A method and system for unmanned aerial vehicle data security management

Abstract

This application relates to the field of data security technology, and in particular to a method and system for managing the data security of unmanned aerial vehicles (UAVs). It includes: establishing a shared root key and a basic processing model between the UAV and a ground base station; setting multiple communication cycles based on the UAV's inspection tasks, with the basic processing model preprocessing the inspection data for each communication cycle and generating multiple data sub-packets; setting communication sub-keys for each communication cycle based on the shared root key and the inspection tasks, and generating transmission data packets for each communication cycle based on the encryption results of the data sub-packets using the communication sub-keys; and constructing a verification structure for each transmission data packet. By establishing a shared root key between the UAV and the ground base station and dynamically generating communication sub-keys in each communication cycle, the communication sub-keys are strongly bound to the transmission content. The ground base station can assess the attack risk based on the real-time decryption status, and each derived sub-key chain is independent, meaning that the leakage of a single key will not affect other tasks.

Description

Technical Field

[0001] This application relates to the field of data security technology, and in particular to a method and system for managing the data security of unmanned aerial vehicles (UAVs). Background Technology

[0002] With the widespread application of drones in fields such as power line inspection, environmental monitoring, and disaster assessment, secure data transmission between drones and ground base stations has become a key link in ensuring mission reliability and information confidentiality.

[0003] Drone inspection missions are typically characterized by long durations, multiple communication periods, diverse data types, and complex channel environments. Existing drone data security solutions often employ pre-agreed fixed keys or periodically independent random keys for encryption. With fixed keys, if the key is intercepted, all data throughout the mission is at risk of leakage. While independent random keys offer some security, they require pre-storing or negotiating a large number of keys for each period, leading to a linear increase in key management overhead with the number of communication periods, making them unsuitable for long-duration, high-frequency inspection missions. Furthermore, common solutions often apply a uniform encryption algorithm to all inspection data indiscriminately, ignoring the differences in security, real-time performance, and computational resource consumption among different data types (such as control commands, image information, and sensor data), resulting in unnecessary waste of computing power or insufficient security redundancy. Summary of the Invention

[0004] The purpose of this application is to provide a method and system for managing the data security of unmanned aerial vehicles (UAVs) in order to solve the above-mentioned technical problems and improve the data transmission security of UAVs.

[0005] In some embodiments of this application, a shared root key is established between the UAV and the ground base station, and a communication subkey is dynamically generated in each communication cycle. The communication subkey and the transmitted content are strongly bound together. The ground base station can judge the attack risk based on the real-time decryption status, and each derived subkey chain is independent of each other. The leakage of a single key will not affect other tasks.

[0006] In some embodiments of this application, by adding a basic processing model, personalized encryption can be performed according to different data types, achieving a balance between computational efficiency and security strength. Furthermore, a dual encryption structure is constructed through communication subkeys to ensure the security of UAV data transmission.

[0007] In some embodiments of this application, a method for managing unmanned aerial vehicle (UAV) data security is provided, including: Establish a shared root key and basic processing model for drones and ground base stations; Multiple communication cycles are set according to the inspection tasks of the UAV. The basic processing model preprocesses the inspection data of each communication cycle and generates multiple data sub-packets. Based on the shared root key and the inspection task, communication sub-keys for each communication cycle are set, and transmission data packets for each communication cycle are generated according to the encryption results of data sub-packets using the communication sub-keys. Construct the verification structure for each transmitted data packet.

[0008] In some embodiments of this application, the establishment of the basic processing model includes: Acquire historical data of the drone; Based on the recorded data, a filtering model and multiple data types are set; Select the target data type sequentially from all data types; Select a mapping encryption algorithm for the target data type; Select mapping encryption algorithms for each data type in turn, and build an algorithm sub-library based on all mapping encryption algorithms; Establish a transmission evaluation model; Generate a basic processing model, which includes: a screening model, an algorithm sub-library, and a transport evaluation model.

[0009] In some embodiments of this application, the preprocessing of the inspection data for each communication cycle includes: Obtain inspection data for the current communication cycle; The inspection data is input into the filtering model, and multiple basic sub-packages are output. Each of the aforementioned basic sub-packages includes: data content and type tags; Select the target sub-package sequentially from all the basic sub-packages; Select the target encryption algorithm from the algorithm sub-library based on the type label in the target sub-package; A single data sub-packet is generated based on the encryption result of the target sub-packet using the target encryption algorithm; Generate the transmission evaluation value of the target sub-packet based on the transmission evaluation model; Each basic sub-packet is encrypted sequentially to generate multiple data sub-packets for the current communication cycle; Generate transmission evaluation values ​​for each basic sub-packet; The execution transmission sequence for the current communication cycle is generated based on all transmission evaluation values.

[0010] In some embodiments of this application, setting the communication sub-key for each communication cycle includes: Determine whether the current communication cycle is the first communication cycle; If it is the first communication cycle, obtain the inspection trajectory of the inspection task; Generate a basic hash value based on the inspection trajectory; The communication subkey for the current communication cycle is generated based on the base hash value and the shared root key; If it is not the first communication cycle, select the mapping cycle of the current communication cycle; Auxiliary hash values ​​are generated based on the execution transmission order of the mapping cycle and the basic sub-packets; The communication subkey for the current communication cycle is generated based on the auxiliary hash value and the shared root key.

[0011] In some embodiments of this application, generating the transmission data packets for each communication cycle includes: Retrieve all data sub-packets in the current communication cycle and execute the transmission order; Set the communication subkey of the current communication cycle as the target communication key; The target communication key encrypts the execution transmission order of the current communication cycle, generating the first transmission sub-packet of the current communication cycle; Select the target data sub-packet of the current communication cycle according to the transmission order; The target communication key is used to encrypt the target data sub-packet, generating a single data sub-packet. The target communication key processes each data sub-packet sequentially to generate multiple transmission sub-packets for the current communication cycle; Generate the transmission data packet for the current communication period based on all transmission sub-packets of the current communication period.

[0012] In some embodiments of this application, the construction of the verification structure for each transmitted data packet includes: Retrieve all basic sub-packets in the current communication cycle; Generate verification hash values ​​for each basic sub-package; Generate the verification structure of the transmission data packet corresponding to the current communication cycle based on all basic sub-packets and all verification hash values; Obtain the decryption evaluation value of the ground base station; Determine whether to generate a correction instruction for the verification structure based on the decryption evaluation value.

[0013] In some embodiments of this application, determining whether to generate a correction instruction for the verification structure includes: Determine whether the current communication cycle is the last communication cycle in the inspection task; If it is the last communication cycle; No correction instructions are generated; If it is not the last communication cycle; The communication base station generates a decryption evaluation value for the transmitted data packets of the current communication cycle; When the decryption evaluation value is greater than the preset decryption evaluation value threshold, the data packet of the mapping period of the current communication period is set as the data packet to be corrected. Generate correction instructions for the verification structure of the transmission packet to be corrected; When the decryption evaluation value is less than the preset decryption evaluation value threshold, an early warning command is generated in the current communication cycle.

[0014] In some embodiments of this application, a drone data security management system is provided, including: The central processing unit is used to establish a shared root key and basic processing model for drones and ground base stations; The data unit is used to set multiple communication cycles according to the inspection task of the UAV. The basic processing model preprocesses the inspection data of each communication cycle and generates multiple data sub-packets. The key derivation unit is used to set the communication sub-key for each communication cycle based on the shared root key and the inspection task. The central processing unit includes: The first processing module is used to generate transmission data packets for each communication cycle based on the encryption result of the data sub-packets using the communication sub-key. The second processing module is used to construct the verification structure for each transmitted data packet; The third processing module is used to acquire historical data of the drone; Based on the recorded data, a filtering model and multiple data types are set; Select the target data type sequentially from all data types; Select a mapping encryption algorithm for the target data type; Select mapping encryption algorithms for each data type in turn, and build an algorithm sub-library based on all mapping encryption algorithms; Establish a transmission evaluation model; Generate a basic processing model, which includes: a screening model, an algorithm sub-library, and a transport evaluation model.

[0015] In some embodiments of this application, the data unit includes: The first data module is used to acquire inspection data for the current communication cycle; The inspection data is input into the filtering model, and multiple basic sub-packages are output. Each of the aforementioned basic sub-packages includes: data content and type tags; The second data module is used to select the target sub-package sequentially from all the basic sub-packages; Select the target encryption algorithm from the algorithm sub-library based on the type label in the target sub-package; A single data sub-packet is generated based on the encryption result of the target sub-packet using the target encryption algorithm; Generate the transmission evaluation value of the target sub-packet based on the transmission evaluation model; Each basic sub-packet is encrypted sequentially to generate multiple data sub-packets for the current communication cycle; Generate transmission evaluation values ​​for each basic sub-packet; The execution transmission sequence for the current communication cycle is generated based on all transmission evaluation values.

[0016] In some embodiments of this application, the key derivation unit includes: The judgment module is used to determine whether the current communication cycle is the first communication cycle. In the first communication cycle, the derived module acquires the inspection trajectory of the inspection task. Generate a basic hash value based on the inspection trajectory; The communication subkey for the current communication cycle is generated based on the base hash value and the shared root key; If it is not the first communication cycle, the derived module selects the mapping cycle of the current communication cycle; Auxiliary hash values ​​are generated based on the execution transmission order of the mapping cycle and the basic sub-packets; The communication subkey for the current communication cycle is generated based on the auxiliary hash value and the shared root key.

[0017] Compared with the prior art, the UAV data security management method and system of this application have the following advantages: A shared root key is established between the drone and the ground base station, and a communication subkey is dynamically generated in each communication cycle. The communication subkey and the transmitted content are strongly bound together. The ground base station can judge the attack risk based on the real-time decryption status, and each derived subkey chain is independent of each other. The leakage of a single key will not affect other tasks.

[0018] By adding a basic processing model, personalized encryption can be performed according to different data types, achieving a balance between computational efficiency and security strength. Furthermore, a dual encryption structure can be constructed through communication subkeys to ensure the security of UAV data transmission. Attached Figure Description

[0019] Figure 1 This is a flowchart illustrating a preferred embodiment of a UAV data security management method. Detailed Implementation

[0020] The specific embodiments of this application will be described in further detail below with reference to the accompanying drawings and examples. The following examples are used to illustrate this application, but are not intended to limit the scope of this application.

[0021] In the description of this application, it should be understood that the terms "center", "upper", "lower", "front", "rear", "left", "right", "vertical", "horizontal", "top", "bottom", "inner", "outer", etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing this application and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this application.

[0022] The terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this application, unless otherwise stated, "a plurality of" means two or more.

[0023] In the description of this application, it should be noted that, unless otherwise expressly specified and limited, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection between two components. Those skilled in the art can understand the specific meaning of the above terms in this application based on the specific circumstances.

[0024] like Figure 1 As shown in the preferred embodiment of this application, a method for managing unmanned aerial vehicle (UAV) data security includes: S101: Establish a shared root key and basic processing model for drones and ground base stations; S102: Based on the inspection task of the UAV, multiple communication cycles are set. The basic processing model preprocesses the inspection data of each communication cycle and generates multiple data sub-packets. S103: Based on the shared root key and the inspection task, set the communication sub-key for each communication cycle, and generate the transmission data packet for each communication cycle according to the encryption result of the data sub-packet using the communication sub-key; S104: Construct the verification structure for each transmitted data packet.

[0025] Specifically, during the manufacturing or deployment phase, the drone and the ground base station are written with the same root key in a secure environment (i.e., a shared root key), which is stored in the secure storage areas of both (such as the read-only storage area of ​​the drone's security chip or the encryption module of the ground base station).

[0026] Specifically, multiple communication cycles are set according to the number of devices to be inspected in the inspection task. The time of arrival at a single device point is the start time node of a single communication cycle, and the time of arrival at the next device point in the inspection task is the end time node of the current communication cycle and the start time node of the next communication cycle. That is, only one device point is inspected and data is collected within a single communication cycle.

[0027] Specifically, inspection data refers to all data collected and generated within a single communication cycle, including: collected image and visual data (such as aerial photographs, inspection videos, surveying images, and lidar point cloud data), navigation position data (latitude and longitude, altitude, and precise timestamps), inertial measurement data (three-axis acceleration, angular velocity, attitude angles, etc.), the UAV's own flight status data (battery voltage, current, remaining power, temperature, motor speed, and propeller speed), and mission execution data (arrival time of each waypoint, data acquisition timestamps, mission start and end records, mission area polygons, and shooting parameters such as exposure, focal length, and frame rate).

[0028] Specifically, establishing a basic processing model includes: Acquire historical data of the drone; Filtering models and multiple data types can be set based on recorded data; Select the target data type sequentially from all data types; Select a mapping encryption algorithm for the target data type; Select mapping encryption algorithms for each data type in turn, and build an algorithm sub-library based on all mapping encryption algorithms; Establish a transmission evaluation model; Generate a basic processing model, which includes: a screening model, an algorithm sub-library, and a transport evaluation model.

[0029] Specifically, historical data refers to all data uploaded by UAVs to ground base stations during the execution of historical inspection tasks. By filtering and analyzing historical data, various data types are generated, including but not limited to: image and visual data, navigation position data, inertial measurement data, UAV flight status data, mission execution data, and all data collected and generated by UAVs during the inspection process.

[0030] Specifically, personalized encryption algorithms are selected based on the characteristics of different data types to reduce computational load. For example, for film and visual data, which have large data volumes, high bandwidth pressure, and real-time requirements, lightweight chaotic encryption / selective encryption (encrypting only or key areas) is used as the mapping encryption algorithm. For navigation position data, which is highly sensitive and leakage would have serious consequences, coordinate desensitization + AES-256-GCM encryption is used as the corresponding mapping encryption algorithm. For UAV flight status data, which has continuous data streams, small single packets, and contains sensitive information such as position / attitude, AES-128-CTR or SM4-CTR is used as the corresponding mapping encryption algorithm.

[0031] Specifically, a basic transmission value is set based on the importance of each data type. The more important the current data type, the larger the corresponding basic transmission value. A corresponding correction coefficient is set based on the remaining timeliness of each data sub-packet (each data sub-packet has a latest sending time, and the difference between the current time node and the latest sending time is the remaining timeliness). A transmission evaluation model is constructed based on the mapping relationship between the remaining timeliness and the correction coefficient and all basic transmission values.

[0032] Specifically, the inspection data for each communication cycle is preprocessed, including: Obtain inspection data for the current communication cycle; Input the inspection data into the filtering model and output multiple basic sub-packages; A single basic subpackage includes: data content and type label; Select the target sub-package sequentially from all the basic sub-packages; Select the target encryption algorithm from the algorithm sub-library based on the type label in the target sub-package; A single data sub-packet is generated based on the encryption result of the target sub-packet using the target encryption algorithm; Generate the transmission evaluation value of the target sub-packet based on the transmission evaluation model; Each basic sub-packet is encrypted sequentially to generate multiple data sub-packets for the current communication cycle; Generate transmission evaluation values ​​for each basic sub-packet; The execution transmission sequence for the current communication cycle is generated based on all transmission evaluation values.

[0033] Specifically, the screening model can classify inspection data according to preset data types and generate corresponding basic sub-packages.

[0034] Specifically, the encryption algorithm for mapping the data type corresponding to the type label of the target sub-package is set as the target encryption algorithm.

[0035] Specifically, the data content in the target sub-packet is initially encrypted using the target encryption algorithm to generate a data sub-packet. The transmission evaluation model sets the basic transmission value of the target sub-packet based on the data type corresponding to its type label, and selects a real-time correction coefficient based on the remaining time of the target sub-packet; the shorter the remaining time, the larger the corresponding real-time correction coefficient. The transmission evaluation value of the target sub-packet is generated by multiplying the real-time correction coefficient and the selected basic transmission value.

[0036] Specifically, the higher the transmission evaluation value of the basic sub-packet, the earlier the corresponding data sub-packet will be in the transmission order.

[0037] It is understandable that, in the above embodiments, by adding a basic processing model, personalized encryption can be performed according to different data types, achieving a balance between computational efficiency and security strength, and a dual encryption structure can be constructed through communication subkeys to ensure the security of UAV data transmission.

[0038] In a preferred embodiment of this application, the communication sub-key for each communication cycle is set, including: Determine whether the current communication cycle is the first communication cycle; If it is the first communication cycle, obtain the inspection trajectory of the inspection task; Generate a basic hash value based on the inspection trajectory; The communication subkey for the current communication cycle is generated based on the base hash value and the shared root key; If it is not the first communication cycle, select the mapping cycle of the current communication cycle; Auxiliary hash values ​​are generated based on the execution transmission order of the mapping cycle and the basic sub-packets; The communication subkey for the current communication cycle is generated based on the auxiliary hash value and the shared root key.

[0039] Specifically, the inspection trajectory refers to the expected flight path for completing the inspection of all equipment points during the inspection mission. It is determined by the ground base station and synchronized to the drone before takeoff. Since the drone does not transmit any data before the start of the first communication cycle, the hash value of the inspection trajectory is used as a random number to generate the corresponding communication subkey.

[0040] Specifically, a basic hash value is generated by hashing the inspection trajectory. The shared key and the basic hash value are then concatenated (with the shared root key first and the basic hash value second). The concatenated data is then passed as input key material to the key derivation function (which is synchronously stored in the UAV and ground base station) to generate a communication subkey.

[0041] Specifically, the previous communication cycle of the current communication cycle is set as the mapping cycle of the current communication cycle.

[0042] Specifically, the UAV sorts all the basic sub-packets according to the transmission order to generate an overall data packet, performs hash processing on the overall data packet to generate a corresponding auxiliary hash value, and generates a corresponding communication sub-key by concatenating the auxiliary hash value and the shared root key. The generation rules are the same as those mentioned above.

[0043] Specifically, after decrypting the currently received transmission data packet, the ground base station can obtain the execution transmission order and all basic sub-packets of the current communication cycle, thereby generating the communication sub-key for the next communication cycle.

[0044] Specifically, in each communication cycle, both the drone and the ground base station independently generate communication subkeys.

[0045] Specifically, the transmission data packets for each communication cycle are generated, including: Retrieve all data sub-packets in the current communication cycle and execute the transmission order; Set the communication subkey of the current communication cycle as the target communication key; The target communication key encrypts the execution transmission order of the current communication cycle, generating the first transmission sub-packet of the current communication cycle; Select the target data sub-packet of the current communication cycle according to the transmission order; The target communication key is used to encrypt the target data sub-packet, generating a single data sub-packet. The target communication key processes each data sub-packet sequentially to generate multiple transmission sub-packets for the current communication cycle; Generate the transmission data packet for the current communication period based on all transmission sub-packets of the current communication period.

[0046] Specifically, after encrypting the execution transmission order using the target communication key, the first transmission sub-packet is generated and transmitted to the ground base station. After decryption, the ground base station can determine whether there is an attack risk based on the order in which the remaining transmission sub-packets are received (if the actual transmission order is different from the execution transmission order, there is an attack risk).

[0047] Specifically, after completing the secondary encryption of all data sub-packets using the target communication key, they are sent to the ground base station sequentially according to the transmission order.

[0048] It is understood that in the above embodiments, a shared root key is established between the UAV and the ground base station, and a communication subkey is dynamically generated in each communication cycle. The communication subkey and the transmitted content are strongly bound together. The ground base station can judge the attack risk based on the real-time decryption status, and each derived subkey chain is independent of each other. The leakage of a single key will not affect other tasks.

[0049] In a preferred embodiment of this application, the verification structure for each transmitted data packet is constructed, including: Retrieve all basic sub-packets in the current communication cycle; Generate verification hash values ​​for each basic sub-package; Generate the verification structure of the transmission data packet corresponding to the current communication cycle based on all basic sub-packets and all verification hash values; Obtain the decryption evaluation value of the ground base station; Determine whether to generate a correction instruction for the verification structure based on the decryption evaluation value.

[0050] Specifically, by hashing each basic sub-package, a corresponding verification hash value is generated.

[0051] Specifically, the verification structure is stored in the drone's storage area. When the drone returns after completing its inspection mission, the verification structure is used to determine whether each transmitted data packet has been tampered with, thereby improving the security of the drone's data.

[0052] Specifically, a decryption evaluation value is generated based on the decryption result of the data packets received by the ground base station in the current communication cycle. If the decryption is successful, the decryption evaluation value is set to 1; if the decryption fails, the decryption evaluation value is set to 0.

[0053] Specifically, determining whether to generate a correction instruction for the verification structure includes: Determine whether the current communication cycle is the last communication cycle in the inspection task; If it is the last communication cycle; No correction instructions are generated; If it is not the last communication cycle; The communication base station generates a decryption evaluation value for the transmitted data packets of the current communication cycle; When the decryption evaluation value is greater than the preset decryption evaluation value threshold, the data packet of the mapping period of the current communication period is set as the data packet to be corrected. Generate correction instructions for the verification structure of the transmission packet to be corrected; When the decryption evaluation value is less than the preset decryption evaluation value threshold, an early warning command is generated in the current communication cycle.

[0054] Specifically, the decryption evaluation value threshold ranges from (0,1), and is preferably 0.5 in this application.

[0055] Specifically, when the decryption evaluation value exceeds a preset decryption evaluation value threshold, it indicates that the UAV and the ground base station generated the same communication subkey in the current communication cycle. This indirectly proves that the data packets sent by the UAV and received by the ground base station were the same in the previous communication cycle, eliminating the risk of attack. At this point, according to the correction instruction, the basic sub-packets in the verification structure of the previous communication cycle stored in the UAV are removed, and only the verification hash values ​​corresponding to each basic sub-packet are retained as the verification structure. This reduces the storage load on the UAV.

[0056] Specifically, when the decryption evaluation value is less than the preset decryption evaluation value threshold, it means that the data packets sent by the UAV and the data packets received by the ground base station were different in the previous communication cycle. Therefore, there is a risk that the data was tampered with in the previous communication cycle (i.e. the mapping cycle). At this time, an early warning instruction needs to be generated to eliminate the attack risk in time and re-execute the inspection process of the previous communication cycle.

[0057] Specifically, since the data packets transmitted in the last communication cycle cannot be judged in real time, the verification structure of the last communication cycle is completely saved. When the drone returns, it is compared with the data received by the ground base station in a timely manner to determine whether it has been tampered with, thereby improving the security of drone data.

[0058] In another preferred embodiment of the UAV data security management method based on any of the above preferred embodiments, a UAV data security management system is provided, comprising: The central processing unit is used to establish a shared root key and basic processing model for drones and ground base stations; The data unit is used to set multiple communication cycles according to the inspection task of the UAV. The basic processing model preprocesses the inspection data of each communication cycle and generates multiple data sub-packets. The key derivation unit is used to set the communication subkey for each communication cycle based on the shared root key and the inspection task. The central processing unit includes: The first processing module is used to generate transmission data packets for each communication cycle based on the encryption result of the data sub-packets using the communication sub-key. The second processing module is used to construct the verification structure for each transmitted data packet; The third processing module is used to acquire historical data of the drone; Filtering models and multiple data types can be set based on recorded data; Select the target data type sequentially from all data types; Select a mapping encryption algorithm for the target data type; Select mapping encryption algorithms for each data type in turn, and build an algorithm sub-library based on all mapping encryption algorithms; Establish a transmission evaluation model; Generate a basic processing model, which includes: a screening model, an algorithm sub-library, and a transport evaluation model.

[0059] In a preferred embodiment of this application, the data unit includes: The first data module is used to acquire inspection data for the current communication cycle; Input the inspection data into the filtering model and output multiple basic sub-packages; A single basic subpackage includes: data content and type label; The second data module is used to select the target sub-package sequentially from all the basic sub-packages; Select the target encryption algorithm from the algorithm sub-library based on the type label in the target sub-package; A single data sub-packet is generated based on the encryption result of the target sub-packet using the target encryption algorithm; Generate the transmission evaluation value of the target sub-packet based on the transmission evaluation model; Each basic sub-packet is encrypted sequentially to generate multiple data sub-packets for the current communication cycle; Generate transmission evaluation values ​​for each basic sub-packet; The execution transmission sequence for the current communication cycle is generated based on all transmission evaluation values.

[0060] In a preferred embodiment of this application, the key derivation unit includes: The judgment module is used to determine whether the current communication cycle is the first communication cycle. In the first communication cycle, the derived module obtains the inspection trajectory of the inspection task. Generate a basic hash value based on the inspection trajectory; The communication subkey for the current communication cycle is generated based on the base hash value and the shared root key; If it is not the first communication cycle, the derived module selects the mapping cycle of the current communication cycle; Auxiliary hash values ​​are generated based on the execution transmission order of the mapping cycle and the basic sub-packets; The communication subkey for the current communication cycle is generated based on the auxiliary hash value and the shared root key.

[0061] According to the first concept of this application, a shared root key is established between the UAV and the ground base station, and a communication subkey is dynamically generated in each communication cycle. The communication subkey and the transmitted content are strongly bound together. The ground base station can judge the attack risk based on the real-time decryption status, and each derived subkey chain is independent of each other. The leakage of a single key will not affect other tasks.

[0062] According to the second concept of this application, by adding a basic processing model, personalized encryption can be performed according to different data types, achieving a balance between computational efficiency and security strength. Furthermore, a dual encryption structure is constructed through communication subkeys to ensure the security of UAV data transmission.

[0063] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and substitutions can be made without departing from the technical principles of this application, and these improvements and substitutions should also be considered within the scope of protection of this application.

Claims

1. A method for managing the security of unmanned aerial vehicle (UAV) data, characterized in that, include: Establish a shared root key and basic processing model for drones and ground base stations; Multiple communication cycles are set according to the inspection tasks of the UAV. The basic processing model preprocesses the inspection data of each communication cycle and generates multiple data sub-packets. Based on the shared root key and the inspection task, communication sub-keys for each communication cycle are set, and transmission data packets for each communication cycle are generated according to the encryption results of data sub-packets using the communication sub-keys. Construct the verification structure for each transmitted data packet.

2. The UAV data security management method as described in claim 1, characterized in that, The basic processing model is established, including: Acquire historical data of the drone; Based on the recorded data, a filtering model and multiple data types are set; Select the target data type sequentially from all data types; Select a mapping encryption algorithm for the target data type; Select mapping encryption algorithms for each data type in turn, and build an algorithm sub-library based on all mapping encryption algorithms; Establish a transmission evaluation model; Generate a basic processing model, which includes: a screening model, an algorithm sub-library, and a transport evaluation model.

3. The UAV data security management method as described in claim 2, characterized in that, The preprocessing of inspection data for each communication cycle includes: Obtain inspection data for the current communication cycle; The inspection data is input into the filtering model, and multiple basic sub-packages are output. Each of the aforementioned basic sub-packages includes: data content and type tags; Select the target sub-package sequentially from all the basic sub-packages; Select the target encryption algorithm from the algorithm sub-library based on the type label in the target sub-package; A single data sub-packet is generated based on the encryption result of the target sub-packet using the target encryption algorithm; Generate the transmission evaluation value of the target sub-packet based on the transmission evaluation model; Each basic sub-packet is encrypted sequentially to generate multiple data sub-packets for the current communication cycle; Generate transmission evaluation values ​​for each basic sub-packet; The execution transmission sequence for the current communication cycle is generated based on all transmission evaluation values.

4. The UAV data security management method as described in claim 3, characterized in that, The setting of communication sub-keys for each communication cycle includes: Determine whether the current communication cycle is the first communication cycle; If it is the first communication cycle, obtain the inspection trajectory of the inspection task; Generate a basic hash value based on the inspection trajectory; The communication subkey for the current communication cycle is generated based on the base hash value and the shared root key; If it is not the first communication cycle, select the mapping cycle of the current communication cycle; Auxiliary hash values ​​are generated based on the execution transmission order of the mapping cycle and the basic sub-packets; The communication subkey for the current communication cycle is generated based on the auxiliary hash value and the shared root key.

5. The UAV data security management method as described in claim 4, characterized in that, The generation of transmission data packets for each communication cycle includes: Retrieve all data sub-packets in the current communication cycle and execute the transmission order; Set the communication subkey of the current communication cycle as the target communication key; The target communication key encrypts the execution transmission order of the current communication cycle, generating the first transmission sub-packet of the current communication cycle; Select the target data sub-packet of the current communication cycle according to the transmission order; The target communication key is used to encrypt the target data sub-packet, generating a single data sub-packet. The target communication key processes each data sub-packet sequentially to generate multiple transmission sub-packets for the current communication cycle; Generate the transmission data packet for the current communication cycle based on all transmission sub-packets of the current communication cycle.

6. The UAV data security management method as described in claim 5, characterized in that, The construction of the verification structure for each transmitted data packet includes: Retrieve all basic sub-packets in the current communication cycle; Generate verification hash values ​​for each basic sub-package; Generate the verification structure of the transmission data packet corresponding to the current communication cycle based on all basic sub-packets and all verification hash values; Obtain the decryption evaluation value of the ground base station; Determine whether to generate a correction instruction for the verification structure based on the decryption evaluation value.

7. The UAV data security management method as described in claim 6, characterized in that, The determination of whether to generate a correction instruction for the verification structure includes: Determine whether the current communication cycle is the last communication cycle in the inspection task; If it is the last communication cycle; No correction instructions are generated; If it is not the last communication cycle; The communication base station generates a decryption evaluation value for the transmitted data packets of the current communication cycle; When the decryption evaluation value is greater than the preset decryption evaluation value threshold, the data packet of the mapping period of the current communication period is set as the data packet to be corrected. Generate correction instructions for the verification structure of the transmission packet to be corrected; When the decryption evaluation value is less than the preset decryption evaluation value threshold, an early warning command is generated in the current communication cycle.

8. A drone data security management system, employing the drone data security management method according to any one of claims 1-7, characterized in that, include: The central processing unit is used to establish a shared root key and basic processing model for drones and ground base stations; The data unit is used to set multiple communication cycles according to the inspection task of the UAV. The basic processing model preprocesses the inspection data of each communication cycle and generates multiple data sub-packets. The key derivation unit is used to set the communication sub-key for each communication cycle based on the shared root key and the inspection task. The central processing unit includes: The first processing module is used to generate transmission data packets for each communication cycle based on the encryption result of the data sub-packets using the communication sub-key. The second processing module is used to construct the verification structure for each transmitted data packet; The third processing module is used to acquire historical data of the drone; Based on the recorded data, a filtering model and multiple data types are set; Select the target data type sequentially from all data types; Select a mapping encryption algorithm for the target data type; Select mapping encryption algorithms for each data type in turn, and build an algorithm sub-library based on all mapping encryption algorithms; Establish a transmission evaluation model; Generate a basic processing model, which includes: a screening model, an algorithm sub-library, and a transport evaluation model.

9. The UAV data security management system as described in claim 8, characterized in that, The data unit includes: The first data module is used to acquire inspection data for the current communication cycle; The inspection data is input into the filtering model, and multiple basic sub-packages are output. Each of the aforementioned basic sub-packages includes: data content and type tags; The second data module is used to select the target sub-package sequentially from all the basic sub-packages; Select the target encryption algorithm from the algorithm sub-library based on the type label in the target sub-package; A single data sub-packet is generated based on the encryption result of the target sub-packet using the target encryption algorithm; Generate the transmission evaluation value of the target sub-packet based on the transmission evaluation model; Each basic sub-packet is encrypted sequentially to generate multiple data sub-packets for the current communication cycle; Generate transmission evaluation values ​​for each basic sub-packet; The execution transmission sequence for the current communication cycle is generated based on all transmission evaluation values.

10. The UAV data security management system as described in claim 9, characterized in that, The key derivation unit includes: The judgment module is used to determine whether the current communication cycle is the first communication cycle. In the first communication cycle, the derived module acquires the inspection trajectory of the inspection task. Generate a basic hash value based on the inspection trajectory; The communication subkey for the current communication cycle is generated based on the base hash value and the shared root key; If it is not the first communication cycle, the derived module selects the mapping cycle of the current communication cycle; Auxiliary hash values ​​are generated based on the execution transmission order of the mapping cycle and the basic sub-packets; The communication subkey for the current communication cycle is generated based on the auxiliary hash value and the shared root key.

Images