical node B receives a transmission message from physical node A. The transmission message includes a software upgrade package image, metadata describing the upgrade package image, a digital certificate of physical node A, and a first digital signature obtained by physical node A signing a first hash value based on its private key. The first hash value is generated based on the metadata and the upgrade package image. Physical node B verifies the received transmission message, and the verification includes: verifying the identity validity of physical node A through the digital certificate and verifying the data integrity through the first digital signature; Physical node B receives an upgrade request from physical node C, the upgrade request including physical node C's digital certificate and a signed list of software versions; Physical node B verifies the upgrade request. After successful verification, it sends a response message to physical node C. The response message includes at least the software upgrade package image, the corresponding metadata, and authentication information for verifying the data source.

[0023] Physical node A, as the initiator and data source of the secure link, plays a crucial role in generating and reliably distributing software upgrade packages. Based on digital signature technology: First, it calculates a first hash value by combining the software upgrade package image and its metadata. Then, it signs this hash value using its own private key, forming a first digital signature. This process is equivalent to generating a unique and unforgeable "digital fingerprint" and "proof of origin" for the data packet. Finally, it sends the software package, metadata, its own digital certificate, and signature together. The principle is that any recipient can use the public key in its digital certificate to verify the signature, thus confirming that the data has not been tampered with during transmission (integrity) and indeed originated from node A (authenticity).

[0024] Physical node B, acting as the hub and verification relay of the secure link, plays a crucial role as a trusted "security gateway" or "signature verification proxy." It performs bidirectional verification: on one hand, it verifies transmitted messages from node A by checking node A's digital certificate to confirm its legitimacy and by verifying the first digital signature to ensure the integrity of received software packages and metadata. This is achieved by repeatedly performing hash calculations and comparing the result with the hash value obtained from decrypting the signature. On the other hand, it also rigorously verifies the legitimacy of upgrade requests from node C. After successful verification, it is responsible for forwarding secure software packages to the next node. Essentially, its operation involves implementing a strict security policy to ensure that only data that has undergone identity authentication and integrity verification can flow forward in the link.

[0025] Physical node C, as the final requester and upgrade executor in the secure link, plays a crucial role in initiating upgrade requests and securely completing the final deployment. Physical node C proactively sends an upgrade request to node B, including its own digital certificate and a signed list of software versions. This proves the legitimacy of its identity and ensures the clarity and immutability of the requested upgrade content. Upon receiving a response from node B, it further verifies the data source and integrity based on the authentication information in the response (such as node B's digital certificate and signature). This process forms a closed-loop trust chain, ultimately ensuring that the software upgrade package loaded onto its system has been verified and is trustworthy throughout the entire secure link.

[0026] In some embodiments, the roles of physical node A, physical node B, and physical node C change dynamically. Wherein, physical node A is the application development side, software center library, or software loading library; physical node B is the software center library, software loading library, or airborne terminal; and physical node C is the software loading library or airborne terminal.

[0027] Physical node A is the "sender", physical node B is the "verification and forwarding hub", and physical node C is the "receiver and requester". This abstract process can be flexibly embedded into longer software distribution chains.

[0028] For example, when a software central library (as A) distributes software to a software loading library (as B), the software loading library (B) verifies the software central library (A).

[0029] Then, when the software loading library (referred to as A at this time) provides software to the onboard unit (referred to as B at this time), the onboard unit (B) will perform the same verification on the software loading library (A).

[0030] As the optimal implementation, the end-to-end security protection chain from software upgrade package generation to loading is concretized into four entity nodes: Physical Node A (Application Development Side): The source of the software, responsible for generating and signing the initial software package.

[0031] Physical Node B (Software Central Repository): The primary distribution and control center, responsible for verifying the source and reconstructing metadata (such as adding expiration time), and implementing management strategies.

[0032] Physical Node C (Software Loader): An edge service node responsible for storing software and responding to terminal upgrade requests.

[0033] Physical Node D (Airborne): The final software consumer and executor, responsible for initiating requests and completing security upgrades.

[0034] In some embodiments, the physical node B verifies the received transmission message, and the verification includes: verifying the identity validity of the physical node A through the digital certificate and verifying the data integrity through the first digital signature; The verification of the identity validity of physical node A specifically includes: 1. Verify whether the digital certificate of physical node A is valid to ensure that the communication is conducted within the valid lifespan of the certificate and eliminate the security risks that may be caused by the certificate expiration.

[0035] 2. Verify that the digital certificate is not listed in the certificate revocation list; By querying the Certificate Revocation List (CRL) or using the Online Certificate Status Protocol (OCSP), it is possible to proactively confirm whether the Certificate Authority (CA) has prematurely revoked the certificate due to security incidents such as private key leakage or identity change, thereby effectively defending against malicious attacks using expired but not yet expired certificates.

[0036] 3. Use the certificate authority's public key to verify the authenticity of the signature on the digital certificate itself.

[0037] A digital certificate is a data packet signed by a trusted third-party CA using its private key. Node B uses a pre-securely stored, trusted CA root public key to verify the validity of the CA signature on Node A's certificate. If the verification passes, it proves that the certificate content (including Node A's identity and public key) has not been tampered with and was indeed issued by a trusted CA. These three authentication steps together constitute a comprehensive identity authentication system, ensuring that the identity of the communicating peer is trustworthy at any given moment, from time validity and state validity to source authenticity.

[0038] The process of verifying data integrity via the first digital signature specifically includes: 1. Decrypt the first digital signature using the public key in the digital certificate of physical node A to obtain the first hash value; Since the first digital signature was generated using node A's private key, and theoretically only node A holds this private key, successfully decrypting it with its corresponding public key cryptographically proves that the signature was indeed generated by the entity possessing the private key (i.e., node A, which has passed the aforementioned authentication), thus achieving non-repudiation of the action. The "first hash value" obtained after decryption is the integrity check code calculated by node A from the original data (metadata and upgrade package image) when sending it.

[0039] 2. Recalculate the hash value based on the received metadata and the upgrade package image; An independent computation performed locally by the receiver on the same dataset, aimed at obtaining the current state of the data after it has passed through the transmission channel.

[0040] 3. Compare whether the first hash value is consistent with the recalculated hash value.

[0041] The properties of hash functions ensure that any slight modification to the original data will result in a significant change in the calculated hash value. Therefore, if the two are completely consistent, they constitute a strong chain of evidence proving that no bits of the metadata and upgrade package image have changed during the entire transmission process from node A's signature to node B's verification, ensuring the absolute integrity of the data.

[0042] In some embodiments, before physical node B receives an upgrade request from physical node C, the method further includes a metadata reconstruction and forwarding step: After verifying the transmitted message from physical node A, physical node B reconstructs the received metadata and generates verification metadata. Node B can add new control policies during the reconstruction process, the most typical being "expiration time information". This enables the software central repository to uniformly set a global effective usage period for distributed software upgrade packages, realizing proactive management of the software lifecycle, preventing expired software from being improperly loaded, and greatly enhancing the system's security control capabilities.

[0043] Physical node B generates a second digital signature by signing the hash value based on its private key, the hash value being generated based on the verification metadata and the upgrade package image; When a software package verified by Node B is forwarded by Node B, it is tagged with Node B's own digital signature. This means that for downstream Node C, it no longer relies solely on the initial application developer's signature, but trusts Node B's verification result and forwarding behavior. Node B, using its own reputation, guarantees that the software package's origin is trustworthy, its content is complete, and that a new management policy has been attached.

[0044] Physical node B sends the verification metadata, the second digital signature, and the upgrade package image as a new transmission message to the software loading library, which is physical node C.

[0045] Node B combines the reconstructed verification metadata, the second digital signature, and the original upgrade package image into a new, complete, and independently verifiable secure transmission message. This allows the security verification process of this invention to be passed down the chain like a "security relay baton." Upon receiving this message, Node C (the software loader library) will initiate a similar verification process to that of Node B, but the object of verification will be Node B's identity and signature, thus forming a security protection chain.

[0046] In some embodiments, the physical node C undergoes a software upgrade, including: The authentication information is used to verify the identity and validity of physical node B; Physical node C verifies the legitimacy and authenticity of physical node B's digital certificate by parsing and verifying it. This includes checking the certificate's validity period, querying the revocation status list, and verifying the authenticity of the certificate authority's signature. This ensures that the target of the operation is a legitimate entity that has been certified by an authoritative authority, fundamentally defending against man-in-the-middle attacks and the threat of spoofed nodes.

[0047] Verify the integrity of the received upgrade package image to ensure that the data transmission process has not been tampered with.

[0048] Physical node C uses the verified public key of node B to decrypt the digital signature to obtain the original hash value. Simultaneously, it performs local hash calculations on the received verification metadata and upgrade package image, and determines data integrity by rigorously comparing the consistency of the two hash values. This cryptographic verification process provides a tamper-proof guarantee for the software package, ensuring that no data corruption or malicious modification occurs during the entire transmission process from sending to receiving.

[0049] Verify the key information in the metadata to ensure a complete match between the software and the device.

[0050] Key fields such as software name, version number, and applicable platform are extracted from the verification metadata and automatically compared with the device's own upgrade policy list and system configuration. This verification process achieves precise control over "correct software loaded onto the correct device," effectively preventing upgrade failures caused by configuration errors or version incompatibility, and is a crucial step in ensuring system compatibility and stability.

[0051] Determine whether the upgrade package image is within its validity period based on the expiration time in the metadata; If the verification passes and the application has not expired, the upgrade process will be executed.

[0052] The system compares the expiration timestamp in the metadata with the current time of the device's security clock, allowing the process to continue only if the upgrade package is still valid. This mechanism effectively defends against rollback attacks on older software, prevents the malicious exploitation of expired versions with known vulnerabilities, and ensures that packages that have become invalid due to policy updates are not misused. After all security conditions are met, the system enters the final execution phase.

[0053] Example 1 See Figure 1 In this embodiment, the physical nodes include the application development side, the software central library, the software loading library, and the airborne terminal. During the process of generating the airborne software product and transferring it to the airborne terminal, the software upgrade package travels from the application development side to the software central library, then from the software central library to the software loading library. Finally, the software loading library directly provides the software upgrade package to the airborne terminal. To ensure the correctness and integrity of the airborne software during its transfer, the metadata-based airborne software loading security protection chain method of this application is used to ensure the secure and complete transmission of the airborne software product. The core of this method is to support the verification of the correctness of the upgrade package through metadata, and combine it with technologies such as identity authentication and digital signatures to verify the authenticity of the metadata and upgrade package mirror source and the integrity of the data. This ensures the secure transmission of the upgrade package between each physical node, provides end-to-end security protection for the software upgrade package, and guarantees the security and reliability of the airborne terminal.

[0054] Before the security chain is built, each physical node first applies for a digital certificate from a trusted third-party CA using basic information and a key pair. After verifying the information submitted by the node, the CA constructs a digital certificate for it, which mainly includes the node's identity identifier, public key, certificate validity period, issuing CA, and the issuing CA's digital signature.

[0055] A metadata-based airborne software loading security protection chain method includes the following steps: Step 1: The application development side constructs metadata and generates a hash value based on the software upgrade product, generates a digital signature of the hash value based on its private key, and sends the metadata, digital signature sig1, and upgrade package image to the software center library.

[0056] To meet requirements, the application development team constructs metadata for the developed airborne software upgrade package. This metadata includes basic information such as the upgrade package's filename, version number, file size, functional description, and hash value. The hash value is generated by hashing the important metadata information and the upgrade package image, i.e., h1 = Hash(filename||version number||file size||upgrade package image). The metadata also includes technical descriptions such as the software product's encoding method, software dependencies, and operating environment, as well as security information such as the development unit, testing unit, and testing report. To ensure the security of the upgrade package, the application development team signs the hash value h1 based on its private key sk1, using sig1 = Sig(sk1, h1). Finally, the application development team sends the metadata, digital signature, digital certificate, and upgrade package image to the software center repository.

[0057] Step 2: The software center repository will verify the received software upgrade product image as follows: Verify the identity validity of the application developer; Calculate the hash value based on the metadata and upgrade package image, compare the calculated hash value with the hash value in the digital signature, and verify the digital signature based on the comparison result; Verify the integrity of the upgrade package based on the metadata.

[0058] like Figure 2 As shown, this step first verifies the sender's identity and the integrity of the software product and its metadata, and then verifies the correctness and security of the software product, as detailed below. S2.1 The software center library first verifies the validity of the digital certificate, including verifying the certificate's validity period, revocation status, and digital signature in the certificate.

[0059] S2.2 If certificate verification passes, the software center repository extracts the sender's signature from the public key verification message in the certificate. The verification process involves using the public key to decrypt the developer's signature sig1 to obtain the hash value h1. Simultaneously, the application developer recalculates the hash value h1' = Hash(filename||version number||file size||upgrade package image) based on the data in the message. Then, the hash values ​​h1 and h1' are compared for verification. If they match, the signature verification passes.

[0060] The above verification ensures the authenticity of the data source and the integrity of the data.

[0061] S2.3 The software center library checks whether the version, function, test results, etc. of the upgrade package meet the requirements based on the metadata.

[0062] Step 3: The software center library reconstructs the metadata according to the verification requirements of the onboard terminal, generates a new digital signature sig2, and sends the reconstructed metadata, the new digital signature sig2, and the upgrade package image to the software loading library.

[0063] The software center library simplifies the received metadata according to the verification requirements of the onboard terminal, retaining the file name and file size. In order to control the use of upgrade packages, the software center library adds expiration time information and replaces hash values ​​in the metadata to form new metadata.

[0064] Simultaneously, the software central repository generates a new digital signature sig2=Sig(sk2,h2) on the metadata payload based on its private key sk2, where the hash value h2=Hash(filename||version number||file size||expiration time||upgrade package image). Finally, the software central repository sends the metadata, digital signature, digital certificate, and upgrade package image to the software loading library.

[0065] Step 4: The software loads the library and performs local verification of the received message, including: Verify the identity validity of the application developer; Calculate the hash value based on the metadata and upgrade package image, compare the calculated hash value with the hash value in the digital signature sig2, and verify the digital signature sig2 based on the comparison result; Verify the integrity of the upgrade package based on metadata; After successful verification, a new digital signature sig3 is generated.

[0066] First, the software loader verifies the validity period, status, and CA signature of the software central repository's digital certificate to ensure its validity. Then, the software loader uses the public key from the certificate to verify whether the hash value h2 in the digital signature sig2 matches its recalculated hash value h2' = Hash(filename||version number||file size||expiration time||upgrade package image). If the verification passes, the software loader stores the received metadata and software upgrade package image locally and generates a new digital signature sig3 = Sig(sk3, h2) using its private key sk3.

[0067] Step 5: The onboard unit constructs an upgrade request based on the software version list and its digital signature, and sends it to the software loading library to perform the software upgrade.

[0068] The onboard unit sends an upgrade request to the software loading library. The upgrade request includes the onboard unit's digital certificate, software version list, and digital signature of the software version list sig4=Sig(sk4, h3), where the hash value h3 = Hash(software version list).

[0069] Step 6: The software loading library verifies the upgrade request, and sends the software upgrade package image after successful verification; First, the software loading library verifies the digital certificate on the device to ensure its validity; Then, by verifying the digital signature, that is, verifying whether the hash value h3 in the signature is consistent with its recalculated hash value h3'=Hash (software version manifest), the authenticity and integrity of the source of the software version manifest are ensured.

[0070] Finally, if the above verification passes, the software loading library checks and sends the upgrade package image that needs to be updated and the corresponding metadata to the airborne terminal based on the software version list on the airborne terminal, along with the digital certificate of the software loading library and the signature sig3 from step four.

[0071] Step 7: Verify the upgrade package image on the airborne end. After successful verification, upgrade the software.

[0072] First, based on the received message, the onboard unit authenticates the identity of the software library and verifies the integrity and correctness of the upgrade package by verifying the validity period of the software library certificate and the CA signature. Then, verify its digital signature on the metadata, that is, whether the hash value h2 in the digital signature sig3 is consistent with the hash value h2' = Hash(filename||version number||file size||expiration time||upgrade package image) recalculated by the on-board end.

[0073] Finally, the onboard unit checks the filename and version number, and determines whether the upgrade package image is valid based on the expiration time in the metadata. If the upgrade package image is valid, the onboard unit uses the upgrade package image to perform the upgrade operation.

[0074] This metadata-based airborne software loading security protection chain method introduces metadata as a core element describing the software upgrade package. Metadata supports verification of the upgrade package's correctness, and combined with technologies such as identity authentication and digital signatures, it verifies the authenticity of the metadata and upgrade package image source and the integrity of the data. This ensures secure transmission of the upgrade package between physical nodes, safeguarding the security of the airborne software upgrade package at every stage. It effectively prevents various security threats during transmission, improves the reliability of the software upgrade package, and provides end-to-end security protection, ensuring the security and reliability of the airborne end.

[0075] Correspondingly, this application also provides a metadata-based airborne software loading security protection chain system, characterized in that it includes: The first receiving module is used for physical node B to receive a transmission message from physical node A. The transmission message includes a software upgrade package image, metadata describing the upgrade package image, a digital certificate of physical node A, and a first digital signature obtained by physical node A signing a first hash value based on its private key. The first hash value is generated based on the metadata and the upgrade package image. The second verification module is used by physical node B to verify the received transmission message. The verification includes: verifying the identity validity of physical node A through the digital certificate and verifying the data integrity through the first digital signature. The first receiving module is used for physical node B to receive an upgrade request from physical node C, the upgrade request including physical node C's digital certificate and a signed software version list; The second verification module is used by physical node B to verify the upgrade request. After successful verification, it sends a response message to physical node C. The response message includes at least the software upgrade package image, the corresponding metadata, and authentication information for verifying the data source.

[0076] It should be noted that, in the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules may be combined or integrated into another device, or some features may be ignored or not executed. The modules described as separate components may or may not be physically separated. The components shown as modules may be one or more physical units, that is, they may be located in one place or distributed in multiple different places. Some or all of the modules can be selected to achieve the purpose of the solution in this embodiment according to actual needs.

[0077] Furthermore, in the various embodiments of the present invention, the modules can be integrated into one processing unit, or each module can exist physically separately, or two or more modules can be integrated into one unit. The integrated unit described above can be implemented in hardware or as a software functional unit.

[0078] An electronic device provided in this application includes a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, it implements the steps of the metadata-based airborne software loading security protection chain method described in any of the above embodiments.

[0079] Another electronic device provided in this application embodiment may further include: an input port connected to a processor for transmitting multimodal data collected by an external acquisition device to the processor; a display unit connected to the processor for displaying the processor's processing results to the outside world; and a communication module connected to the processor for enabling communication between the electronic device and the outside world. The display unit may be a display panel, a laser scanning display, etc.; the communication method adopted by the communication module includes, but is not limited to, Mobile High Definition Link (HML), Universal Serial Bus (USB), High Definition Multimedia Interface (HDMI), and wireless connection (including Wi-Fi, Bluetooth, Bluetooth Low Energy, and IEEE 802.11s-based communication technology).

[0080] This application provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it implements the steps of the metadata-based airborne software loading security protection chain method described in any of the above embodiments.

[0081] For descriptions of relevant parts of the metadata-based airborne software loading security protection chain system, electronic device, and computer-readable storage medium provided in this application's embodiments, please refer to the detailed descriptions of the corresponding parts in the metadata-based airborne software loading security protection chain method provided in this application's embodiments; they will not be repeated here. Furthermore, parts of the technical solutions provided in this application that are consistent with the implementation principles of corresponding technical solutions in the prior art have not been described in detail to avoid excessive elaboration.

[0082] The above content is only for illustrating the technical concept of the present invention and should not be construed as limiting the scope of protection of the present invention. Any modifications made to the technical solution based on the technical concept proposed in this invention shall fall within the scope of protection of the claims of this invention.

Claims

1. A method for a security protection chain for airborne software loading based on metadata, characterized in that, Includes the following steps: Physical node B receives a transmission message from physical node A. The transmission message includes a software upgrade package image, metadata describing the upgrade package image, a digital certificate of physical node A, and a first digital signature obtained by physical node A signing a first hash value based on its private key. The first hash value is generated based on the metadata and the upgrade package image. Physical node B verifies the received transmission message, and the verification includes: verifying the identity validity of physical node A through the digital certificate and verifying the data integrity through the first digital signature; Physical node B receives an upgrade request from physical node C, the upgrade request including physical node C's digital certificate and a signed list of software versions; Physical node B verifies the upgrade request. After successful verification, it sends a response message to physical node C. The response message includes at least the software upgrade package image, the corresponding metadata, and authentication information for verifying the data source.

2. The method for a metadata-based airborne software loading security protection chain according to claim 1, characterized in that, The roles of physical node A, physical node B, and physical node C change dynamically. Wherein, physical node A is the application development side, software center library, or software loading library; physical node B is the software center library, software loading library, or airborne terminal; and physical node C is the software loading library or airborne terminal.

3. The method for a metadata-based airborne software loading security protection chain according to claim 1, characterized in that, The verification of the identity validity of physical node A specifically includes: Verify whether the digital certificate of physical node A is valid; The digital certificate was verified to be not on the certificate revocation list; The authenticity of the digital certificate's signature is verified using the certificate authority's public key.

4. The method for a metadata-based airborne software loading security protection chain according to claim 1, characterized in that, The process of verifying data integrity via the first digital signature specifically includes: Decrypt the first digital signature using the public key in the digital certificate of physical node A to obtain the first hash value; Based on the received metadata and the upgrade package image, recalculate the hash value; Compare whether the first hash value is consistent with the recalculated hash value.

5. The method according to claim 4, characterized in that, Before physical node B receives the upgrade request from physical node C, the method further includes a metadata reconstruction and forwarding step: After verifying the transmitted message from physical node A, physical node B reconstructs the received metadata and generates verification metadata. Physical node B generates a second digital signature by signing the hash value based on its private key, the hash value being generated based on the verification metadata and the upgrade package image; Physical node B sends the verification metadata, the second digital signature, and the upgrade package image as a new transmission message to the software loading library, which is physical node C.

6. The method for a metadata-based airborne software loading security protection chain according to claim 5, characterized in that, The reconstructed metadata includes: simplifying the metadata received from physical node A and adding expiration time information for managing the lifecycle of software upgrade packages.

7. The method for a metadata-based airborne software loading security protection chain according to claim 1, characterized in that, The signed software version list in the upgrade request is a third digital signature obtained by physical node C signing the hash value of the software version list based on its private key. The verification of the upgrade request by physical node B includes: verifying the validity of the digital certificate of physical node C, and verifying the third digital signature.

8. The method for a metadata-based airborne software loading security protection chain according to claim 1, characterized in that, The physical node C undergoes a software upgrade, including: The authentication information is used to verify the identity and validity of physical node B; Verify the integrity of the received upgrade package image; Verify the key information in the metadata; Determine whether the upgrade package image is within its validity period based on the expiration time in the metadata; If the verification passes and the application has not expired, the upgrade process will be executed.

9. A method for a metadata-based airborne software loading security protection chain according to claim 1, characterized in that, The method is executed on a complete chain consisting of the application development side, the software center library, the software loading library, and the onboard terminal, wherein: Physical node A is the application development side, physical node B is the software central library, and physical node C is the software loading library; The method also includes a physical node D, wherein the physical node D is an airborne terminal; The upgrade request is sent from physical node D to physical node C; After physical node C verifies the upgrade request, it sends the upgrade package image, metadata, and authentication information to physical node D. Physical node D verifies the received information, and performs a software upgrade after successful verification.

10. A metadata-based airborne software loading security protection chain system, characterized in that, Includes the following steps: The first receiving module is used for physical node B to receive a transmission message from physical node A. The transmission message includes a software upgrade package image, metadata describing the upgrade package image, a digital certificate of physical node A, and a first digital signature obtained by physical node A signing a first hash value based on its private key. The first hash value is generated based on the metadata and the upgrade package image. The second verification module is used by physical node B to verify the received transmission message. The verification includes: verifying the identity validity of physical node A through the digital certificate and verifying the data integrity through the first digital signature. The first receiving module is used for physical node B to receive an upgrade request from physical node C, the upgrade request including physical node C's digital certificate and a signed software version list; The second verification module is used by physical node B to verify the upgrade request. After successful verification, it sends a response message to physical node C. The response message includes at least the software upgrade package image, the corresponding metadata, and authentication information for verifying the data source.

Images