Unmanned aerial vehicle authentication and key negotiation system and method based on PUF and chaotic mapping

Abstract

The invention discloses an unmanned aerial vehicle authentication and key negotiation system and method based on PUF and chaotic mapping, and relates to the field of information security and cryptographic protocol security. The system generates a unique challenge-response pair through an unmanned aerial vehicle terminal PUF module to complete registration, a four-way handshake mechanism is adopted in the authentication stage, a session key is dynamically generated in combination with Henon chaotic mapping, the number of chaotic iterations is hidden through XOR operation, and identity legality is guaranteed through multi-layer MAC verification. According to the method, secret keys do not need to be pre-stored, the PUF physical unclonability and the chaotic mapping sensitivity are utilized, anonymous authentication and forward security are achieved, lightweight computing adapts to unmanned aerial vehicle resource constraints, various attacks are effectively resisted, and communication security is guaranteed.

Description

A UAV authentication and key negotiation system and method based on PUF and chaotic mapping. Technical Field

[0001] This invention relates to the fields of information security and cryptographic protocol technology, specifically to a UAV authentication and key negotiation system and method based on PUF and chaotic mapping. Background Technology

[0002] With the rapid popularization of drone technology, its role in various fields is becoming increasingly crucial. However, drones rely on open wireless channels for communication, and their own hardware computing power and energy supply are constrained, leading to severe security challenges.

[0003] Existing drone authentication and key negotiation technologies face numerous unresolved issues: Traditional authentication protocols heavily rely on pre-stored keys for security; if a drone is physically captured, the keys are easily leaked, leading to the breakdown of the entire communication system. Some protocols employ public-key cryptography, which provides some security but suffers from high computational complexity and consumes significant hardware resources, making it unsuitable for the lightweight application scenarios of drones. Most protocols lack anonymity protection, making it easy for the drone's true identity to be stolen during transmission, resulting in device tracking and location. Furthermore, existing technologies generally lack forward security guarantees; even if the current communication remains unbroken, historical session keys can be deduced due to subsequent information leaks. In addition, defense mechanisms against replay attacks and man-in-the-middle attacks are inadequate, allowing attackers to intercept and tamper with communication data for unauthorized access or information theft.

[0004] Physically unclonable functions generate unique responses based on microscopic differences in hardware, possessing anti-cloning and anti-predictability characteristics. Chaotic mappings, on the other hand, exhibit determinism, pseudo-randomness, and sensitivity to initial conditions. Both demonstrate significant advantages in lightweight security authentication. However, current technologies have not fully integrated the two deeply, failing to form a complete solution that balances security, lightweight design, anonymity, and forward security, making it difficult to meet the complex security requirements of UAV communication. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides a UAV authentication and key negotiation system and method based on PUF and chaotic mapping, which solves the problems mentioned in the background.

[0006] To achieve the above objectives, the present invention is implemented through the following technical solution: a UAV authentication and key negotiation system based on PUF and chaotic mapping, including a UAV terminal and a ground station terminal;

[0007] The UAV terminal integrates a physically unclonable function module, a random number generation module, a hash operation module, a symmetric encryption module, a registration module, an authentication response module, and a chaotic key generation module; the ground station terminal deploys a secure database module, a registration receiving module, an authentication challenge module, a chaotic key verification module, and a message verification module.

[0008] The UAV terminal and the ground station terminal interact with each other via a wireless channel. The registration module and the registration receiving module complete the registration and storage of challenge-response pairs. The authentication response module, the authentication challenge module, the chaotic key generation module, and the chaotic key verification module realize two-way authentication and session key negotiation.

[0009] Optionally, the PUF module is of the SRAMPUF or Arbitrator PUF type, used to receive random challenge values ​​and output a unique hardware response;

[0010] The random number generation module is a cryptographically secure random number generator used to generate one-time random numbers. and the number of iterations of the chaotic mapping ,in All are 128-bit random numbers. The value range is [100, 1000].

[0011] Optionally, the hash operation module uses the SHA-256 hash function to calculate the message authentication code and key derivative value; the symmetric encryption module uses the AES-128 encryption algorithm for subsequent communication data encryption; and the secure database module is an encrypted SQL database that uses the drone's identity identifier as an index to securely store the corresponding CRP set. The database is configured with an access control mechanism, allowing only authorized modules to read the data.

[0012] Optionally, the chaotic key generation module is used to map the PUF response to the initial point of the chaotic system and perform Henon mapping iteration to generate a chaotic key; the parameters of the Henon mapping are set to... The iterative process satisfies the formula:

[0013]

[0014]

[0015] in For the number of iterations, For the first The state value of the next iteration.

[0016] Optionally, the chaotic key generation module further includes an initial point mapping unit and a normalization unit; the initial point mapping unit will generate the PUF response. Convert to the initial point of a chaotic system During the conversion process Perform numerical standardization to ensure , The range of values ​​satisfies the iterative requirements of the Henon mapping; the normalization unit represents the final state of the Henon mapping. Normalization is performed to generate a fixed-length chaotic key. .

[0017] Optionally, the authentication response module includes a random number freshness check unit and a MAC verification unit; the random number freshness check unit is used to verify the random number sent by the ground station. Is it a recent, unused value? The MAC verification unit calculates the local MAC value and compares it with the received MAC value, specifically including calculation... and the received Perform consistency verification.

[0018] Optionally, the chaotic key verification module includes an iteration count restoration unit and a chaotic synchronization calculation unit; the iteration count restoration unit performs an XOR operation. Restore the number of chaotic iterations, where , The encrypted message containing the hidden iteration count is sent from the drone; the chaotic synchronization computation unit uses the restored... and database storage Perform Henon mapping iterations consistent with those on the drone side to generate a chaotic key for verification. .

[0019] A method for a drone authentication and key negotiation system based on PUF and chaotic mapping includes a registration phase and an authentication and key negotiation phase. The registration phase completes the generation and storage of CRP sets in a secure and trusted environment, and the authentication and key negotiation phase achieves two-way authentication and session key generation through four message interactions.

[0020] Optionally, the registration phase specifically includes the following steps:

[0021] (1) The UAV terminal generates a cryptographically secure random number generator. A set of 128 distinct random numbers constitutes the challenge set. ,in The preset positive integer;

[0022] (2) Each challenge Enter the PUF module sequentially to obtain the corresponding unique response. ,generate A set of challenge-response pairs constitutes the CRP set. ;

[0023] (3) The UAV will package its unique identifier ID with the complete CRP set and send it to the ground station through physical isolation or a secure channel;

[0024] (4) After receiving the data, the registration and receiving module at the ground station creates an entry for the UAV in the security database and stores the CRP set encrypted with the ID as the index. ;

[0025] (5) The drone securely stores its own identity ID locally and destroys temporary data during transmission to reduce the risk of leakage.

[0026] Optionally, the authentication and key negotiation phase specifically includes the following steps:

[0027] (1) Generating a one-time random number on the UAV end The message authentication code is calculated using the SHA-256 hash function. , will message The data is transmitted to the ground station via a wireless channel, and error correction codes are added during transmission to improve reliability.

[0028] (2) Ground station receiving Then, check via random number cache. The system checks for freshness; if a request is duplicated, it rejects it. It then iterates through the database entries and calculates... and the received Compare and determine the matching drone ID; based on the LRU policy, retrieve the drone's ID from its database. Select unused challenge-response pairs Generate one-time random numbers ,calculate Send message To the drone end;

[0029] (3) Inspection of drone terminals Freshness, calculation and If the comparison fails and verification fails, the agreement will be terminated. Input the PUF module to get the response ; Generate iteration count and random numbers ,Will Mapped to the initial point of chaos ,implement The final state is obtained through the next iteration of the Henon mapping. After normalization, the generated ;calculate and session key ; via XOR operation Hiding the number of iterations, calculation Send message To the ground station end;

[0030] (4) Ground station inspection The freshness, utilizing database storage calculate ,pass Restore the number of iterations; use and Perform synchronous Henon mapping iteration to generate ;calculate If with If the keys match, authentication is successful; both parties confirm the session key. It is used for subsequent AES-128 encrypted communication; the session key is updated periodically, and the CRP set is rotated by the ground station. The UAV generates a new CRP set and completes secure registration.

[0031] This invention provides a UAV authentication and key negotiation system and method based on PUF and chaotic mapping, which has the following beneficial effects:

[0032] First, this invention uses a PUF module to deeply bind the drone's identity to the hardware. The CRP set is transmitted and encrypted only during the registration phase. No keys need to be pre-stored during subsequent authentication. Even if the drone is physically captured, attackers cannot obtain the core security credentials, thus fundamentally resisting the risks of physical capture attacks and key leakage. At the same time, the physical non-cloning property of PUF ensures that the response of each drone is unique, effectively preventing device impersonation and identity forgery attacks and ensuring the reliability of identity authentication.

[0033] Secondly, the dynamic generation and forward security of the session key are achieved through chaotic mapping technology. Henon mapping is used as the core of chaos, and its extreme sensitivity to initial conditions makes it impossible for attackers to reverse deduce the historical session key even if the CRP set is leaked in the future. The session key is generated by PUF dynamic response, random number and chaotic iteration. A brand new key is generated for each communication, and the number of iterations is hidden by XOR operation, which further improves the randomness and security of key generation.

[0034] Furthermore, during the authentication process, the drone's true identity ID is never transmitted in plaintext over the wireless channel; all authentication is performed through a temporarily generated ID. The value and random number are completed, which effectively avoids the risk of device tracking caused by ID theft and meets the privacy protection needs of drones in sensitive scenarios;

[0035] Meanwhile, the present invention adopts a lightweight computing architecture, which is perfectly adapted to the resource constraints of drones; the core operation of the protocol only includes hash operation, symmetric encryption and chaotic mapping iteration, avoiding complex public key cryptography operations. The selection of SHA-256 and AES-128 algorithms takes into account both security and computational efficiency. The number of iterations of Henon mapping can be flexibly adjusted according to the hardware performance of the drone, ensuring efficient authentication under limited computing resources.

[0036] Furthermore, the freshness of random numbers is ensured through a cryptographically secure random number generator, effectively resisting replay attacks; through multiple layers... Verification mechanism Two-way authentication is implemented to resist man-in-the-middle attacks; error correction codes are added to improve data transmission reliability; the LRU policy is used to manage the CRP set to avoid reuse; and the session key is updated regularly and the CRP set is rotated to further reduce security risks, forming a comprehensive attack defense capability.

[0037] Finally, the present invention has low implementation cost and strong compatibility. The drone terminal only needs to integrate a low-cost PUF module, and the ground station terminal can realize the core functions through software modules. No large-scale hardware upgrades are required. It can be adapted to various existing drone platforms and multiple communication channels such as 4G / 5G and dedicated radio frequency, and has a wide range of application scenarios and promotional value. Attached Figure Description

[0038] Figure 1 is a schematic diagram of the system flow of the invention;

[0039] Figure 2 is a flowchart of the steps of this invention. Detailed Implementation

[0040] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments.

[0041] This invention discloses a UAV authentication and key negotiation system and method based on PUF and chaotic mapping, which aims to solve the problem of secure communication between UAVs and ground stations, including the UAV end and the ground station end;

[0042] The UAV terminal integrates a Physically Unclonable Function (PUF) module, a random number generation module, a hash operation module, a symmetric encryption module, a registration module, an authentication response module, and a chaotic key generation module; the ground station terminal deploys a secure database module, a registration receiving module, an authentication challenge module, a chaotic key verification module, and a message verification module.

[0043] The configuration of the unmanned aerial vehicle (UAV) is as follows:

[0044] At the hardware level, the drone needs to integrate a Physically Unclonable Function (PUF) module, preferably SRAMPUF or Arbitrator PUF type. These PUF modules generate unique responses based on microscopic differences in the hardware manufacturing process, and have low cost and low power consumption characteristics, adapting to the resource constraints of the drone; it should be equipped with a high-performance microcontroller; configured with a Cryptographically Secure Random Number Generator (CSPRNG) to ensure that the generated random numbers have high randomness and unpredictability, used to generate challenge values, one-time random numbers, and chaotic mapping iterations; and set up a secure storage unit, using an encrypted flash memory module, to locally and securely store the drone's unique identification (ID) to prevent the ID from being read illegally.

[0045] At the software level, the UAV terminal needs to implement the program development of core functional modules: the hash operation module calls the SHA-256 algorithm library to calculate the Message Authentication Code (MAC) and key derivative values; the symmetric encryption module integrates the AES-128 encryption and decryption algorithm for data transmission encryption after successful authentication; the PUF driver module implements control over the PUF hardware, supports inputting challenge values ​​into the PUF and reading response results; the chaos calculation module encapsulates the Henon mapping algorithm to implement initial point mapping, iterative calculation, and normalization processing; the communication module adopts a wireless communication protocol stack, supports data transmission over 4G / 5G or dedicated radio frequency channels, and integrates error correction code (ECC) encoding function to improve the reliability of data transmission.

[0046] The ground station (GS) configuration is as follows:

[0047] On the hardware side, the ground station is equipped with high-performance servers, multi-core processors and large-capacity memory to meet the needs of processing authentication requests from multiple drones in parallel; it also deploys an encrypted SQL database server; and it is equipped with wireless communication transceivers that are compatible with the communication modules on the drone side to ensure stable transmission of the wireless channel.

[0048] At the software level, the ground station develops the following functional modules: a secure database management module, which implements encrypted storage, index management, and access control of UAV IDs and CRP sets, allowing only authorized authentication modules to read the database content; a registration receiving module, which receives registration data sent by the UAV, verifies data integrity, and creates database entries; an authentication challenge module, which performs random number freshness checks, MAC verification, CRP selection, and challenge message generation; a chaotic key verification module, which reproduces the chaotic computation process on the UAV side, including iteration count restoration, Henon mapping synchronous iteration, and key verification; and a message verification module, which receives authentication messages sent by the UAV, performs random number freshness checks and MAC consistency checks, and records verification logs.

[0049] During the registration phase, data transmission must be conducted through a physically isolated environment or a secure channel; during the authentication and key negotiation phases, 4G / 5G public networks or dedicated radio frequency channels can be used. All transmitted messages are sent through wireless channels, and channel coding and interference suppression technologies are enabled during transmission to reduce the risk of data loss and eavesdropping.

[0050] The registration phase is performed when the drone leaves the factory or is deployed for the first time, ensuring the secure generation, transmission, and storage of CRP sets. The specific steps are as follows:

[0051] (1) The random number generation module (CSPRNG) on the UAV generates 100 different 128-bit random numbers to form the challenge set. During the generation process, environmental noise is collected through a hardware entropy source to ensure the uniqueness and randomness of each challenge value;

[0052] (2) The PUF driver module on the UAV side sequentially assigns each challenge The input is given to the PUF module, which detects differences in the internal microstructure of the hardware and outputs a unique response accordingly. Each response is also 128 bits, thus generating 100 challenge-response pairs (CRPs), forming a CRP set. ;

[0053] (3) The registration module on the UAV end packages its own unique identity ID (preset as a 64-bit binary number) with the complete CRP set and sends it to the ground station through a physically isolated wired channel or encrypted VPN tunnel;

[0054] (4) After receiving the data, the registration receiving module at the ground station first verifies the integrity of the data packet through hash verification to confirm that the data has not been tampered with; then it creates a new entry for the UAV in the security database, using the ID as the index, and uses the AES-256 encryption algorithm to encrypt and store the CRP set, and configures an access control policy so that only the authentication challenge module and the chaos key verification module can access the entry data.

[0055] (5) The UAV encrypts and stores its own ID in a local secure storage unit, and immediately destroys the temporary data generated during transmission (including temporary cache of challenge values ​​and transmission copies of CRP sets) to avoid security risks caused by temporary data leakage.

[0056] The authentication and key negotiation phase is implemented as follows: When the UAV needs to establish secure communication with the ground station, the authentication and key negotiation phase is initiated. Two-way authentication and session key generation are achieved through four message exchanges. The specific implementation steps are as follows:

[0057] Step 1: Access Request (UAV→GS), details are as follows:

[0058] (1) The random number generation module on the UAV generates a 128-bit one-time random number. This random number is only used for this authentication session and will be discarded immediately after use;

[0059] (2) The hash operation module calls the SHA-256 algorithm to calculate the message authentication code. ,in" " indicates a string concatenation operation, that is, the ID and The binary data is concatenated from beginning to end and then input into the hash function;

[0060] (3) The communication module will send the message Encapsulated into data frames, with error correction codes added, the data frames are transmitted to the ground station via 4G / 5G wireless channels. During transmission, the data frames are identified by frame sequence numbers to prevent message order disruption.

[0061] Step 2: Challenge Issuance (GS→UAV), details are as follows:

[0062] (1) The communication module at the ground station receives Then, error correction is performed using error correction codes to ensure data integrity; the message verification module extracts... Query the locally maintained random number cache (which caches random numbers from the most recent 1000 authentication sessions) and check. If the request has been used before, and a duplicate is found, it is considered an illegal request, subsequent operations are rejected, and an alarm log is recorded.

[0063] (2) The authentication challenge module iterates through all drone IDs in the security database and calculates the authentication challenge for each ID. The calculation result will be compared with the received data. By comparing each character, a matching ID is found, thereby confirming the identity of the drone that initiated the request;

[0064] (3) The authentication challenge module selects an unused challenge-response pair from the CRP set corresponding to the UAV based on the LRU strategy. Ensure that each CRP is used only in a single authentication session to avoid security risks caused by reuse;

[0065] (4) The random number generation module generates a 128-bit one-time random number. The authentication challenge module calls the SHA-256 algorithm to calculate... ,in" " indicates a multi-string concatenation operation;

[0066] (5) The communication module will send the message It is encapsulated into a data frame, and after adding error correction codes, it is sent to the drone via a wireless channel.

[0067] Step 3: Chaotic computation (UAV→GS), as follows:

[0068] (1) UAV terminal communication module receives After error correction, the authentication response module extracts... Check if it is a fresh value that has not been used recently; if it is not fresh, terminate the agreement.

[0069] (2) The authentication response module calls the SHA-256 algorithm to calculate ,Will With the received Perform consistency verification; if verification fails, immediately terminate the protocol to avoid establishing communication with unauthorized ground stations.

[0070] (3) The PUF driver module will face challenges Input the PUF module to generate a response. This response is related to the data stored during the registration phase. It is consistent because the physical characteristics of the PUF module ensure that the same challenge input corresponds to the same response output;

[0071] (4) The chaotic key generation module starts the chaotic key generation process:

[0072] First, generate a random number of iterations. and 128-bit random numbers ;Will The 128-bit binary data is converted to a decimal value and then mapped to the initial point of the chaotic system through normalization. ,make sure The value of is in the range of [-1.5, 1.5], which meets the iterative requirements of the Henon mapping; according to the Henon mapping formula... , where parameters ,implement The final state is obtained through the next iteration. ; for the final state After normalization, mapping it to the [0,1] interval, and converting it into a 128-bit binary number, a chaotic key is generated. ;

[0073] (5) The hash operation module calculates the encryption key. And further calculate the session key. This session key will be used for AES-128 encryption of subsequent communication data;

[0074] (6) Using XOR operation Hidden iteration count To prevent attackers from stealing the iteration count and cracking the chaotic key; the hash operation module calculates the verification code. ;

[0075] (7) The communication module will send the message Encapsulated into a data frame, with error correction codes added, it is then sent to the ground station.

[0076] Step 4: Verification and Feedback (GS→UAV), details are as follows:

[0077] (1) Ground station communication module receives After error correction, the message verification module extracts... Check its freshness; if it is not fresh, terminate the agreement.

[0078] (2) Extraction of Chaotic Key Verification Module Using the data stored in the database calculate Through XOR operation Restore iteration count ;

[0079] (3) Chaotic key verification module usage The conversion generates a chaotic initial point consistent with that of the drone. Using the same Henon mapping parameters ,implement The next iteration calculates and generates a chaotic key for verification. ;

[0080] (4) Calculation of the certification challenge module ,Will With the received A consistency check is performed. If the check matches, the drone is deemed legitimate and authentication is successful.

[0081] (5) The ground station and the UAV jointly confirm the session key. The ground station's communication module sends an encrypted "ACK" confirmation message (using... The process involves transmitting AES-128 encryption to the drone, completing a four-way handshake.

[0082] (6) During subsequent communication, both parties use session keys. The transmitted data is encrypted and decrypted using AES-128 to ensure the confidentiality and integrity of the data transmission.

[0083] After successful authentication, all communication data between the UAV and the ground station must be transmitted after being encrypted using AES-128, with CBC encryption mode and initial vector. The random number is dynamically generated by the random number generation module, and a new one is used for each communication session. This further enhances encryption security.

[0084] The validity period of the session key SK is set to a preset duration. After the validity period expires, the drone needs to re-initiate the authentication and key negotiation process to generate a new session key to ensure forward security. If an anomaly is detected during the communication process, the use of the current session key will be terminated immediately and the authentication process will be restarted.

[0085] The rotation of the CRP set is initiated periodically by the ground station. After receiving the request, the UAV generates 100 new challenge values, generates a new CRP set through the PUF module, and sends it to the ground station via a secure channel. The ground station updates the CRP set in the database and deletes the old set to ensure the security and freshness of the CRP set and avoid the risk of it being cracked due to long-term use.

[0086] The above are merely preferred embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A drone authentication and key negotiation system based on PUF and chaotic mapping, characterized in that, It includes a drone terminal and a ground station terminal; the drone terminal integrates a physically unclonable function module, a random number generation module, a hash operation module, a symmetric encryption module, a registration module, an authentication response module, and a chaotic key generation module; the ground station terminal deploys a secure database module, a registration receiving module, an authentication challenge module, a chaotic key verification module, and a message verification module; the drone terminal and the ground station terminal achieve data interaction through a wireless channel, complete the registration and storage of challenge-response pairs through the registration module and the registration receiving module, and achieve two-way authentication and session key negotiation through the authentication response module, the authentication challenge module, the chaotic key generation module, and the chaotic key verification module.

2. The system according to claim 1, characterized in that, The PUF module is of type SRAMPUF or ArbitratorPUF, used to receive random challenge values ​​and output a unique hardware response; the random number generation module is a cryptographically secure random number generator, used to generate one-time random numbers. and the number of iterations of the chaotic mapping ,in All are 128-bit random numbers. The value range is [100, 1000].

3. The system according to claim 1, characterized in that, The hashing module uses the SHA-256 hash function to calculate the message authentication code and key derivative value; the symmetric encryption module uses the AES-128 encryption algorithm for subsequent communication data encryption; the secure database module is an encrypted SQL database that uses the drone's identity identifier as an index to securely store the corresponding CRP set. The database is configured with an access control mechanism, allowing only authorized modules to read the data.

4. The system according to claim 1, characterized in that, The chaotic key generation module is used to map the PUF response to the initial point of the chaotic system and perform Henon mapping iteration to generate a chaotic key; the parameters of the Henon mapping are set to... The iterative process satisfies the formula: ； ;in For the number of iterations, For the first The state value of the next iteration.

5. The system according to claim 4, characterized in that, The chaotic key generation module further includes an initial point mapping unit and a normalization unit; the initial point mapping unit will generate the PUF response. Convert to the initial point of a chaotic system During the conversion process Perform numerical standardization to ensure 、 The range of values ​​for conforms to the iterative requirements of the Henon mapping; Final state of the normalized unit with respect to the Henon mapping Normalization is performed to generate a fixed-length chaotic key. 。 6. The system according to claim 1, characterized in that, The authentication response module includes a random number freshness check unit and a MAC verification unit; the random number freshness check unit is used to verify the random number sent by the ground station. Is it a recent, unused value? The MAC verification unit calculates the local MAC value and compares it with the received MAC value, specifically including calculation... and the received Perform consistency verification.

7. The system according to claim 1, characterized in that, The chaotic key verification module includes an iteration count restoration unit and a chaotic synchronization calculation unit; the iteration count restoration unit performs an XOR operation. Restore the number of chaotic iterations, where ， The encrypted message containing the hidden iteration count is sent from the drone; the chaotic synchronization computation unit uses the restored... and database storage Perform Henon mapping iterations consistent with those on the drone side to generate a chaotic key for verification. 。 8. A method for the UAV authentication and key negotiation system based on PUF and chaotic mapping as described in claims 1 to 7, characterized in that, It includes a registration phase and an authentication and key negotiation phase; the registration phase completes the generation and storage of the CRP set in a secure and trusted environment, and the authentication and key negotiation phase achieves two-way authentication and session key generation through four message interactions.

9. The method according to claim 8, characterized in that, The registration phase specifically includes the following steps: (1) The drone terminal generates a cryptographically secure random number generator. A set of 128 distinct random numbers constitutes the challenge set. ,in (2) Set each challenge as a positive integer; Enter the PUF module sequentially to obtain the corresponding unique response. ,generate A set of challenge-response pairs constitutes the CRP set. (3) The UAV packages its unique identifier ID with the complete CRP set and sends it to the ground station via physical isolation or a secure channel; (4) After receiving the data, the registration and receiving module of the ground station creates an entry for the UAV in the secure database and stores the CRP set encrypted with the ID as the index. (5) The drone terminal securely stores its own identity ID locally and destroys temporary data during transmission to reduce the risk of leakage.

10. The method according to claim 8, characterized in that, The authentication and key negotiation phase specifically includes the following steps: (1) The UAV generates a one-time random number. The message authentication code is calculated using the SHA-256 hash function. , will message (1) The data is transmitted to the ground station via a wireless channel, and error correction codes are added during transmission to improve reliability; (2) The ground station receives the data. Then, check via random number cache. The database entries are checked for freshness; if duplicates are found, the request is rejected. The database entries are iterated through and calculated. and the received Compare and determine the matching drone ID; based on the LRU policy, retrieve the drone's ID from its database. Select unused challenge-response pairs Generate one-time random numbers ,calculate Send message To the drone terminal; (3) drone terminal inspection Freshness, calculation and If the comparison fails and verification fails, the agreement will be terminated. Input the PUF module to get the response ; Generate iteration count and random numbers ,Will Mapped to the initial point of chaos ,implement The final state is obtained through the next iteration of the Henon mapping. After normalization, the generated ;calculate and session key ; via XOR operation Hiding the number of iterations, calculation Send message To the ground station end; (4) Ground station end inspection The freshness, utilizing database storage calculate ,pass Restore the number of iterations; use and Perform synchronous Henon mapping iteration to generate ;calculate If with If the keys match, authentication is successful; both parties confirm the session key. It is used for subsequent AES-128 encrypted communication; the session key is updated periodically, and the CRP set is rotated by the ground station. The UAV generates a new CRP set and completes secure registration.

Images